Researchers tricked an OpenAI feature into revealing AI's hidden thinking

Security firm Xint showed that an OpenAI feature built to shorten long conversations could be turned into a way to copy out an AI model's hidden thinking as plain, readable text. OpenAI confirmed the problem and fixed it on October 23, according to Xint. It was a demonstration, not an attack seen in the wild.

What happened

OpenAI's reasoning models work through a problem before they answer. The service normally returns that work as an encrypted item that users cannot read. Compaction is a feature that uses a model to squeeze a long conversation into a smaller encrypted item that carries the context forward.

Xint sent a task to gpt-5.6-sol and kept the encrypted reasoning it got back. It then ran compaction on the same model and told it to copy that reasoning in word for word, with every space changed to a tab to get past usage-policy filters. Two cheaper models, gpt-4.1 and gpt-4o, were then asked to repeat the item exactly, and they did.

Why it got past an earlier fix

In August, researchers behind a paper called Stolen Thoughts showed that a strong model's encrypted reasoning could be replayed into a weaker model from the same company, which would repeat it as plain text. OpenAI and others blocked that soon after. Xint says compaction slipped through because it runs on the same model that made the reasoning, so it never triggers the check meant to catch a switch between models.

Why the thinking is kept hidden

OpenAI keeps raw reasoning hidden partly to stop distillation, where one company trains a cheaper model on another's outputs. Raw reasoning makes better training data than a final answer alone, because it shows how the model worked through the problem. That is what makes it worth stealing for a rival.

What is not known

• Xint cannot prove the copied text matches the model's real reasoning, because it never saw the original.
• It tested only gpt-5.6-sol, not OpenAI's newer GPT-6 Astra.
• No one knows if anyone used the trick before the fix.
• Xint argues that fixing one path may not be enough, since any server-side step that reads decrypted reasoning and follows user instructions could leak it.

The test used math and algorithm puzzles the researchers wrote themselves. Xint did not claim the method could reach another user's reasoning.

Who it affects

The fix was on OpenAI's side, so developers who build on its API do not need to change anything. Xint says OpenAI paid the researchers a $6,000 reward. The wider backdrop is real: OpenAI said in September it disrupted a July campaign to expose its models' hidden reasoning, linking a core part to people associated with China's Moonshot AI. None of that is tied to Xint's method.