OpenAI API compaction smuggling could extract reasoning traces

Compaction smuggling uses three API calls to move reasoning

Compaction smuggling moves one model’s reasoning to another model by encoding it inside a compaction. Xint said the process first produces reasoning, then steers a compaction and finally echoes the contents through three API calls.

For its demonstration, Xint sent a task to gpt-5.6-sol with store=False and kept the encrypted reasoning item. The team then asked for the reasoning under a solution key in a JSON object, with every space replaced by a tab, which was enough to slip past OpenAI's usage-policy classifiers.

In one example, the compaction item contained 612 tokens while the reasoning contained 405 tokens. Xint said it could not prove token-for-token fidelity without the original plaintext, a limitation it said the Stolen Thoughts authors also share.

Encrypted reasoning can be replayed into a weaker model

Xint said OpenAI shows API users optional summaries of the reasoning chain from models such as gpt-5.6-sol. The API returns raw reasoning only as an encrypted blob that clients can send back on later turns for server-side decryption.

A paper published in August 2026 showed that encrypted reasoning from a frontier model could be replayed into a weaker model from the same provider and transcribed, according to Xint. Providers deployed mitigations after that disclosure, and the earlier attack no longer reproduced as of August 2026.

Xint said any server-side step that reads decrypted reasoning and takes instructions from the client is a potential decryption oracle. SecurityWeek reported that the earlier mitigations reduced the threat of PII exposure and model poisoning but did not prevent reasoning extraction through compaction smuggling.

OpenAI had already disclosed a hidden-reasoning extraction campaign

OpenAI disclosed on Sep 30 that it had disrupted a campaign extracting hidden reasoning from its models. The campaign peaked at about 16,000 requests from over 4,000 accounts in July, according to OpenAI.

SecurityWeek reported that OpenAI has now also mitigated compaction smuggling, which Xint discovered as a way to bypass OpenAI's earlier mitigations.

CISA warned in early September that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI had extracted billions of tokens across millions of exchanges or requests from U.S. frontier AI models since at least late 2024, according to SecurityWeek.

Xint received a $6,000 bounty for the finding. Its demo script, reasoning_smuggle.py, is available in the team’s GitHub repository.