Security firm Xint demonstrated how OpenAI's conversation compaction feature could be used to extract a model's hidden reasoning into plain text.
The technique bypassed cross-model replay blocks by utilizing the same model for compaction and having cheaper models repeat the output.
OpenAI patched the issue on October 23.
The company's intelligent systems think step by step internally before responding, but the company keeps that reasoning hidden as encrypted data. In August, measures were taken to prevent these thoughts from being transferred to other systems, but the research team at security firm Xint discovered that another feature, which condenses large conversations, could bypass the restriction.
How did the method work?
According to the researchers, the compression process is performed by the same system that generated the thoughts, so security checks are not triggered. By asking the system to copy the thoughts during compression and changing the spaces to parentheses to escape the filters, they were able to feed the result to cheaper models and read it as plain text.
The researchers tested the method on the gpt-5.6-sol model by solving mathematical puzzles. However, they clarified that they cannot prove with certainty that the text they managed to read was word for word identical to the original internal reasoning.
OpenAI's response
OpenAI confirmed the problem and implemented a fix on October 23, and the researchers reported receiving a $6.000 reward. So far, there is no evidence that the method had been used by others before the flaw was closed.
READ ALSO
iPhone test: How six artificial intelligence digital assistants fared in 24 hours
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)