The attack builds on research from August 2026 showing that encrypted reasoning returned through a frontier model's API could be replayed into a weaker model from the same provider, which could then be coerced into transcribing it. OpenAI deployed mitigations against that threat, but Xint found a way around them by encoding one model's reasoning inside the compaction process, the step where a model compresses accumulated conversation history into a summary. Because the compaction call runs on the same model that produced the reasoning, it sidestepped the August defences, which only blocked replaying reasoning into a different model.

In practice, Xint reported obtaining reasoning from a frontier model, shaping the returned compaction, then sending it to other models with a request to output its input exactly as-is, which, Xint reports, the models did. The firm says the attack worked at every reasoning effort it tried.

The concern is distillation: using a rival's reasoning output to help train a cheaper competing model. In early September, CISA warned that several Chinese AI firms, likely with government awareness, had extracted billions of tokens from US frontier models since at least late 2024, with DeepSeek specifically targeting reasoning capabilities. That warning predates this new bypass, so it describes extraction efforts generally rather than this technique.