Cybersecurity researchers have demonstrated a way to expose hidden reasoning from an OpenAI model by exploiting its conversation compaction feature. The technique reportedly bypassed protections introduced earlier to prevent reasoning extraction, but OpenAI has since fixed the issue.
Security firm Xint said the method allowed researchers to retrieve text associated with a model’s internal reasoning by manipulating how OpenAI compresses long conversations. OpenAI confirmed the issue and fixed it on October 23, according to the researchers.
OpenAI’s reasoning models process problems before generating their final answers. The service normally keeps raw reasoning hidden, returning it through encrypted items rather than exposing it as ordinary readable text. This helps protect sensitive internal model information and reduces the risk of competitors using it to train competing systems.
Xint tested the technique against gpt-5.6-sol, one of OpenAI’s reasoning models, using mathematical and algorithmic puzzles created by its researchers. The firm said the extracted text came from the researchers’ own requests and did not demonstrate access to another user’s conversations or reasoning.
The technique relies on OpenAI’s compaction feature, which compresses lengthy conversations into smaller items that preserve context for subsequent interactions. According to Xint, researchers first sent a task to the reasoning model and retained the encrypted reasoning item it returned. They then invoked compaction on the same model and instructed it to reproduce the reasoning in the compacted output, changing spaces to tabs to evade usage-policy filters.
Researchers subsequently passed the compacted item to less expensive models, including GPT-4.1 and GPT-4o, and asked them to reproduce their input exactly. Xint said both models returned the same text, suggesting the copying process worked as intended.
However, the researchers acknowledged that they could not establish whether the extracted text matched the model’s original reasoning word for word. They did not have access to the original decrypted reasoning for comparison, leaving open the possibility that the compaction process had rephrased or otherwise altered the content.
The discovery follows earlier research published in August under the name Stolen Thoughts. That research demonstrated how encrypted reasoning from a more capable model could be replayed into a weaker model from the same provider, which could then reproduce the content in plain text. OpenAI and other companies subsequently introduced protections against this type of cross-model replay.
Xint said the compaction technique bypassed those protections because the compaction operation ran on the same model that generated the original reasoning. As a result, the process did not trigger the cross-model checks designed to prevent the earlier attack.
The research builds on Xint’s previous work, called GhostCompact, which demonstrated that the compaction process could be manipulated to perform tasks selected by an attacker. The firm has also published related code in its GitHub repository.
According to Xint, the fix was implemented by OpenAI, meaning developers using the API do not need to make changes to their applications. The researchers described the resolution as an undisclosed fix and said OpenAI awarded them $6,000 for the discovery.
The researchers tested only gpt-5.6-sol and did not establish whether GPT-6 Astra, a newer OpenAI model, was affected. They also said there was no evidence showing whether anyone had exploited the technique before the issue was fixed.
Xint warned that the broader security concern could extend beyond this particular method. In its assessment, server-side processes that can access decrypted model reasoning and follow instructions supplied through a conversation could create potential paths for exposing information that is normally kept hidden.
The finding also highlights the commercial importance of protecting internal reasoning traces. Such information can provide more detailed examples of how a model approaches complex problems, making it valuable for distillation, a process in which the outputs of a more capable model are used to train a smaller or less expensive one.
OpenAI has previously reported efforts to prevent attempts to extract hidden reasoning from its models. However, Xint emphasized that its compaction demonstration was separate from those reported campaigns and was not evidence of an attack observed in the wild.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
