Threat reportVulnerabilityTL-2026-4575
OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden GPT-5.6 Reasoning Traces
OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden (TL-2026-4575), also tracked as Compaction Smuggling, is a medium-severity software vulnerability, first published 2026-10-27. It has no confirmed attribution, affects OpenAI OpenAI API (Responses API /responses/compact), maps to 6 MITRE ATT&CK / ATLAS techniques (AML.T0024, AML.T0051, AML.T0054), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4575
- Threat ID
- TL-2026-4575
- Also known as
- Compaction Smuggling, Stolen Thoughts bypass
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, artificial-intelligence
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden works
Xint researchers demonstrated 'compaction smuggling', a technique abusing OpenAI's /responses/compact conversation-compaction feature to expose encrypted GPT-5.6 reasoning data as readable text. Replacing spaces with tabs evaded usage-policy filters, and the compaction item was relayed to weaker models (gpt-4.1, gpt-4o) that echoed it verbatim. OpenAI confirmed the bug, paid a $6,000 bounty and deployed an undisclosed server-side fix on 2026-10-23.
Xint (research led by Tim Becker) disclosed on 2026-10-26 a bypass of OpenAI's August 2026 mitigations against theft of encrypted reasoning traces. The August protections were introduced after the 'Stolen Thoughts' research (Panfilov et al., published 2026-08-10, arXiv 2608.09867), which showed that encrypted chain-of-thought blocks returned by frontier APIs could be replayed into weaker sibling models that share the same encryption key, causing them to emit the stronger model's reasoning in plaintext. OpenAI's August mitigations blocked replaying reasoning into a different model.
Compaction smuggling circumvents that control by staying inside the originating model's ecosystem for the decryption step. The attacker first sends math or algorithm puzzles to gpt-5.6-sol with store=False and retains the returned encrypted_content reasoning item. The original task is removed from the context and the /responses/compact endpoint is called with an instructions parameter asking the compaction step to preserve the reasoning rather than summarize it, copying it word for word into the compacted item as JSON under a 'solution' key. Every space is replaced with a tab character so that usage-policy classifiers do not recognize the content. In the PoC, a 405-token reasoning item produced a 612-token compaction item.
Because compaction items are portable between models, the attacker then passes the compaction item to gpt-4.1 and gpt-4o and asks each to repeat its input exactly; each returned roughly 609 tokens of readable text, which is decoded from the JSON and has tabs restored to spaces. Xint characterizes the compaction service as a decryption oracle: any server-side step that reads a model's decrypted reasoning and follows user-supplied instructions can leak it. Xint classified the issue as CWE-200 and CWE-347. Researchers could not verify that the extracted text matched the model's original reasoning verbatim, only that multiple cheaper models reproduced identical output.
The primary risk is unauthorized distillation: reasoning traces, including failed attempts and corrections, are high-value training data for smaller models. Context in the source material notes a joint NSA/CISA/FBI advisory on industrial-scale distillation (September 2026) and OpenAI's 2026-09-30 disclosure of a disrupted distillation campaign of about 16,000 requests. No in-the-wild exploitation of compaction smuggling, CVE or CVSS score has been reported. A proof-of-concept script (compaction_smuggle.py) was published on GitHub. OpenAI confirmed the bug, applied a server-side fix requiring no developer action, and awarded a $6,000 bounty. The details of the fix are undisclosed, and severity is an analyst estimate.
MITRE ATT&CK / ATLAS techniques used in TL-2026-4575
Exfiltration
AML.T0024 Exfiltration via AI Inference API
Execution
AML.T0051 LLM Prompt Injection
Defense Evasion
AML.T0054 LLM Jailbreak; T1027 Obfuscated Files or Information
Collection
Initial Access
Affected products and versions in OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden
- OpenAI — OpenAI API (Responses API /responses/compact)
Vulnerable versions: gpt-5.6-sol reasoning items prior to 2026-10-23; gpt-4.1 and gpt-4o as decoder models
Fixed in: Server-side fix deployed 2026-10-23
Remediation for OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden
Patches
- OpenAI server-side fix deployed 2026-10-23 (details undisclosed)
Immediate actions
- No developer action required: OpenAI deployed a server-side fix on 2026-10-23
- Monitor API usage for repeated /responses/compact calls with store=false and unusual instructions parameters
- Review API logs for compaction items relayed to different models than the one that produced them
Workarounds
- None published; the fix is applied by the vendor
Longer-term hardening
- Treat any server-side step that decrypts reasoning and follows user instructions as a potential decryption oracle
- Apply rate limiting and anomaly detection for distillation-style bulk extraction of reasoning output
- Normalize whitespace and encoding before applying usage-policy classifiers
Weaknesses (CWE) in OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden
Timeline of OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden
- 'Stolen Thoughts' research (Panfilov et al.) published, showing encrypted reasoning traces from frontier APIs can be replayed into weaker sibling models to recover plaintext reasoning
- Stolen Thoughts attack confirmed no longer reproducible
- OpenAI discloses a disrupted distillation campaign of about 16,000 requests, illustrating the distillation threat model
- OpenAI deploys an undisclosed server-side fix for compaction smuggling and awards a $6,000 bounty
- Xint publishes its technical report and PoC (compaction_smuggle.py) on GitHub
- Cyber Security News, The Hacker News, CSO Online and others report the flaw
Sources cited for OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden
- Stealing OpenAI Reasoning Traces via Compaction Smuggling - Xint
- Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 Reasoning Traces
- OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections - The Hacker News
- OpenAI's August fix for theft of reasoning traces was quickly bypassed - CSO Online
- OpenAI Compaction Flaw Exposed AI Reasoning to Researchers - Infosecurity Magazine
- Researchers Discover OpenAI API Vulnerability That Leaks Hidden AI Reasoning Traces - GBHackers
- Stealing reasoning traces (Stolen Thoughts) - Simon Willison's Weblog
Detection coverage for TL-2026-4575
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4575 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.