Researchers Show OpenAI's Compaction Feature Could Expose Hidden AI Reasoning

Security firm Xint has shown that a feature built to shrink long AI conversations could be turned into a way to extract a model's hidden reasoning. OpenAI's reasoning models work through a problem before answering, and the service normally returns that reasoning only as an encrypted item the user cannot read. Xint's method got around protections OpenAI added in August. According to Xint, OpenAI confirmed the problem and fixed it on October 23.

The feature, called compaction, uses a model to squeeze a long conversation into a smaller encrypted item that carries context forward. Xint kept the encrypted reasoning returned for a task, then used compaction on the same model to carry that reasoning into the compacted item. Because compaction items can move between models, Xint then had two cheaper models repeat the item, and each produced the same plain text. The August protections block replaying reasoning into a weaker model, but compaction runs on the same model that produced the reasoning, so it never triggered that check.

There are limits to the findings. Xint tested the technique on its own math and algorithm puzzles, and it did not claim the method could reach another user's reasoning. It also cannot prove the copied text matches the model's real reasoning word for word, because it never had the original to compare against. Xint has published its code on GitHub.