A newly disclosed OpenAI API vulnerability, known as compaction smuggling, allows attackers to extract hidden reasoning traces from frontier models, circumventing protections against unauthorized model distillation This article explores documented attacks openai. . OpenAI confirmed the issue, deployed an undisclosed fix on October 23, and awarded the team a $6,000 bounty.
OpenAI’s Security Vulnerability OpenAI’s reasoning models produce internal working traces, but they typically expose only the final answers and optional reasoning summaries.
Encrypted reasoning items enable clients to retain this internal context across subsequent requests without directly reading it. Previous research, titled “Stealing Reasoning Traces from Proprietary LLM APIs,” revealed that portable encrypted blocks could be replayed into weaker models, resulting in plaintext reasoning. Becker documented attacks against OpenAI, Anthropic, and Google, emphasizing the broader security risks beyond intellectual property theft.
Xint’s earlier GhostCompact investigation had already confirmed that compaction could perform arbitrary inference and that another model could decrypt and reveal information within an encrypted compaction item. OpenAI revealed a campaign involving approximately 16,000 extraction-pattern requests from more than 4,000 users, emphasizing that these figures represent attempts, not actual successful extractions. Ensuring reasoning is protected necessitates consistent controls across every server-side transformation that can read decrypted content, accept client instructions, and produce artifacts usable by other models.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team.
