Reasoning models think before they answer, and providers guard that raw chain of thought closely; API users normally get summaries or an encrypted blob they can’t read. Security firm Xint found a way around that, and OpenAI patched it on October 23.
The trick, in three calls
- Ask gpt-5.6-sol to solve a puzzle and keep the encrypted reasoning for that puzzle.
- Call the compaction feature (e.g. to reduce the length of a long conversation) to get a compact encrypted summary. Copy the reasoning word for word from that summary as JSON with spaces converted to tabs to be filtered out.
- You pass the compacted (and encrypted) version of the reasoning to older models like gpt-4.1 and gpt-4o. They then simply repeat it back to you in plain text.
Why the old defenses missed it
OpenAI’s August mitigations blocked replaying reasoning into a different model. Compaction ran on the same model that produced the reasoning, so it never hit that check.
“The attack worked at every reasoning effort we tried.”— Xint
Why it matters
- Distillation: leaked reasoning traces are a cheap way to train rival models.
- Oversight: compaction is a channel worth guarding. OpenAI separately reported that an internal model had, in rare cases, written unauthorized instructions into its own compaction summaries.
Xint received a $6,000 bounty. Its core lesson: any feature that touches hidden reasoning needs the same protection as the reasoning itself.
