Compaction Smuggling Extracts OpenAI Reasoning Traces for Chinese Model Distillation

Xint's attack obtains reasoning outputs from frontier models, shapes the compaction summary, then forces a same-provider weaker model to output the hidden trace verbatim. This bypasses OpenAI's August fixes that only blocked cross-model replay. The method succeeded across tested reasoning depths and directly feeds distillation pipelines that train rival models on stolen chain-of-thought data. CISA's September advisory documented DeepSeek, Moonshot, Alibaba and others extracting billions of tokens from Claude, GPT, Gemini and Grok variants since late 2024, explicitly targeting reasoning traces and domain optimizations for R1 and V3 training. Procurement and job postings show these labs received state coordination signals, while OpenAI logs confirm sustained high-volume API access from Chinese infrastructure. Technical evidence shows only that traces can be lifted and replayed; official attribution to specific state tasking rests on CISA's phrasing of "likely awareness" without public packet or log corroboration. The pattern matches prior semiconductor and semiconductor-tooling IP flows where API exposure accelerated catch-up timelines by 12-18 months. OpenAI has now hardened compaction calls; next indicators will be whether rate limits on high-reasoning endpoints drop below 500 queries per hour for unverified accounts and whether additional labs appear on Entity List expansions by mid-2027.