TLDR Tech / Practical
GhostCompact Bug Offered Near-Free OpenAI Inference
A flaw in OpenAI's API accounting, dubbed GhostCompact by Xint researchers, allowed users to achieve virtually no-cost inference by exploiting billing errors related to inline compactions and subsequent tool calls. The researchers demonstrated this by creating a security scanner that identified actual zero-day vulnerabilities, manipulating the compaction phase, typically used for summarization, to execute arbitrary inference. OpenAI has acknowledged the vulnerability, implemented a fix, and provided a bounty to the discovery team.
Read the full story