How Researchers Smuggled OpenAI's Hidden Reasoning Out in Plain Text—And What It Means for AI Security
In October 2026, security firm Xint disclosed a vulnerability in OpenAI's compaction feature that allowed researchers to extract encrypted hidden reasoning traces from OpenAI's gpt-5.6-sol reasoning model in plain text. By manipulating the compaction step—which condenses long conversations into smaller encrypted context items—researchers instructed the model to embed its own reasoning verbatim into the compacted output, then relayed that item to cheaper models (gpt-4.1 and gpt-4o) to reproduce the text. The technique circumvented protections OpenAI had deployed in August 2026 against cross-model reasoning replay. OpenAI confirmed and patched the issue on October 23, 2026, and awarded Xint a $6,000 bug bounty. This incident is directly relevant to a broader wave of AI model intellectual property theft attempts, including a July 2026 campaign OpenAI disrupted that was linked to individuals associated with China's Moonshot AI. As enterprises increasingly depend on proprietary AI reasoning for competitive advantage, attacks targeting hidden chain-of-thought outputs represent a new and growing class of threat—effectively enabling model distillation without direct access to training data.
Kill Chain
