Researchers at security firm Xint found a way around protections OpenAI added this summer and extracted the hidden step-by-step reasoning its models produce, material that rivals could use to train cheaper copies, SecurityWeek reported Monday. OpenAI confirmed and fixed the issue, according to Xint. The case shows that what AI companies sell can leak through ordinary product features.
What Happened
OpenAI's reasoning models, such as gpt-5.6-sol, work through a problem before answering. Developers using OpenAI's application programming interface (API) get only optional summaries of that reasoning; the raw version comes back encrypted, which customers can send back in later turns but cannot read.
In August, academic researchers showed in a paper, "Stealing Reasoning Traces From Proprietary LLM APIs," that encrypted reasoning could be replayed into a weaker model from the same provider and coaxed into plain text. OpenAI responded by blocking reasoning from being replayed into a different model.
Xint's technique, which it calls compaction smuggling, got around that block, according to a company blog post by researcher Tim Becker. Compaction condenses a long conversation into a shorter, encrypted item. Xint removed the original task from a conversation, told the compaction step to preserve the reasoning verbatim and had it swap spaces for tabs, which the post says was enough to get past OpenAI's usage-policy filters. Because compaction runs on the same model that produced the reasoning, the August block did not apply. Xint then handed the compacted item to older models, gpt-4.1 and gpt-4o, and asked them to repeat their input, which returned the reasoning in plain text. It worked at every reasoning-effort setting tested.
Xint says OpenAI confirmed the issue, deployed an undisclosed fix on Oct. 23 and paid a $6,000 bug bounty. Xint acknowledges it cannot prove the output matches the original reasoning word for word, and its demonstration used a single small example.
Why It Matters
Distillation means training a new model on another model's outputs so it picks up the original's skills at a fraction of the cost. Full reasoning is especially valuable for that, which is why providers hide it. Xint argues the flaw would have enabled large-scale distillation of OpenAI's frontier models.
Distillation is now a national security concern. SecurityWeek cited an early-September warning from the Cybersecurity and Infrastructure Security Agency that Chinese firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI had extracted billions of tokens, the word fragments models process, from U.S. frontier models since at least late 2024. OpenAI said in September it had disrupted a reasoning-extraction campaign it tied to Moonshot AI, as The Primary Wire reported, and Anthropic says new defenses have sharply cut what distillers harvest from Claude, The Primary Wire reported this month.
Xint's broader point is that any server-side feature that reads decrypted reasoning and follows customer instructions can become a way to decrypt it.
What to Watch
Watch whether OpenAI describes its fix and whether researchers test similar features at Anthropic, Google and others; Xint's post does not say whether they are affected.
