--- title: OpenAI’s August fix for theft of reasoning traces was... description: Security firm Xint found a new way to steal raw reasoning traces from OpenAI models, bypassing an August fix for a similar bug. The technique, called... canonical: https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenAI’s August fix for theft of reasoning traces was quickly bypassed | daily.dev og:description: Security firm Xint found a new way to steal raw reasoning traces from OpenAI models, bypassing an August fix for a similar bug. The technique, called... og:url: https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq og:image: https://api.daily.dev/og/posts/VSyWsPmnq.png og:image:alt: OpenAI’s August fix for theft of reasoning traces was quickly bypassed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenAI’s August fix for theft of reasoning traces was quickly bypassed **[CSO Online](https://daily.dev/sources/csoonline)** · 8 min read · 0 upvotes · 0 comments ## Summary Security firm Xint found a new way to steal raw reasoning traces from OpenAI models, bypassing an August fix for a similar bug. The technique, called compaction smuggling, moves one model's reasoning to another by encoding it inside a compaction object. Researchers asked for the reasoning under a 'solution' key with spaces swapped for tabs, which slipped past OpenAI's usage-policy classifiers. They then sent the compaction item to gpt-4.1 and gpt-4o, which output it as-is. OpenAI confirmed the flaw and mitigated it, and paid a bug bounty. The August mitigation only blocked replaying reasoning into a different model, but this attack ran on the same model that produced the reasoning. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is compaction smuggling in OpenAI models? Compaction smuggling is a technique that moves one model's reasoning trace to another by encoding it inside a compaction object. Researchers captured encrypted reasoning, requested it back under a 'solution' JSON key with spaces replaced by tabs to evade usage-policy classifiers, then had gpt-4.1 and gpt-4o output the compaction item verbatim, revealing the original reasoning after decoding. _Teams building on reasoning models can track emerging LLM exploit techniques like this one on daily.dev._ ### Why did OpenAI's August fix for reasoning trace theft fail to stop the new attack? The August mitigation only blocked replaying captured reasoning into a different model, but the new compaction smuggling attack runs the compaction call on the same model that originally produced the reasoning, so it never triggered that cross-model block. The attack reportedly worked at every reasoning effort level tested. _Anyone evaluating AI vendor security patches can follow how these fixes get bypassed on daily.dev._ ### How much was the bug bounty paid for the OpenAI compaction smuggling vulnerability? OpenAI paid a $6,000 bug bounty to Xint for discovering and reporting the compaction smuggling flaw that leaked raw reasoning traces from frontier models. One analyst called this a low pricing signal given the bug enabled the kind of industrial-scale model distillation that the NSA, CISA, and FBI warned about in a joint September advisory. _Security teams weighing AI vendor risk can track bug bounty outcomes like this on daily.dev._ ## Similar posts on daily.dev - [OpenAI was breached by a smarter model, not a new bug](https://daily.dev/posts/openai-was-breached-by-a-smarter-model-not-a-new-bug-bgdul0oun) · Kilo Blog · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#openai](https://daily.dev/tags/openai), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenAI’s August fix for theft of reasoning traces was quickly bypassed","url":"https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq"},"datePublished":"2026-10-27T03:25:34.177Z","dateModified":"2026-10-27T04:27:52.545Z","description":"Security firm Xint found a new way to steal raw reasoning traces from OpenAI models, bypassing an August fix for a similar bug. The technique, called...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/435530c4cbd511dbae81a290380211b9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/435530c4cbd511dbae81a290380211b9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,openai,prompt-injection","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"OpenAI’s August fix for theft of reasoning traces was quickly bypassed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openai-s-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed-vsywspmnq#faq","mainEntity":[{"@type":"Question","name":"What is compaction smuggling in OpenAI models?","acceptedAnswer":{"@type":"Answer","text":"Compaction smuggling is a technique that moves one model's reasoning trace to another by encoding it inside a compaction object. Researchers captured encrypted reasoning, requested it back under a 'solution' JSON key with spaces replaced by tabs to evade usage-policy classifiers, then had gpt-4.1 and gpt-4o output the compaction item verbatim, revealing the original reasoning after decoding. Teams building on reasoning models can track emerging LLM exploit techniques like this one on daily.dev."}},{"@type":"Question","name":"Why did OpenAI's August fix for reasoning trace theft fail to stop the new attack?","acceptedAnswer":{"@type":"Answer","text":"The August mitigation only blocked replaying captured reasoning into a different model, but the new compaction smuggling attack runs the compaction call on the same model that originally produced the reasoning, so it never triggered that cross-model block. The attack reportedly worked at every reasoning effort level tested. Anyone evaluating AI vendor security patches can follow how these fixes get bypassed on daily.dev."}},{"@type":"Question","name":"How much was the bug bounty paid for the OpenAI compaction smuggling vulnerability?","acceptedAnswer":{"@type":"Answer","text":"OpenAI paid a $6,000 bug bounty to Xint for discovering and reporting the compaction smuggling flaw that leaked raw reasoning traces from frontier models. One analyst called this a low pricing signal given the bug enabled the kind of industrial-scale model distillation that the NSA, CISA, and FBI warned about in a joint September advisory. Security teams weighing AI vendor risk can track bug bounty outcomes like this on daily.dev."}}]} ```