Compaction Smuggling Flaw Lets Attackers Extract and Copy Frontier AI Reasoning

What happened

Why it matters

• ·Organizations that access frontier AI models through vendor application programming interfaces may unknowingly contribute to nation-state model theft at scale. CISA's warning about billions of extracted outputs means that routine enterprise API use is part of a pattern regulators and law enforcement are now tracking.
• ·The Compaction Smuggling flaw exposes a gap in vendor security assurance programs. A vulnerability in how an AI provider manages memory, not in the model itself, was enough to allow proprietary reasoning to be stolen and reused. Procurement and vendor risk controls that focus only on model-level safety miss this class of infrastructure risk.
• ·US government agencies are now publicly naming specific foreign companies as actors in AI model theft. Enterprises with operations or partnerships touching those companies face heightened scrutiny. Compliance programs should assess whether existing third-party AI risk reviews under frameworks such as the NIST AI Risk Management Framework (AI RMF 1.0) and Playbook address nation-state distillation risk.

Governance controls affected

What to do now

• ☐Ask your AI vendor which internal infrastructure processes, beyond the model itself, are covered by their security vulnerability disclosure and bug bounty programs, and whether context compaction or similar memory management functions have been reviewed.
• ☐Review your organization's API usage agreements with frontier AI providers to confirm whether there are contractual controls that restrict the volume or pattern of output extraction, and escalate to legal if those controls are absent.
• ☐Brief your third-party AI risk team on CISA's named warning about DeepSeek and industrial-scale distillation, then check whether any current or prospective AI vendors have known ties to entities flagged in that advisory.
• ☐Confirm that your vendor security assessment process covers infrastructure-layer vulnerabilities, not only model behavior, and request evidence from key AI vendors that their context processing pipelines have been independently tested.
• ☐Assess whether your organization's AI model IP is at risk: if you fine-tune or build on proprietary models, determine whether any vendor API access could expose that investment to extraction or replication by third parties.

What to watch next

CISA's warning about systematic output extraction is likely to prompt further guidance on API access controls and rate-limit requirements for frontier AI providers under US government contracts. Compliance teams should monitor whether the Americas AI Action Plan or follow-on executive action produces specific requirements around frontier model access security. The Compaction Smuggling disclosure adds momentum to legislative proposals targeting AI model theft. This includes efforts referenced in Bills Target AI Model Theft and Political Deepfakes With Disclosure Mandates, which could impose new disclosure or control requirements on enterprises using frontier AI APIs.