Security firm Xint says it found a way, which it calls compaction smuggling, to copy the raw chain-of-thought of OpenAI reasoning models out of the API. OpenAI normally returns that reasoning only as an encrypted item the client can't read, partly to stop competitors training smaller models on it.

• How it worked: three API calls. Get the encrypted reasoning from gpt-5.6-sol, then call /responses/compact on the same model with instructions to copy that reasoning verbatim into a JSON field, with spaces swapped for tabs to slip past usage-policy classifiers. Because compaction items are portable, gpt-4.1 or gpt-4o would then simply echo the contents back.
• Why the earlier fix missed it: after the August "Stolen Thoughts" paper, providers blocked replaying reasoning into a different model. Compaction runs on the same model that produced the reasoning, so that check didn't apply.
• Limits: Xint only extracted reasoning from its own requests and does not claim access to other users' data. It also says it can't prove the output is word-for-word the original trace, only that two decoder models produced identical text.

The risk here is mostly to the model provider (large-scale distillation), not to API customers. The takeaway for anyone building agent platforms: an encrypted or opaque context item is only as safe as every server-side feature that can read it and every model that will accept it.