THE SHORT VERSION
- Security firm Xint showed that OpenAI's compaction feature, which shrinks a long conversation into an encrypted item, could be instructed to copy a model's hidden reasoning out in plain text.安全公司 Xint 证明，OpenAI 的压缩功能（把长对话压缩为加密条目）可被指示把模型的隐藏推理复制成明文。
- The technique targeted gpt-5.6-sol and worked around a fix OpenAI shipped in August against replaying encrypted reasoning into weaker models, because compaction runs on the same model that produced the reasoning.该手法针对 gpt-5.6-sol，并绕过了 OpenAI 8 月针对「跨模型重放加密推理」的修复：因为压缩步骤由生成推理的同一模型执行。
- OpenAI confirmed the problem and fixed it on October 23, according to Xint, which says it cannot prove the extracted text is word-for-word the model's reasoning.据 Xint 说法，OpenAI 确认问题并于 10 月 23 日修复；Xint 也表示无法证明取出的文本与模型真实推理逐字一致。
The feature and the flaw功能与漏洞
OpenAI's reasoning models work through a problem before answering, and the service normally returns that reasoning as an encrypted item the user cannot read. Xint, a security firm, found that the compaction feature — which shrinks a long conversation into a smaller encrypted item so the context can carry forward — could be turned into a way to copy the hidden reasoning out as plain text.OpenAI 的推理模型会先思考再回答，服务通常只把这段推理作为用户无法读取的加密条目返回。安全公司 Xint 发现，压缩功能——把长对话压成更小的加密条目以延续上下文——可以被改造成把隐藏推理以明文复制出来的通道。
The method got past protections OpenAI added in August against this kind of reasoning theft, and OpenAI confirmed the problem and fixed it on October 23, according to Xint. The disclosure matters less for what it reveals about one model than for what it says about features that move encrypted state between models.该手法绕过了 OpenAI 在 8 月为阻止此类推理窃取而加的保护；据 Xint 说法，OpenAI 确认了问题并于 10 月 23 日修复。这次披露的意义，与其说在于某一个模型，不如说在于「在模型之间搬运加密状态」这类功能本身。
Asking the model to copy itself让模型复制自己
Xint ran the technique against gpt-5.6-sol using math and algorithm puzzles its researchers wrote themselves. It sent a task, kept the encrypted reasoning the model returned, then called the compaction step on the same model and told it to copy that reasoning into the compacted item word-for-word, changing every space to a tab to get past OpenAI's usage-policy filters.Xint 用自编的数学与算法题目对 gpt-5.6-sol 实施该手法：发送任务、保留模型返回的加密推理，然后对同一模型调用压缩步骤，并要求它把该推理逐字复制进压缩条目，同时把所有空格换成制表符以绕过 OpenAI 的使用政策过滤器。
Because compaction items can move between models, Xint then passed the item to the cheaper gpt-4.1 and gpt-4o models and asked each to repeat its input exactly. Both did. The reasoning that came out came from Xint's own requests, and the firm did not claim the method could reach another user's reasoning.由于压缩条目可在模型之间传递，Xint 随后把该条目传给更便宜的 gpt-4.1 与 gpt-4o，要求各自原样复述输入。两者都照做了。取出的推理来自 Xint 自己的请求，该机构并未声称能接触其他用户的推理。
Why the earlier defence did not cover it8 月的修复为何没覆盖它
In August, researchers behind a paper called Stolen Thoughts showed that encrypted reasoning from a strong model could be replayed into a weaker model from the same company, which would then repeat it as plain text. OpenAI and others blocked that cross-model replay soon after.今年 8 月，一篇名为 Stolen Thoughts 的论文显示，强模型的加密推理可以被重放进同公司的较弱模型，后者会将其作为明文复述。OpenAI 等公司随后封堵了这种跨模型重放。
Compaction got past the block because the compaction step runs on the same model that produced the reasoning, so the operation never looks like the cross-model replay the fix was written for. The lesson is structural: a defence keyed to model boundaries can be bypassed by a feature that legitimately crosses those boundaries itself.压缩之所以能绕过，是因为压缩步骤由生成推理的同一模型执行，因此该操作看起来并不像修复所针对的跨模型重放。教训是结构性的：以模型边界为界的防御，会被一个本身就合法跨越该边界的功能绕开。
What Xint says it cannot showXint 说自己无法证明的部分
Xint says it cannot prove the copied text is word-for-word the model's real reasoning, because it never had the original to compare against. Two cheaper models each repeated the item and produced the same text, which rules out errors in the copying step but leaves open the possibility that compaction reworded the text.Xint 表示无法证明复制出的文本与模型真实推理逐字一致，因为它没有原始推理可供比对。两个更便宜的模型各自复述并给出一致文本，这排除了复制环节的错误，却仍留下「压缩过程可能改写了文本」的可能。
That gap matters for how the finding should be read. If the output is a paraphrase of reasoning rather than the reasoning itself, the exposure is a leak of reasoning content through a different route, not necessarily a bit-exact extraction. Either way, the encrypted item was not as opaque as the design assumed.这一空白决定了结论该如何读。若输出是对推理的改写而非推理本身，暴露的仍是通过另一条路径泄露推理内容，但不一定是逐位一致的提取。无论哪种，加密条目都没有设计所假设的那样不透明。
The part that is a policy question属于政策层面的那一半
The technique deliberately changed spaces to tabs to get past usage-policy filters, which puts part of the story outside the technical layer. Filters that scan for requests to reproduce hidden text are guarding against a behaviour, and a user who rephrases the instruction can test whether the guard is robust.该手法刻意把空格换成制表符以绕过使用政策过滤器，这使故事的一部分落在技术层之外。扫描「要求复现隐藏文本」这类请求的过滤器，防的是一种行为；而换一种说法就能测试这道防线是否牢固。
That is the harder problem for any provider. Adding filters raises the cost of abuse, and it does not close a path that a model is capable of following when asked in the right way. The fix OpenAI shipped on October 23 is the one that matters here; the underlying tension between usability and opacity remains.这对任何服务商都是更难的问题。增加过滤器提高了滥用成本，却没有关闭一条模型在被告知正确方式时能够走通的路。此处关键的是 OpenAI 10 月 23 日的修复；可用性与不透明之间的张力依然存在。
Why reasoning extraction matters beyond one model为什么推理提取不只关乎一个模型
A model's reasoning trace can expose more than an answer: it can reveal the shape of the checks a model applies, the pathways it prefers and, in an agentic setting, the steps it takes before acting. For competitors, that is data about training; for attackers, it is a map of where a system can be steered.推理轨迹泄露的可能不只是答案：它可能暴露模型采用的检查结构、偏好的路径，以及在智能体场景中行动前的步骤。对竞争者而言这是训练数据；对攻击者而言，这是系统可被引导之处的地图。
It also complicates the promise made to users. If reasoning is encrypted because it may contain sensitive prompt content, then a feature that exports it is not a cosmetic bug. The finding joins a series of incidents this year in which the boundary between what a model shows and what it keeps internal turned out to be enforced by convention rather than by architecture.它也让对用户的承诺更复杂。若推理之所以加密是因为可能含敏感提示内容，那么能导出它的功能就不是外观问题。这一发现加入了今年一系列事件：模型展示什么与保留什么之间的边界，由约定而非架构来执行。
What to check next接下来该核查什么
Three things would clarify the risk: whether OpenAI's October 23 fix covers compaction on other models, whether other providers with cross-model context features are affected, and whether vendors publish tests that attempt this class of extraction. None of those is settled in the disclosure reviewed here.三件事能厘清风险：OpenAI 10 月 23 日的修复是否覆盖其他模型上的压缩、其他提供跨模型上下文功能的服务商是否受影响，以及厂商是否公布针对这类提取的测试。已读披露中没有一项得到确定。
Related coverage on this site includes the Claude Code extension compromise, tampered AI hardware changing chatbot answers and Proton's account of its AI reckoning. All three describe the same pattern: the trust boundary moves, and the controls lag behind it.本站相关报道包括 Claude Code 扩展被植入后门、被篡改的 AI 硬件改变聊天机器人回答与 Proton 谈其 AI 清算。三者描述同一种模式：信任边界在移动，而控制措施落后于它。
What a fix on one feature coversWhat a fix on one feature covers
A patch shipped on October 23 closes the path Xint demonstrated, and it says less about other features that move compressed state between models. Context summarisation, memory hand-off and cross-model routing all sit in the same design space, and none of them is addressed in the disclosure reviewed here.10 月 23 日上线的补丁关闭了 Xint 演示的那条路径，但它对「在模型之间搬运压缩状态」的其他功能说明得很少。上下文摘要、记忆交接与跨模型路由都处在同一设计空间，而本次已读披露均未涉及。
That is the practical question for anyone running these systems: whether the fix is a rule about compaction or a rule about exporting encrypted items at all. Only the second would generalise, and the reporting does not say which was implemented.对运行这类系统的人而言，实际问题是：这次修复是针对压缩功能的一条规则，还是针对「导出加密条目」这一整类行为的规则。只有后者才具备通用性，而报道没有说明实现的是哪一种。
Sources & reporting limits来源与核查范围
Follow Products to find related stories on your next visit.关注产品新闻，下次访问时阅读相关文章。
