Reasoning models such as GPT-5.6 Sol generate intermediate reasoning before producing answers. OpenAI does not provide API users with the complete raw reasoning in readable form, instead offering optional summaries. This restriction helps protect against distillation, a process in which developers train smaller models using outputs from more advanced systems. Full reasoning traces can provide particularly useful training data because they contain intermediate steps, incorrect approaches and self-corrections.
The API stores raw reasoning in encrypted items that clients can return during later interactions but cannot directly decode. OpenAI also encrypts conversation compactions, which condense lengthy exchanges into smaller items while preserving relevant context.
The discovery follows an August 2026 study titled Stealing Reasoning Traces from Proprietary LLM APIs. The researchers behind that study demonstrated that encrypted reasoning could be replayed into weaker models from the same provider and reproduced as text.
The approach affected models from OpenAI, Anthropic and Google, although OpenAI’s safeguards made extraction more difficult. Subsequent protections reportedly stopped the original technique from working.
Xint discovered that the compaction feature offered another route. The researchers first generated reasoning using GPT-5.6 Sol and retained its encrypted reasoning item. They then removed the original task from the conversation history and instructed the compaction process to preserve the reasoning verbatim in a JSON object. Replacing spaces with tab characters helped the content evade usage-policy classifiers.
The resulting encrypted compaction was then submitted to GPT-4.1 and GPT-4o, which were instructed to reproduce the contents exactly. After decoding the JSON and converting tabs back into spaces, the researchers recovered the reasoning trace.
The technique worked across all tested reasoning-effort settings, from minimal to maximum. In the demonstration, the original reasoning item contained 405 tokens, compared with 612 tokens in the compaction and 609 tokens in each echoed output.
Xint compared outputs from two models using different prompts and obtained identical results.
Although the original plaintext was unavailable for a definitive token-by-token comparison, the recovered trace retained its false starts, corrections and characteristic writing style.
The researchers developed the technique while investigating GhostCompact and examining how encrypted compactions could be transferred between models.
The findings raise concerns about large-scale extraction of proprietary AI capabilities.
In September 2026, U.S. agencies warned about industrial-scale model distillation campaigns. Anthropic subsequently reported seven campaigns attributed to China-based laboratories, while OpenAI disclosed disrupting an effort that generated approximately 16,000 requests from more than 4,000 accounts in July.
Xint concluded that server-side processes handling decrypted reasoning while accepting client-controlled instructions can become potential extraction pathways. The researchers said compaction features require protections comparable to those applied to raw reasoning traces.
