Xavfsizlik firmasi Xint ko'rsatganidek, OpenAI'ning kompaktlash (compaction) funksiyasi — bu uzoq suhbatni joyni tejash uchun qisqartirish — modelning yashirin fikrlashini ochiq matn sifatida nusxalash usuliga aylanishi mumkin edi.
OpenAI'ning fikrlash modellari javob berishdan oldin muammoni o'ylab ko'radi va xizmat odatda faqat xom fikrlashni shifrlangan, foydalanuvchi o'qiy olmaydigan element sifatida qaytaradi. Ushbu usul OpenAI avgust oyida bu turdagi fikrlash o'g'irlanishiga qarshi qo'shgan himoyalarni chetlab o'tdi. Xint ma'lumotiga ko'ra, OpenAI muammoni tasdiqladi va 23-oktabrda tuzatdi.
Xint usulni gpt-5.6-sol — OpenAI'ning fikrlash modellaridan biri — ustida sinovdan o'tkazdi, tadqiqotchilar o'zlari yozgan matematik va algoritm masalalaridan foydalandi. Olingan fikrlash aynan shu so'rovlardan kelib chiqqan va Xint usul boshqa foydalanuvchining fikrlashiga yetib borishi mumkinligini da'vo qilmadi.
Xint aytishicha, nusxalangan matn modelning haqiqiy fikrlashi bilan so'zma-so'z bir xil ekanligini isbotlay olmaydi, chunki u asl nusxaga solishtirish uchun ega emas edi. Ikkita arzonroq model har biri elementni takrorladi va bir xil matnni hosil qildi, bu nusxalash bosqichidagi xatolarni inkor etadi, lekin kompaktlash matnni qayta so'zlagan bo'lishi mumkinligi ehtimolini ochiq qoldiradi.
Kompaktlash — bu OpenAI funksiyasi bo'lib, model yordamida uzoq suhbatni kichikroq, shifrlangan elementga siqib, kontekstni oldinga olib boradi.
Xint gpt-5.6-sol'ga vazifa yubordi va qaytgan shifrlangan fikrlashni saqlab qoldi. So'ngra u kompaktlash bosqichini xuddi shu modelda chaqirdi va unga fikrlashni kompaktlangan elementga so'zma-so'z nusxalashni, har bir bo'sh joyni tab bilan almashtirishni buyurdi — bu OpenAI'ning foydalanish siyosati filtrlarini chetlab o'tish uchun qilingan.
Kompaktlash elementlari modellar o'rtasida harakatlana olgani uchun, Xint elementni arzonroq gpt-4.1 va gpt-4o modellariga o'tkazdi va har biridan o'z kiritishini aynan takrorlashni so'radi, ular shunday qildi.
Usul OpenAI allaqachon jo'natgan tuzatishni chetlab o'tdi. Avgust oyida "Stolen Thoughts" deb nomlangan maqola ortidagi tadqiqotchilar kuchli modeldan shifrlangan fikrlashni xuddi shu kompaniyaning zaifroq modeliga qayta ijro etish mumkinligini, u esa uni ochiq matn sifatida takrorlashini ko'rsatgan edi. OpenAI va boshqalar tez orada bu modellararo qayta ijroni blokladilar.
Xint aytishicha, kompaktlash bu blokni chetlab o'tdi, chunki kompaktlash bosqichi fikrlashni yaratgan xuddi shu modelda ishlaydi, shuning uchun u modellararo tekshiruvni ishga tushirmaydi.
G'oya Xint'ning avvalgi ishi — GhostCompact — ga asoslangan bo'lib, u kompaktlash bosqichini hujumchining tanlagan vazifalarini bajarishga majburlash mumkinligini ko'rsatgan. Xint kodni o'zining GitHub omborida e'lon qilgan.
Tuzatish OpenAI tomonida bo'lgani uchun, API ustida ishlaydigan ishlab chiquvchilar hech narsani o'zgartirishlari shart emas. Xint buni e'lon qilinmagan tuzatish deb atadi va OpenAI tadqiqotchilarga 6 000 dollar mukofot to'laganini aytdi.
Xint faqat gpt-5.6-sol'ni sinovdan o'tkazdi va OpenAI'ning yangi modeli GPT-6 Astra ta'sirlanganmi yoki yo'qligini tekshirmadi. Usul OpenAI uni yopishdan oldin kimdir tomonidan ishlatilganmi yoki yo'qligi noma'lum. Xint shuningdek, bu bitta yo'lni tuzatish yetarli bo'lmasligi mumkinligini ta'kidladi, chunki uning fikricha, modelning shifrlangan fikrlashini o'qiydigan va foydalanuvchi ko'rsatmalariga amal qiladigan har qanday server tomonidagi bosqich uni ochib yuborishi mumkin.
OpenAI xom fikrlashni qisman distillatsiyani — bir kompaniya boshqa kompaniyaning natijalariga asoslanib arzonroq modelni o'rgatishini — to'xtatish uchun yashirin saqlaydi. Xom fikrlash yakuniy javobdan ko'ra yaxshiroq o'quv ma'lumotlari bo'ladi, chunki u model muammoni qanday o'ylab ko'rganini ko'rsatadi, bu esa raqib uchun o'g'irlashga arziydigan narsadir.
OpenAI sentyabr oyida iyul oyida o'z modellarining yashirin fikrlashini ochishga uringan kampaniyani to'xtatganini va uning asosiy qismini Xitoyning Moonshot AI bilan bog'liq shaxslarga bog'laganini aytdi.
Anthropic va AQSh hukumatining qo'shma maslahatnomasi har biri Xitoyda joylashgan laboratoriyalar Amerika modellarining yashirin fikrlashini nishonga olganini xabar qilgan. Bularning hech biri Xint'ning kompaktlash usuli bilan bog'liq emas, bu usul haqiqiy hujum emas, balki namoyishdir.
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown.
OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past the protections OpenAI added in August against this kind of reasoning theft. OpenAI confirmed the problem and fixed it on October 23, according to Xint.
Xint ran the technique against gpt-5.6-sol, one of OpenAI's reasoning models, using math and algorithm puzzles its researchers wrote themselves. The reasoning it pulled out came from those same requests, and Xint did not claim the method could reach another user's reasoning.
Xint says it cannot prove the copied text is word-for-word the model's real reasoning, because it never had the original to compare against. Two cheaper models each repeated the item and produced the same text, which rules out mistakes in the copying step but leaves open the possibility that compaction reworded the text.
Compaction is an OpenAI feature that uses a model to squeeze a long conversation into a smaller, encrypted item that carries the context forward.
Xint sent a task to gpt-5.6-sol and kept the encrypted reasoning it returned. It then called the compaction step on the same model and told it to copy that reasoning into the compacted item word-for-word, with every space changed to a tab to get past OpenAI's usage-policy filters.
Because compaction items can move between models, Xint passed the item to the cheaper gpt-4.1 and gpt-4o models and asked each to repeat its input exactly, which they did.
The method worked around a fix OpenAI had already shipped. In August, researchers behind a paper called Stolen Thoughts showed that encrypted reasoning from a strong model could be replayed into a weaker model from the same company, which would then repeat it as plain text. OpenAI and others blocked that cross-model replay soon after.
Compaction got past that block, Xint said, because the compaction step runs on the same model that made the reasoning, so it never triggers the cross-model check.
The idea built on Xint's earlier work, called GhostCompact, which showed the compaction step can be pushed to run tasks of the attacker's choosing. Xint has published the code in its GitHub repository.
The fix was on OpenAI's side, so developers who build on the API do not need to change anything. Xint called it an undisclosed fix and said OpenAI paid the researchers a $6,000 reward.
Xint tested only gpt-5.6-sol and did not check whether GPT-6 Astra, OpenAI's newer model, is affected. It is not known whether anyone used the method before OpenAI closed it. Xint also argued that fixing this one path may not be enough because, in its view, any server-side step that reads a model's decrypted reasoning and follows the user's instructions could leak it.
OpenAI keeps raw reasoning hidden partly to stop distillation, where one company trains a cheaper model on another's outputs. Raw reasoning makes better training data than the final answer alone, because it shows how the model worked through the problem, which is what makes it worth stealing for a rival.
OpenAI said in September that it had disrupted a July campaign that tried to expose its models' hidden reasoning, and linked a core part of it to people associated with China's Moonshot AI.
Anthropic and a joint U.S. government advisory have each reported China-based labs targeting the hidden reasoning of American models. None of that is tied to Xint's compaction method, which is a demonstration rather than an attack seen in the wild.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.