OpenAI Compaction Flaw Exposed Hidden Model Reasoning to Researchers

Compaction Feature Exploited

Security firm Xint identified a vulnerability in OpenAI's compaction feature, which is designed to condense long conversations. This flaw enabled researchers to copy a model's internal reasoning processes, typically encrypted and inaccessible to users, into plain text.

Bypassing Existing Protections

The technique successfully circumvented security measures OpenAI had introduced in August to prevent this type of reasoning extraction. OpenAI's reasoning models typically process a problem internally before generating an answer, with the raw reasoning usually returned as an unreadable encrypted item. Xint confirmed that OpenAI acknowledged the problem and deployed a fix on October 23.

Methodology and Scope

Xint tested the method against gpt-5.6-sol, one of OpenAI's reasoning models, using custom math and algorithm puzzles. The extracted reasoning corresponded to these specific requests; Xint did not claim the method could access other users' reasoning. While Xint could not definitively prove the extracted text was an exact replica of the model's original reasoning, testing with two cheaper models that reproduced the same text ruled out copying errors, though compaction-induced rephrasing remains a possibility.

How the Bypass Worked

The compaction feature uses a model to compress a conversation into a smaller, encrypted item that retains context. Xint sent a task to gpt-5.6-sol, captured its encrypted reasoning, and then instructed the same model to copy that reasoning into a compacted item, replacing spaces with tabs to avoid usage policy filters. This compacted item was then passed to gpt-4.1 and gpt-4o, which were asked to repeat their input, successfully revealing the reasoning. The method bypassed OpenAI's cross-model replay block because the compaction step occurred on the same model that generated the reasoning, thus not triggering the cross-model check.

Developer Impact

The fix for this vulnerability was implemented on OpenAI's backend, meaning developers utilizing the API do not need to make any changes to their applications.