{"id":10166,"date":"2026-10-27T03:22:50","date_gmt":"2026-10-27T03:22:50","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10166"},"modified":"2026-10-27T03:22:50","modified_gmt":"2026-10-27T03:22:50","slug":"openais-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10166","title":{"rendered":"OpenAI\u2019s August fix for theft of reasoning traces was quickly bypassed"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it, and paid a bug bounty for its discovery.<\/p>\n

The problem is that OpenAI had already deployed mitigations for the issue in August after a research report dubbed Stolen Thoughts<\/a> revealed a similar bug that allowed theft of reasoning traces, with possible consequences including large-scale data extraction and the ability for attackers to execute invisible prompt injections and to embed malicious payloads to poison public agentic rollouts. Xint\u2019s discovery bypassed those mitigations.<\/p>\n

OpenAI did not respond to a request for comment.<\/p>\n

Fixing fixes like this is starting to become a trend among the major AI vendors<\/a>, with AWS earlier this month reporting that it had fixed a bug in April, only to then have to refix it in September<\/a>.\u00a0<\/p>\n

Bypassing mitigation<\/h2>\n

Xint is describing the current hole as compaction smuggling. Its blog post about the flaw <\/a>described its researchers\u2019 methodology.<\/p>\n

\u201cOur new technique, compaction smuggling, moves one model\u2019s reasoning to another model by encoding it inside a compaction,\u201d they wrote.<\/p>\n

First, they captured the encrypted reasoning from a designated task, removed the original task from the history, and preserved the reasoning verbatim.<\/p>\n

Then \u201cwe asked for the reasoning under a \u2018solution\u2019 key in a JSON object, with every space replaced by a tab (t), which was enough to slip past OpenAI\u2019s usage-policy classifiers,\u201d the post said. \u201cEncrypted compaction items are still portable, so we sent the compaction item to gpt-4.1 and gpt-4o and asked each to output its input exactly as-is, which they happily did. We then decoded the JSON and converted tabs back into spaces.\u201d<\/p>\n

The post added that the tactic worked \u201cbecause OpenAI\u2019s August mitigations only block replaying reasoning into a different model, and the compaction call runs on the same model that produced the reasoning. The attack worked at every reasoning effort we tried.\u201d<\/p>\n

A hard problem to solve<\/h2>\n

Tim Becker, lead researcher at Xint and the author of the blog post, said in an interview that some of the flaw\u2019s timeline is unknown. For example, the Stolen Papers post went live August 10, but Becker only knows that OpenAI addressed that problem at some point before that date. And, he said,\u00a0OpenAI didn\u2019t publish when it implemented the fix for the issue that Xint reported;\u00a0unlike with traditional patches, an AI model maker can make changes silently. \u201cIt\u2019s sort of security through obscurity,\u201d he said, using a term that historically has meant that something was only protected by the fact that almost no one knew of its existence.\u00a0<\/p>\n

Protecting such a model, Becker said, \u201cis a very fundamentally hard problem to solve,\u201d mostly because of the massive number of changes that today\u2019s models routinely undergo.\u00a0<\/p>\n

The models \u201care a moving target and that is part of the problem. Any mitigation is going to be somewhat brittle,\u201d he said.\u00a0<\/p>\n

As well, Frank Dickson<\/a>, principal analyst at Dickson Research, noted that AI models tend to feed on themselves operationally, which is why Xint\u2019s method worked.<\/p>\n

\u201cCompaction runs on the same model that produced the reasoning, so it sailed past the August mitigation, which only blocked replaying reasoning into a different model,\u201d he said. \u201cSwapping spaces for tabs was enough to slip past the usage-policy classifiers. The vault was locked. The clerk holding the key would still read the letter aloud if you asked nicely. OpenAI did fix the bug it was shown. The trouble is that it was shown only one door.\u201d<\/p>\n

Risk to enterprises<\/h2>\n

Analysts and consultants said this is an immediate big problem for the major AI vendors, but there is a clear secondary risk for enterprise CISOs.\u00a0<\/p>\n

Erik Avakian<\/a>, technical counselor at Infotech, said that the Xint team \u201ccircumvented the protections by using legitimate functionality already built into the platform. For most enterprises, while this specific finding may not rise to the level of an immediate crisis, its significance is that it demonstrates how legitimate AI platform features can be combined to bypass narrowly designed safeguards.\u201d<\/p>\n

\u201cThis can leave organizations exposed to risks that a vendor\u2019s individual patch may not fully address,\u201d he said. \u201cIt reinforces just how difficult it can be to fully address these vulnerabilities in situations where different components of an AI system interact in ways that create unintended risks.\u201d<\/p>\n

Avakian said that this should be a heads-up for the enterprise.\u00a0<\/p>\n

\u201cFor CISOs, the takeaway is that a vendor\u2019s fix for a specific exploit shouldn\u2019t, in and of itself, be treated as proof that the underlying weakness has been comprehensively addressed,\u201d he said. \u201cCISOs should press their AI providers to explain not only how a reported exploit was patched, but also how they were tested across interconnected features and services.\u201d<\/p>\n

Brian Levine<\/a>, a partner with consulting firm Control Risks, added that he thinks CISOs should look at the overall pattern of holes like these that need to be fixed repeatedly.<\/p>\n

\u201cVendors are fixing the specific attack path that was reported, not the underlying class of weakness, and researchers are walking right back in through a side door,\u201d he said. \u201cA patch notice is not proof the risk is gone. Stop treating an AI vendor\u2019s \u2018fixed\u2019 as the end of the conversation. Ask what variant testing was done and build regression notification into your contracts.\u201d<\/p>\n

Jeff Valdes<\/a>, a director at consulting firm Acceligence, shared similar fears.<\/p>\n

\u201cThis is what happens when you treat security as a game of whack-a-mole instead of fixing the underlying plumbing,\u201d Valdes said. \u201cPatching a symptom while leaving the helper pipes wide open isn\u2019t a remediation strategy. It\u2019s just kicking the vulnerability down to the next release. If an attacker can smuggle the model\u2019s internal scratchpad across API boundaries to steal training data, what makes anyone think enterprise prompts and sensitive intermediate context are truly quarantined?\u201d<\/p>\n

In addition, Pieter Arntz<\/a>, malware intelligence researcher at Malwarebytes, observed that this summer\u2019s OpenAI fix was inadequate.\u00a0\u201cThe earlier mitigation was incomplete, which is a fair description of a gap,\u201d Arntz said. <\/p>\n

\u201cRetest after vendor fixes,\u201d he advised. \u201cAs the AWS case shows, a fix in one place can leave other paths open. Verify with your own testing rather than relying on the vendor\u2019s word.\u201d<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said it is almost impossible for the largest AI vendors to not <\/em>approach these big reports piecemeal.\u00a0<\/p>\n

\u201cAI vendors are patching exploits on a surface that grows by several features a month,\u201d he pointed out. \u201cUntil they fix properties instead of paths, CISOs should assume every AI security fix is partial, every encrypted blob is readable, and every vendor guardrail is one encoding trick from irrelevant. The trend is real, and\u00a0\u2018the fix didn\u2019t work\u2019 undersells what is happening.\u201d<\/p>\n

He noted that, in both the OpenAI and AWS cases, the vendor fixed the proof of concept and left the property intact. \u201cPatch the path, keep the property,\u201d he said. \u201cOn platforms assembled from composable features, every new feature is a fresh path to the same asset, and point fixes on a combinatorial surface will keep losing.\u201d<\/p>\n

CISOs unused to the agentic model<\/h2>\n

Mahapatra said the cybersecurity industry should learn lessons from its own history.<\/p>\n

\u201cCryptographers learned this two decades ago with padding oracles: any system that decrypts on a client\u2019s behalf and returns anything derived from the plaintext is an oracle. AI platforms are relearning it with a twist,\u201d he said. \u201cEvery LLM step that can see a secret and accept instructions is an oracle, and natural language is the most expressive oracle interface ever built.\u201d <\/p>\n

He noted that compaction did exactly what it was designed to do, and its portability across models exists so agentic tools like Codex can let users switch models mid-session. \u201cThe feature and the vulnerability are the same capability, which is why fixes keep arriving narrow,\u201d he said.<\/p>\n

But, he argued, the bigger problem is that CISO operations are not yet used to the agentic model way of doing things.\u00a0<\/p>\n

\u201cAI platform flaws arrive with no CVE, no advisory, and no patch notes. Enterprise vulnerability management, built on CVE feeds and vendor advisories, is blind to its most consequential new suppliers,\u201d Mahapatra said. \u201cCISOs should write security notification obligations into AI provider contracts, assign someone to track researcher disclosures against the platforms they use, and ask one question after every vendor fix: did you fix the report or the class, and what variant analysis supports that answer?\u201d<\/p>\n

He also raised questions about the small size of the bounty paid to Xint.\u00a0<\/p>\n

\u201cA $6,000 bounty for a bug enabling exactly the industrial-scale distillation the NSA, CISA, and FBI warned about in a joint advisory in September is a pricing signal that researchers with other buyers will notice,\u201d he said.\u00a0<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it, and paid a bug bounty for its discovery. The problem is that OpenAI had already deployed mitigations […]<\/p>\n","protected":false},"author":0,"featured_media":10167,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10166","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10166"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10166"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10166\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10167"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}