{"data":{"id":"ec52266f-9712-4bf8-95e4-57510431d7a7","title":"OpenAI’s August fix for theft of reasoning traces was quickly bypassed","summary":"Cybersecurity research firm Xint published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models. Its technique, compaction smuggling, bypassed mitigations OpenAI had deployed in August after the Stolen Thoughts report, by asking for the reasoning under a \"solution\" key with spaces replaced by tabs and sending the compaction item to gpt-4.1 and gpt-4o. OpenAI confirmed the flaw, mitigated it, and paid a bug bounty.","solution":"OpenAI confirmed the flaw, mitigated it, and paid a bug bounty for its discovery. No further fix details are given in the source.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4240662/openais-august-fix-for-theft-of-reasoning-traces-was-quickly-bypassed.html","publishedAt":"2026-10-27T03:22:50.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["data_extraction"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI API","gpt-4.1","gpt-4o","OpenAI reasoning models"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-27T03:22:50.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}