Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 Reasoning Traces

Researchers at Xint found an OpenAI API flaw that exposed hidden reasoning in GPT-5.6 models by routing prompts through a conversation-compaction feature.

The method, called compaction smuggling, bypassed protections introduced in August 2026. According to Xint, OpenAI confirmed the bug, deployed an undisclosed fix on October 23, and awarded the team a $6,000 bounty.

The finding shows how a feature built to preserve conversation context could become a path around model security controls. Xint discovered the issue in August and published its technical report on October 26.

OpenAI reasoning models work through problems before returning answers. API users can receive summaries, but the raw reasoning stays encrypted.

Applications can return that data during later requests, allowing OpenAI’s servers to decrypt it and restore context without exposing the text directly.

Compaction serves a related purpose. It shrinks long conversations into encrypted items that retain useful information. Xint found that this process could read decrypted reasoning while also following instructions supplied by the API user. That combination created the opening.

OpenAI API Flaw Exploit

The researchers first sent math and algorithm puzzles to gpt-5.6-sol with store=False, keeping the returned encrypted_content. They then removed the original task and called /responses/compact, asking it to preserve the reasoning rather than summarize it. Removing the question reduced the chance that the model would solve the puzzle again.

The team requested a JSON object with a “solution” field, replacing spaces with tabs. Xint said this formatting change bypassed OpenAI’s usage-policy filters. The team then passed the resulting encrypted compaction separately to gpt-4.1 and gpt-4o, which repeated its contents as readable text.

The attack followed the Stolen Thoughts research, which showed that weaker models could expose encrypted reasoning from stronger models. Cybersecurity News previously covered those hidden reasoning leaks across major AI APIs. Providers introduced protections after that disclosure.

Xint said OpenAI’s August controls blocked direct reasoning replay into another model. Compaction avoided that check because it ran on the model that originally produced the reasoning. Once copied into a compaction item, the content could move to older models. The method worked across every reasoning effort level tested.

Both decoder models returned identical text. However, Xint could not prove an exact match with the original hidden reasoning because it lacked the plaintext for comparison. One example contained 405 reasoning tokens, a 612-token compaction, and 609 tokens in each echoed output.

The main risk is unauthorized distillation, where another model learns from extracted outputs. Reasoning traces can provide valuable training material because they include failed attempts and corrections, not just final answers.

Unlike the separate OpenAI sandbox escape report, this finding concerned reasoning access rather than unauthenticated model use. Xint’s demonstration used its own requests, not another customer’s conversations. Its central warning is that every server-side feature handling decrypted reasoning needs equivalent protections, even when its output remains encrypted.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 Reasoning Traces appeared first on Cyber Security News.