WORLDTECHXint details new OpenAI API flaw that leaks reasoning traces
Cybersecurity research firm Xint has published details of a flaw in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models. OpenAI has confirmed the problem, says it has mitigated it and paid a bug bounty for the discovery, yet the protections it introduced in August did not hold against the new technique.
August protections did not stop the new route
OpenAI had already introduced mitigations in August, after a research report dubbed Stolen Thoughts exposed a similar bug that allowed reasoning traces to be stolen. According to the verified facts, that earlier flaw could have enabled large-scale data extraction, invisible prompt injections by attackers, and malicious payloads capable of poisoning public agentic rollouts.
Xint describes the current weakness as compaction smuggling, a method it says bypasses those August mitigations.
What Xint published and OpenAI's reply
Xint released its findings on Monday. The bug exposes raw reasoning traces, which the firm says points to the risk of further data leaks. OpenAI did not respond to a request for comment.
Repeated fixes across the sector
Having to revisit fixes is becoming a pattern among major AI vendors. AWS reported earlier this month that it had repaired a bug in April, only to have to repair it again in September.
Open questions
- Which OpenAI models and API configurations are affected by the new flaw?
- Has OpenAI deployed a fix that fully closes the compaction smuggling technique?