OpenAI, Grok, Claude and Gemini don’t simply help us, they have also been tricked into helping China produce cheap rivals.
Frontier AI generally includes a public API to let developers interface specialized apps with their AI engine. It allows a user application to query the AI and receive a response. The response generally includes the model’s reasoning steps in reaching its response. The reasoning is returned to the model in any subsequent query, allowing the model to maintain contextual continuity of ‘thought’.
The size of this process is kept reasonable through a process of context compaction, where the accumulated conversation history, tool calls, and workspace state are compressed into a summary before overflowing the context window.
Attackers consider any API a potential doorway into a target. In this case, can any secrets be gleaned from the reasoning output, and/or can the model itself be poisoned by malicious input? In August 2026, Stealing Reasoning Traces from Proprietary LLM APIs reported an ability to extract PII via this reasoning process. “The paper showed that encrypted reasoning from a frontier model can be replayed into a weaker model from the same provider, which can then be coerced into transcribing it,” explains Xint in a new report.
The original paper started the standard process of developer-hardening and researcher-probing. For example, OpenAI rapidly deployed mitigations to this threat, and Xint has subsequently discovered a way (which it calls Compaction Smuggling) to bypass these mitigations – which OpenAI has now also mitigated.
While OpenAI’s first mitigations reduced the threat of PII exposure and model poisoning, knowledge of a model’s reasoning process can still be stolen (compaction smuggling) and used to cheaply build a new rival AI model (distillation). Distillation is the process of using stolen AI reasoning secrets from an advanced model to help cheaply build a rival model.
OpenAI confirmed the new issue of compaction smuggling, fixed it and awarded Xint a $6,000 bounty on October 23, 2026. Compaction smuggling moves one model’s reasoning to another model by encoding it inside a compaction requiring three steps. The first step is to obtain reasoning by submitting a task (for example, from gpt-5.6-sol). The second is to steer or shape the returned compaction. The third is to send the result to a different AI model (for example, gpt-4.1 and gpt-4o) with the request (reports Xint), “to output its input exactly as-is, which they happily did.”
Simplistically, although the process detail is more complex, Xint’s new attack still just asks a second model to decipher and decode the first model’s security. “This works because OpenAI’s August mitigations only block replaying reasoning into a different model, and the compaction call runs on the same model that produced the reasoning. The attack worked at every reasoning effort we tried,” reports Xint.
Compaction smuggling allows large-scale distillation of frontier OpenAI models. While this distillation may not seem a serious threat, it seriously is. In early September, CISA issued a warning, stating: “Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024. DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models.”
The examples of Chinese AI being used against US interests are myriad. The tragic irony is that much of this capability may have been stolen (distilled) from western AI.
Related: Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development
Related: China Defends DeepSeek After US Ban of Its AI From Government Systems
Related: DARPA Selects Xint to Use AI in Securing Military Messaging Apps
Related: FBI Chief Says He’s ‘Deeply concerned’ by China’s AI Program
