OpenAI Reasoning Trace Leak Bypassed August Safeguards Through Compaction

The OpenAI API flaw reported by cybersecurity firm Xint shows how a safeguard can fail when it covers one route through a system but leaves related features available. Xint says its researchers used a feature called compaction to move raw reasoning traces and retrieve them from other models, bypassing protections OpenAI had introduced in August. OpenAI confirmed the flaw, mitigated it and paid Xint a bug bounty.

The immediate issue is access to reasoning traces. The wider concern for AI providers and enterprise customers is how platform features interact: a restriction on one model-to-model path did not prevent the researchers from using a same-model operation and then transferring the resulting data. The episode adds to a pattern of reported fixes that address a demonstrated method while leaving room for another route.

A second route through compaction

Xint calls its technique “compaction smuggling.” The method, described in the firm’s account of the flaw, used encrypted reasoning preserved in a compaction item. The researchers first captured the reasoning associated with a task, removed that original task from the conversation history, and kept the reasoning intact.

They then placed the material under a “solution” key in a JSON object and replaced spaces with tab characters. Xint said that formatting change was enough to get past OpenAI’s usage-policy classifiers. The researchers sent the compaction item to GPT-4.1 and GPT-4o and asked the models to reproduce their input exactly. After decoding the JSON and changing the tabs back into spaces, they had the reasoning text.

The key detail is where the August safeguard applied. According to Xint, OpenAI’s mitigation blocked replaying reasoning into a different model. Compaction, however, ran on the same model that had produced the reasoning, so the researchers could use it to prepare the item for transfer. Xint said its approach worked at every reasoning-effort setting it tested.

The earlier issue had been described in a research report called Stolen Thoughts. That report raised concerns that reasoning traces could be extracted at scale and potentially used for invisible prompt injections or to place malicious payloads in public agentic rollouts. Xint’s finding indicates that OpenAI’s August response did not close every route to the same underlying data.

Why a patch can miss the property

Tim Becker, Xint’s lead researcher and the author of its report, said the timeline around the first mitigation is unclear. Stolen Thoughts appeared on August 10, but Becker said he only knew that OpenAI had addressed that earlier issue at some point before then. OpenAI did not publish when it implemented the fix for Xint’s finding, either. Unlike a conventional software patch, changes to an AI model or service can be made without a public release note.

Becker described protection as “a very fundamentally hard problem to solve” because models and their surrounding systems change frequently. “They are a moving target and that is part of the problem,” he said. “Any mitigation is going to be somewhat brittle.” That moving target makes it harder to know whether a patch will hold when a feature is combined with another capability, or when the service changes after testing.

Frank Dickson, principal analyst at Dickson Research, focused on the relationship between compaction and the original safeguard. Compaction ran on the model that created the reasoning, he said, while the August mitigation covered replay into a different model. Tab substitution then helped the data pass the platform’s classifiers. Dickson likened the result to a locked vault whose contents could still be read aloud by someone with access to the key. “OpenAI did fix the bug it was shown,” he said. “The trouble is that it was shown only one door.”

There is a broader industry parallel. AWS reported fixing an AI agent control issue in April, then had to address it again in September, according to CSO’s coverage. The recurrence has prompted comparisons with other problems in the AI vendor ecosystem. In both cases, the lesson for security teams is that a reported attack path can be narrower than the weakness that made it possible.

What enterprise security teams should ask

For most companies, Xint’s specific finding may not require an emergency response. Erik Avakian, technical counselor at Infotech, said its value lies in showing how legitimate platform functions can be combined to get around safeguards designed for individual features. That interaction can leave an organization exposed even after a vendor has addressed the exploit it was first shown.

Avakian’s advice for CISOs is to ask how the provider tested the fix across connected features and services. A vendor’s statement that a particular exploit has been patched does not establish that the weakness has been addressed throughout the system. Testing should account for the ways components work together, especially when a feature can carry information between models or steps in an agent workflow.

Brian Levine, a partner at Control Risks, urged security teams to look at the repeated pattern of narrow repairs. “A patch notice is not proof the risk is gone,” he said, recommending questions about variant testing and security notifications. Jeff Valdes, a director at Acceligence, likewise argued that patching an exposed route leaves a deeper problem if the supporting functions remain accessible. His concern is that the same kind of data movement could put enterprise prompts or intermediate context at risk.

Pieter Arntz, a malware intelligence researcher at Malwarebytes, called the earlier mitigation incomplete and recommended retesting after vendor fixes. “Verify with your own testing rather than relying on the vendor’s word,” he said. That advice reflects a practical gap in AI security operations: companies may not receive the familiar vulnerability notices and patch details they use to track conventional software flaws.

Agent features complicate security tracking

Aman Mahapatra, chief strategy officer at Tribeca Softech, said vendors face a growing set of features and may respond to major reports one exploit at a time. In his view, the more durable goal is to address the underlying system property rather than each route researchers uncover. On platforms built from connected capabilities, adding features can create new ways to reach the same sensitive data.

Mahapatra compared the issue to padding-oracle problems in cryptography: a system that decrypts information for a user and returns anything derived from the plaintext can reveal information through its responses. AI adds a conversational interface. As he put it, “Every LLM step that can see a secret and accept instructions is an oracle, and natural language is the most expressive oracle interface ever built.”

Compaction illustrates the tradeoff. Its portability lets users move between models during a session, including in agentic tools such as Codex. That convenience is also part of the route researchers used. Mahapatra’s point is that security fixes can be difficult to make comprehensive when the feature that creates exposure also serves a legitimate purpose.

He also said enterprise vulnerability programs may miss AI platform flaws when those programs depend on CVE feeds and conventional vendor advisories. His recommendations include setting security notification expectations in provider contracts, assigning someone to track researcher reports affecting the platforms in use, and asking vendors whether a fix addresses the specific report or the broader class of weakness—and what testing supports that claim.

Mahapatra questioned the signal sent by the $6,000 bounty Xint received, arguing that compensation can affect where researchers choose to report findings. For enterprise teams, the more immediate takeaway is operational: record which AI services handle sensitive context, follow disclosures that affect those services, and retest relevant workflows after a fix. Xint’s report suggests that in systems where models can carry information across features, the quality of a repair depends on how widely its surrounding paths have been examined.