OpenAI’s August fix for theft of reasoning traces was quickly bypassed

Source: CSO Online · OCT 26, 2026

Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it, and paid a bug bounty for its discovery. The problem is that OpenAI had already deployed mitigations for the issue in August after a research report dubbed Stolen Thoughts revealed a similar bug that allowed theft of reasoning traces, with possible consequences including large-scale data extraction and the ability for attackers to execute invisible prompt injections and to embed malicious payloads to poison public agentic rollouts. Xint’s discovery bypassed those mitigations. OpenAI did not respond to a request for comment. Fixing fixes like this is starting to become a trend among the major AI vendors , with AWS earlier this month reporting that it had fixed a bug in April, only to then have to refix it in September . Bypassing mitigation Xint is describi