R&D lead for Xint Code (@xint_official). Flag capturer at @PlaidCTF. Cryptography enthusiast.
Seattle area
Joined September 2013
- Tweets711
- Following438
- Followers3K
- Likes2.2K
Pinned Tweet
Stealing OpenAI Reasoning Traces (October 2026 Edition)
Using a new technique called Compaction Smuggling, we could bypass all mitigations and steal reasoning traces from frontier OpenAI models.
🚨🚨 Xint researcher @tjbecker found a vulnerability that enabled large scale OpenAI model reasoning distillation that bypassed earlier mitigations set in place post-Stolen Thoughts. We disclosed responsibly to OpenAI and they completed patching last week. Full technical writeup here.
xint.io/blog/compaction-smug…
Heads up: Anthropic CVP models are really good
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Cybersecurity aside: why did Binance allow their hot wallets to hold ~6x the value of SAFU?
(SAFU is their emergency reserve)
Tim Becker retweeted
👻
In honor of Halloween this weekend, bringing back the technical writeup for Ghost Compact - a business logic vulnerability in OpenAI found by @tjbecker that cut output inference costs by 97-99%
This discovery led to an even larger discovery into how this same compaction feature enabled the large scale distillation of chain of reasoning.
xint.io/blog/openai-compacti…
Especially with AI. I've seen both Sol and Opus turn some ridiculously weak memory corruption primitives into reliable RCE exploits. Even us CTF veterans are impressed with the tricks they come up with
ASLR is a security blanket, not a security boundary. It's unfortunately common for C/C++ devs (even *security* engineers) to assume that memory corruption bugs aren't exploitable in practice.
Tim Becker retweeted
@CSOonline interviewed @tjbecker about how he found Compaction Summary - a business logic vulnerability enabling large-scale distillation of model reasoning. They also go deeper into the larger implications for AI security from both the frontier lab as well as the enterprise customer perspective when one-time fixes don't remediate systemic problems for complex LLM attack surfaces
csoonline.com/article/424066…
Tim Becker retweeted
From our work on Ghost Compact, we learned that compaction behavior is highly steerable. We wondered if we could convince a frontier model to transcribe its raw reasoning into the compaction, then use the compaction to smuggle it to the weaker model. The answer was yes!
Tim Becker retweeted
Need response concise explain table first diff6 second10 third7 sum23. verify align yes.
Tim Becker retweeted
An internal model at OpenAI has produced a claimed refutation of ETH! Russell Impagliazzo, Mohan Paturi, and I have been asked to help organize an open and independent examination of this claim. 1/4
From our work on Ghost Compact, we learned that compaction behavior is highly steerable. We wondered if we could convince a frontier model to transcribe its raw reasoning into the compaction, then use the compaction to smuggle it to the weaker model. The answer was yes!
For our research, OpenAI awarded @xint_official with a $6000 bounty. On October 23rd, OpenAI rolled out a new batch of mitigations intended to make reasoning traces harder to leak.
Tim Becker retweeted
I haven't formalized this anywhere, but I think the next 12-18 months will have an enormous amount of innovation in the cybersecurity industry/community.
I think there are some good reasons to think a number of those interventions will shift economics in favor of defenders, even against model capabilities in 12-18mo.
But there's a diffusion lag time and tons of frictions. Quite concerned about the "cyber poverty line" and the long tail of e.g. critical infrastructure.
