OpenAI paid security firm Xint a $6,000 bounty for a flaw that walked straight past the protections it added in August to stop theft of its models’ hidden reasoning. The size of the reward, and the silent way the fix shipped, raise awkward questions for anyone in the UK who relies on AI platforms or runs a bounty programme of their own.
What happened
On Monday 26 October, Xint published research describing a technique it calls “compaction smuggling”. The method extracted the raw reasoning traces that OpenAI’s frontier reasoning models produce before answering, material the company deliberately keeps out of view and hands to API customers only in encrypted form.
Xint says it found the problem in August 2026 and reported it to OpenAI, which confirmed the issue. According to the researchers, a fix was deployed on 23 October without any public announcement, and the team received a $6,000 reward. CSO Online reported that OpenAI did not respond to its request for comment.
The finding matters because it is a bypass of an earlier fix. In August, the academic Stolen Thoughts paper demonstrated that encrypted reasoning could be fed into a less capable model from the same vendor and persuaded back into readable text. Providers, OpenAI included, closed that route. Xint found another way in within weeks.
The technical picture
OpenAI’s API includes a feature called compaction, which uses a model to shrink lengthy chat history into a compact encrypted object so that context can be carried forward. Those compacted items are portable between models, a design choice that lets agentic tools switch models mid-session without losing their place.
Xint’s insight was that the compaction step itself could see the decrypted reasoning and would follow the caller’s instructions about what to keep and how to format it. Because compaction ran on the same model that generated the reasoning, it never tripped the August control, which only stopped reasoning being moved into a different model. The researchers also report that a trivial change to text formatting was enough to get past OpenAI’s usage-policy classifiers. Cheaper models, gpt-4.1 and gpt-4o, were then used to read the compacted item back out.
There are important limits. Only gpt-5.6-sol was tested, and The Hacker News notes that OpenAI’s newer GPT-6 Astra was not checked. The recovered reasoning came from Xint’s own requests, so cross-customer access is not suggested, and Xint admits it cannot prove word-for-word fidelity. Whether the technique was abused before the fix is unknown; API developers need take no action because the remedy sat on OpenAI’s side.
Raw reasoning, with its false starts and corrections, makes far better training data than a final answer, which makes it prized for distillation: training a cheaper rival model on a frontier model’s output. On 30 September OpenAI reported breaking up a July operation targeting its hidden reasoning, and a joint NSA, CISA and FBI advisory in September warned of industrial-scale distillation efforts. None of it is linked to Xint’s research demonstration.
Why it matters for UK organisations
For UK businesses using an AI API, the direct risk is low. The wider lessons are not.
First, the disclosure model looks very different from what vulnerability management teams are used to. No CVE was assigned and nothing was published. A change was made on the provider’s servers and customers only learnt of it because the researchers chose to publish. Tim Becker, Xint’s lead researcher, told CSO that such silent changes were “sort of security through obscurity”. Supplier assurance built on CVE feeds and vendor bulletins will simply miss this.
Second, the reward is a signal. OpenAI runs its programme through Bugcrowd and in 2025 raised its top payout for exceptional critical findings to $100,000. Paying $6,000 for a bypass of a control the company itself had prioritised after a public paper tells researchers where the bar sits. Aman Mahapatra of Tribeca Softech told CSO the figure was “a pricing signal that researchers with other buyers will notice”. If grey-market buyers value the same capability more highly, low rewards risk pushing findings away from coordinated disclosure.
Third, the legal backdrop for UK researchers is still unsettled. Testing a commercial AI platform outside an authorised programme can sit uncomfortably with section 1 of the Computer Misuse Act 1990. In Lords Grand Committee on 7 September, the minister said the Home Office proposes a defence for accredited cyber security researchers, but no accreditation scheme yet exists, and Computer Weekly reported the government would act only “as soon as parliamentary time allows”. Until that changes, a well-scoped bounty or disclosure programme remains a UK researcher’s best legal cover, which makes the terms and rewards of those programmes more important, not less.
Expert view
What strikes me most is the pattern rather than the bug. A vendor fixes the exact path in the report, a researcher finds an adjacent route to the same asset, and the cycle repeats. When we test complex platforms, the first finding is rarely the last; it usually points at a property of the system that has several ways in. Rewarding the bypass at the level of a routine web application bug suggests the programme is pricing the proof of concept, not the weakness it exposed.
In my experience, bounty programmes that reward variant analysis and root-cause findings generously get far better long-term value than those paying per path. Paying a bonus for defeating a previous fix is a sensible way to surface remediation that was too narrow.
There is a fair counterpoint: the impact falls mainly on OpenAI’s intellectual property rather than customer data, and bounty tables have always weighted user harm above commercial loss. Even so, after months of warnings that distillation is a national security concern, a mid-tier reward sits awkwardly.
What to do now
- Add AI providers to your supplier risk register properly. Treat model APIs as critical suppliers where they process sensitive prompts or drive business processes, and assign someone to track public researcher disclosures against them.
- Write notification duties into contracts. Ask AI vendors to commit to telling you about security fixes that affect your data or integrations, even when no CVE is issued, and to describe what variant testing followed.
- Do not treat “fixed” as the end. Where you depend on a vendor control, retest after their remediation and log the result.
- Control what reaches the model. Map Cyber Essentials secure configuration and access control to AI use: restrict which staff and systems hold API keys, rotate them, and keep regulated data out of prompts unless you have assessed the risk.
- Review your own programme. If you run a bounty or vulnerability disclosure policy, check that it gives clear authorisation and safe harbour wording for UK researchers, covers AI features, and rewards bypasses of earlier fixes at least as well as the original finding.
Bottom line
Compaction smuggling is fixed and poses little direct risk to most UK organisations. Its value lies in what it reveals: AI platform fixes can be narrow and silent, and bounty rewards may not match the risks vendors talk about publicly. Buyers should demand better notification, and programme owners should pay for the class of weakness, not just the path.
Sources
- Xint: Stealing OpenAI Reasoning Traces via Compaction Smuggling
- The Hacker News: OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
- CSO Online: OpenAI’s August fix for theft of reasoning traces was quickly bypassed
- BleepingComputer: OpenAI now pays researchers $100,000 for critical vulnerabilities
- Computer Weekly: Government rejects Computer Misuse Act amendment to protect cyber professionals
- PK Sharma: A Computer Misuse Act defence, gated on accreditation that does not exist
