OpenAI API flaw leaked hidden model reasoning traces

Security firm Xint found a flaw in OpenAI's API, dubbed 'compaction smuggling,' that let it extract raw reasoning traces from frontier models via the context compaction feature. OpenAI confirmed the issue, fixed it on October 23 and paid a $6,000 bug bounty.

• Xint hid GPT-5.6 Sol reasoning in a compaction and recovered it via GPT-4.1 and GPT-4o
• The attack succeeded at every reasoning-effort setting tested
• OpenAI deployed a fix on October 23 and paid a $6,000 bounty
• The technique could enable large-scale distillation of frontier models