OpenAI Compaction Flaw Exposed Hidden Model Reasoning, Now Patched
The fix is server-side and needs no developer action, but Xint warns other server-side steps reading decrypted reasoning could leak it too.
Security firm Xint showed that OpenAI's compaction feature, which condenses long conversations, could be abused to extract a reasoning model's normally hidden chain of thought as readable text. The technique slipped past protections OpenAI added in August against cross-model replay, because compaction runs on the same model that produced the reasoning. OpenAI confirmed the issue and patched it on October 23 and paid a $6,000 reward, and developers need not change anything since the fix sits server-side. Xint tested only gpt-5.6-sol and could not verify the copied text matched the original reasoning word for word, nor check whether the newer GPT-6 Astra is affected. Xint also argues that any server-side step reading decrypted reasoning could leak it, so fixing this single path may not be enough.
Why it matters
The episode shows that hiding a model's reasoning depends on every server-side step that touches it, not just on blocks against cross-model replay. Protections built for one path can leave another open when the same model handles both. Because Xint tested only one model version and could not confirm the extracted text matched the original reasoning, the full scope of the exposure remains unclear, and the question of whether similar paths exist elsewhere is still open.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.