Stolen AI Reasoning Could Help China Build Cheaper Rivals

What it is

Compaction Smuggling is a bypass found by Xint for OpenAI's August 2026 mitigations against stealing reasoning traces from proprietary LLM APIs. The August paper, "Stealing Reasoning Traces from Proprietary LLM APIs", showed that encrypted reasoning from a frontier model can be replayed into a weaker model from the same provider, which can then be coerced into transcribing it. OpenAI confirmed the bypass, fixed it and paid Xint a $6,000 bounty on 23 October 2026.

How it works

Context compaction compresses conversation history, tool calls and workspace state into a summary before the context window overflows. The attack uses that step to carry reasoning between models. The page gives three steps:

1. Submit a task to a strong model (the page's example is gpt-5.6-sol) to obtain reasoning.
2. Steer or shape the compaction that comes back.
3. Send the result to a different model (gpt-4.1 or gpt-4o) with a request to output its input exactly as-is. Xint reports the models "happily did".

The August mitigations only block replaying reasoning into a different model. The compaction call runs on the same model that produced the reasoning, so it was not covered. Xint says the attack worked at every reasoning effort level it tried. The page says the full process is more complex than this outline and does not give it.

Preconditions / Affected

The page names OpenAI models only. Source reasoning came from gpt-5.6-sol, and the decoding models were gpt-4.1 and gpt-4o. The attacker needs ordinary API access, since the technique uses the public API and its compaction feature. The page says the result enables large-scale distillation of frontier OpenAI models.

What to do

The page gives no action for API consumers: OpenAI has already fixed the issue. For providers that expose reasoning or compaction, the lesson is that a same-model-only replay restriction left compaction as a path around it. The page does not say whether other providers are affected by this specific bypass.

Caveats

The page's distillation threat rests on a CISA warning from early September 2026. It says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, "likely with Chinese government awareness", extracted billions of tokens across millions of requests from Claude, GPT, Gemini and Grok models since at least late 2024. It adds that DeepSeek has run organized campaigns targeting reasoning capabilities to train R1 and V3. The page does not say anyone used Compaction Smuggling itself for this.