Researchers report OpenAI flaws that exposed hidden reasoning and let shared links hijack accounts

Two security teams published accounts of flaws in OpenAI systems that the company had fixed, both through its bug-bounty programme. Xint, on 26 October, described a way to extract raw reasoning traces from an OpenAI model. Parameter, on 28 October, described a chain of bugs that let a public ChatGPT share link run an attacker’s script in a viewer’s logged-in session. Both are researchers’ write-ups; the sources consulted did not include an OpenAI statement on either.

Xint, whose write-up is credited to Tim Becker, said the bug bypassed mitigations OpenAI had deployed in August to stop outsiders distilling the hidden reasoning of its frontier models. Those mitigations block replaying one model’s encrypted reasoning into a different model. Xint’s “compaction smuggling” used the API’s compaction endpoint, which runs on the same model that produced the reasoning, to carry the reasoning inside a compaction item, and then had two other OpenAI models echo it back for decoding. The demonstration used gpt-5.6-sol. Xint said it could not prove the recovered text was identical token for token, because it lacked the original plaintext. It said it found the bug in August, that OpenAI confirmed it and deployed a fix, which it did not describe, on 23 October, and that OpenAI paid a $6,000 bounty.

Parameter, credited to Mukul Goyal, described a longer chain. A graph in a conversation loads a maths-input library that listens for messages from any origin; a sandboxed HTML preview could send it crafted messages that inserted an unsandboxed frame carrying the chatgpt.com origin, and a content-security-policy gap allowed script to run. Parameter said the payload could list a victim’s conversations, retrieve a private conversation and send data to an outside server, and that the victim needed one click on the preview at most. It reported the issue on 18 October. According to Parameter, OpenAI raised its severity from P2 to P1 on 21 October, confirmed both web front ends rejected the messages on 26 October, and awarded $5,000 in total. The write-up does not say the flaw was exploited in the wild.

The two reports differ in what was at stake. The Xint flaw concerned OpenAI’s defences against distillation, the copying of a model’s outputs to train another, which US agencies accused six Chinese labs of in September. The Parameter flaw concerned users’ private data. They also add to a run of outside disclosures in which OpenAI’s own systems were the target, including a Claude-assisted exploit chain that earned a bounty in September.