# OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden GPT-5.6 Reasoning Traces

> Xint researchers demonstrated 'compaction smuggling', a technique abusing OpenAI's /responses/compact conversation-compaction feature to expose encrypted GPT-5.6 reasoning data as readable text. Replacing spaces with tabs evaded usage-policy filters, and the compaction item was relayed to weaker models (gpt-4.1, gpt-4o) that echoed it verbatim. OpenAI confirmed the bug, paid a $6,000 bounty and deployed an undisclosed server-side fix on 2026-10-23.

- **Published:** 2026-10-27T22:26:21Z
- **Last reviewed:** 2026-10-27T22:26:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4575
- **ID:** TL-2026-4575
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Xint (research led by Tim Becker) disclosed on 2026-10-26 a bypass of OpenAI's August 2026 mitigations against theft of encrypted reasoning traces. The August protections were introduced after the 'Stolen Thoughts' research (Panfilov et al., published 2026-08-10, arXiv 2608.09867), which showed that encrypted chain-of-thought blocks returned by frontier APIs could be replayed into weaker sibling models that share the same encryption key, causing them to emit the stronger model's reasoning in plaintext. OpenAI's August mitigations blocked replaying reasoning into a different model.

Compaction smuggling circumvents that control by staying inside the originating model's ecosystem for the decryption step. The attacker first sends math or algorithm puzzles to gpt-5.6-sol with store=False and retains the returned encrypted_content reasoning item. The original task is removed from the context and the /responses/compact endpoint is called with an instructions parameter asking the compaction step to preserve the reasoning rather than summarize it, copying it word for word into the compacted item as JSON under a 'solution' key. Every space is replaced with a tab character so that usage-policy classifiers do not recognize the content. In the PoC, a 405-token reasoning item produced a 612-token compaction item.

Because compaction items are portable between models, the attacker then passes the compaction item to gpt-4.1 and gpt-4o and asks each to repeat its input exactly; each returned roughly 609 tokens of readable text, which is decoded from the JSON and has tabs restored to spaces. Xint characterizes the compaction service as a decryption oracle: any server-side step that reads a model's decrypted reasoning and follows user-supplied instructions can leak it. Xint classified the issue as CWE-200 and CWE-347. Researchers could not verify that the extracted text matched the model's original reasoning verbatim, only that multiple cheaper models reproduced identical output.

The primary risk is unauthorized distillation: reasoning traces, including failed attempts and corrections, are high-value training data for smaller models. Context in the source material notes a joint NSA/CISA/FBI advisory on industrial-scale distillation (September 2026) and OpenAI's 2026-09-30 disclosure of a disrupted distillation campaign of about 16,000 requests. No in-the-wild exploitation of compaction smuggling, CVE or CVSS score has been reported. A proof-of-concept script (compaction_smuggle.py) was published on GitHub. OpenAI confirmed the bug, applied a server-side fix requiring no developer action, and awarded a $6,000 bounty. The details of the fix are undisclosed, and severity is an analyst estimate.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1027 Obfuscated Files or Information
- T1119 Automated Collection
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak
- AML.T0024 Exfiltration via AI Inference API

## Sources

- [Stealing OpenAI Reasoning Traces via Compaction Smuggling - Xint](https://xint.io/blog/compaction-smuggling-reasoning-traces)
- [Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 Reasoning Traces](https://cybersecuritynews.com/researchers-exploit-openai-api-flaw/)
- [OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections - The Hacker News](https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html)
- [OpenAI's August fix for theft of reasoning traces was quickly bypassed - CSO Online](https://www.csoonline.com/article/4240662/openais-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed.html)
- [OpenAI Compaction Flaw Exposed AI Reasoning to Researchers - Infosecurity Magazine](https://www.infosecurity-magazine.com/news/openai-compaction-flaw-ai/)
- [Researchers Discover OpenAI API Vulnerability That Leaks Hidden AI Reasoning Traces - GBHackers](https://gbhackers.com/researchers-discover-openai-api-vulnerability/)
- [Stealing reasoning traces (Stolen Thoughts) - Simon Willison's Weblog](https://simonwillison.net/2026/Aug/11/stealing-reasoning-traces/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4575