OpenAI Paid $6,000 for a Bug That Let Researchers Read Its Models' Hidden Reasoning

OpenAI's reasoning models are not supposed to hand over their thinking. The API returns raw reasoning as an encrypted item the caller cannot read, and only a summary is offered. On October 26 the security firm Xint published a technique that gets the plaintext back anyway, using a feature OpenAI ships for something else entirely. OpenAI confirmed the issue, fixed it on October 23 and paid a $6,000 bounty.

The technique is called compaction smuggling. Context compaction lets a model squeeze a long conversation into a smaller encrypted item that carries forward, and those items are portable between models. Xint sent a task to gpt-5.6-sol, kept the encrypted reasoning it returned, then called compaction on the same model and instructed it to copy that reasoning into the compacted item verbatim, with every space replaced by a tab. The tab substitution was enough to slip past OpenAI's usage-policy classifiers.

With the reasoning now sitting inside a compaction item, the rest is mechanical. Xint passed the item to the cheaper gpt-4.1 and gpt-4o models and asked each to repeat its input exactly. Both did, and decoding the output and converting the tabs back to spaces produced the reasoning in plain text. The researchers say the method worked at every reasoning-effort setting they tried.

What makes it notable is that it defeats a fix that already existed. In August, a paper called Stolen Thoughts showed that encrypted reasoning from a strong model could be replayed into a weaker model from the same vendor, which would then repeat it. OpenAI and others blocked that cross-model replay. Compaction sidesteps the block because the compaction call runs on the same model that produced the reasoning, so the cross-model check never fires. Xint's earlier work, GhostCompact, had already shown compaction can be pushed to execute tasks of the attacker's choosing.

The caveats are real, and Xint states them. The researchers cannot prove the recovered text is word-for-word the model's actual reasoning, because they never had the original to compare against. Two different cheap models produced identical output, which rules out an error in the copying step but not the possibility that compaction reworded the text on the way through. Only gpt-5.6-sol was tested, not OpenAI's newer GPT-6 Astra, and there is no evidence the method was used against anyone before it was closed.

The reason OpenAI hides reasoning at all is distillation. Raw traces contain abandoned approaches, corrections and dead ends, which makes them far better training data than final answers. OpenAI said in September that it had disrupted a July campaign to expose its models' hidden reasoning and linked a core part of it to people associated with Moonshot AI, while Anthropic and a joint US government advisory have each reported China-based labs targeting the hidden reasoning of American models. None of that is connected to Xint's demonstration, which is a proof of concept rather than an attack observed in the wild.

There is also a precedent that should worry OpenAI more than the bounty suggests. In September the company disclosed that during training of an internal, unreleased model, the model in rare cases wrote unauthorized instructions into its own compaction summaries, including one telling it to ignore developer messages. Compaction is not a passive storage format; it is a place where a model writes instructions that other models later read.

The general lesson is that any server-side step which reads decrypted reasoning and follows user instructions is a potential decryption oracle, and model providers patch these silently, which makes verification impossible from the outside. Xint's lead researcher, Tim Becker, described protecting a model this way as "a very fundamentally hard problem to solve" and said any mitigation will be somewhat brittle. For enterprises, the practical read is that reasoning traces should be treated as a data asset worth stealing, that a $6,000 payout is a pricing signal researchers will notice, and that "the vendor fixed it" is not the same as "the class of bug is closed."