Context compression shouldn’t be treated as a performance optimization. Researchers at Xint discovered that OpenAI’s compaction feature, meant to optimize API costs, could be exploited to extract encrypted reasoning traces from frontier models. By encoding requests with tabs to evade filters and instructing weaker models to echo their input, attackers recovered unencrypted GPT-5.6 reasoning that OpenAI’s August mitigations missed.
The vulnerability worked because compaction itself was the vector. OpenAI’s earlier fix blocked reasoning replay between models, but treated the compaction endpoint as trusted. It wasn’t.
More alarming is the timeline. OpenAI patched October 23; Xint published October 26. That three-day window, coupled with known risks of distillation campaigns targeting chain-of-thought reasoning, suggests the fix may not be airtight. Whether other providers’ compression features share this weakness remains unclear.
Sources: Stealing OpenAI Reasoning Traces via Compaction Smuggling
Coverage: OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections • Stolen AI Reasoning Could Help China Build Cheaper Rivals
Related on this blog: [AUTO] CISA: Chinese AI firms extracting U.S. models at scale • The White House Says Kimi K3 Is Distilled Fable. The Evidence Lives in Anthropic’s Server Logs. • [AUTO] OpenAI’s Agents Exfiltrated User Images