Xint Details Compaction Smuggling Attack Leaking OpenAI Reasoning Traces
Xint researchers describe 'compaction smuggling,' a technique reported to leak raw reasoning traces from OpenAI frontier models by encoding encrypted reasoning inside a compaction. The attack uses three API calls: generating reasoning with store=False, steering a compaction call with instructions to preserve reasoning verbatim, and having same-family models echo the compaction output. The authors say OpenAI confirmed the issue and deployed a fix on October 23, 2026, and that they received a $6,000 bounty. They note they cannot prove token-for-token fidelity without the original plaintext.
Open original source xint.ioOne primary source; other links are context, not independent corroboration.
- Primary sourceX discovery · automated brief
- Discovery linkX
- Linked in sourceStolen Thoughts paper
- Linked in sourceGhostCompact post
- Linked in sourceearlier work by Matthew Green
- Linked in sourcejoint advisory
- Linked in sourcereported
- Linked in sourcedisclosed
- Linked in sourceGitHub repository
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
- Linked article+30
- Fetched source page+30
- No editor link review0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
Xint researchers describe 'compaction smuggling,' a technique reported to leak raw reasoning traces from OpenAI frontier models by encoding encrypted reasoning inside a compaction. The attack uses three API calls: generating reasoning with store=False, steering a compaction call with instructions to preserve reasoning verbatim, and having same-family models echo the compaction output. The authors say OpenAI confirmed the issue and deployed a fix on October 23, 2026, and that they received a $6,000 bounty. They note they cannot prove token-for-token fidelity without the original plaintext.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: xint.io. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
Source claims not independently checked; the authors state they cannot verify that the compaction output reflects the original reasoning token-for-token.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- The attack uses three API calls: produce encrypted reasoning, steer a compaction with instructions, then echo the compaction through other models.
- The technique works because August mitigations blocked replaying reasoning into a different model, not the same-model compaction call.
- The authors report OpenAI confirmed the issue and deployed an undisclosed fix on October 23, 2026.
- The authors cannot prove token-for-token fidelity without the original plaintext reasoning.
Source claims not independently checked; the authors state they cannot verify that the compaction output reflects the original reasoning token-for-token.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
Security firm Xint says its compaction-smuggling attack got around the mitigations OpenAI added after the 'Stolen Thoughts' paper, exposing raw encrypted reasoning from frontier models such as gpt-5.6-sol and enabling distillation. OpenAI confirmed it, deployed an undisclosed fix on Oct 23 and paid a $6,000 bounty. The Hacker News and CSO Online followed up. Researcher-reported.
Source claims not independently checked; the authors state they cannot verify that the compaction output reflects the original reasoning token-for-token.
Engagement counts, when shown, are observed snapshots. They do not establish accuracy or corroboration.
- x post ↗ · 406 likes, 35 reposts, 8 replies, 3 quotes · observed 10/27/2026, 4:11:28 PM
- Related post ↗
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The write-up argues that server-side steps reading decrypted reasoning and accepting client instructions can act as decryption oracles. If accurate, this shows that protections against reasoning-trace extraction may need to cover compaction features too, relevant to ongoing concerns about industrial-scale model distillation.
Limits and open questions
Source claims not independently checked; the authors state they cannot verify that the compaction output reflects the original reasoning token-for-token.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.