Disclosed weakness · no CVE recorded

OpenAI compaction research exposes hidden reasoning traces

OpenAI; reported by Xint · OpenAI Responses API compaction; gpt-5.6-sol

First documented disclosure · Review checkpoint

Summary

Xint demonstrated extraction of hidden reasoning through compaction despite earlier replay restrictions.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Controlled research. Reviewed evidence does not establish malicious use of this technique.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A client-directed compaction transformed reasoning into another portable encrypted context item that other models could echo.

Conditions required

API access and reasoning generated by the researcher’s own gpt-5.6-sol requests.

Potential impact

Exposure of protected reasoning and potential unauthorized distillation; customer-data theft was not demonstrated.

Affected versions and configurations

Tested gpt-5.6-sol service behavior before remediation; gpt-4.1 and gpt-4o served as decoders. No installable version range.

Fix and mitigation status

Xint reports OpenAI deployed a service-side fix October 23, 2026; implementation details are undisclosed.

Practical next steps

Service-side remediation reported; treat every client-directed transformation of protected context as a security boundary.

Operating lesson

Encryption alone does not prevent a trusted transformation from disclosing protected context.

Evidence and limits

Xint cannot prove token-for-token fidelity to the original plaintext. Do not attribute separate distillation campaigns to this technique. October 26 is public disclosure; discovery was in August.

Sources