Xint Demonstrates OpenAI Compaction Flaw That Could Expose Hidden Reasoning
Summary
Xint says a compaction prompt could copy reasoning returned by OpenAI’s gpt-5.6-sol into an encrypted item, which cheaper models repeated as text. OpenAI fixed the issue Oct. 23; Xint could not verify the text was verbatim or whether it was exploited.
Key points
- Xint demonstrated a method to copy reasoning from its own gpt-5.6-sol requests through OpenAI’s compaction feature; it did not claim access to other users’ reasoning.
- The method asked the same model to copy its encrypted reasoning into a compacted item, changing spaces to tabs, then had gpt-4.1 and gpt-4o repeat the item as text.
- Xint said using the same model for compaction bypassed a prior cross-model replay check.
- Xint could not establish whether the copied text matched the model’s original reasoning word-for-word; it said the compaction step may have reworded it.
- OpenAI fixed the issue on October 23. Xint said developers using the API did not need to make changes.
- Xint tested only gpt-5.6-sol, did not test GPT-6 Astra, and said it was unknown whether the method had been used before the fix.
- The demonstration was not reported as an in-the-wild attack and was unrelated to other campaigns targeting hidden model reasoning.
Article Details
- Vulnerability Types
- Hidden reasoning disclosure through compaction
- Affected Versions
- gpt-5.6-sol
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available