OpenAI says it stopped a campaign to steal its models’ reasoning across 15,000+ accounts; researchers say a similar trick still worked on Azure for a time
According to The Decoder, OpenAI says someone tried in July to extract its models’ full reasoning at scale for distillation through more than 15,000 related accounts, which it had fully shut down by July 28, and it links a core group to people associated with Moonshot AI; researchers then found that similar extraction still worked against OpenAI and Anthropic models on Microsoft Azure until late September.
In distillation, one model learns from another model’s full output, including the stronger model’s complete chains of thought rather than just its answers. OpenAI says those intermediate steps can contain information deliberately kept out of the final answer and can help others recreate a model’s capabilities.
According to The Decoder, OpenAI says the activity began at low volume on July 1 and spiked on July 24 and 25 to 16,000 requests from more than 4,000 users, all using a typical extraction pattern; a closer look uncovered a network of more than 15,000 accounts with related patterns, which OpenAI says it had fully shut down by July 28. A footnote clarifies these were attempted extractions, not necessarily successful ones. OpenAI links a core group behind the activity to people associated with Moonshot AI, the maker of the Kimi model, while saying it is unclear whether all the actors it observed trace back to a single source. Anthropic recently reported similar attempts by Chinese AI companies.
OpenAI says the attackers copied encrypted reasoning from one conversation and asked a model in a separate conversation to decrypt and write it out. Researcher Joachim Schaeffer and his team had already shown in a paper how this works: providers return reasoning to customers only as encrypted data packets, which customers pass back with follow-up requests; because the packets are encrypted with shared keys, they can be moved between sessions, between users and even between different models from the same provider, so a weaker, cheaper model from the same family can act as a “decryption oracle” that prints the stronger model’s hidden thoughts word for word. OpenAI credits the researchers by name, saying it confirmed the attack paths they reported were real and that their findings helped it roll out countermeasures faster.
OpenAI says it has banned fraudulent accounts, tightened sign-ups and closed the hole that let people reuse and read encrypted reasoning that did not belong to them, and it now screens streamed outputs and holds them back if they might reveal reasoning; it also shared what it learned through the Frontier Model Forum and government channels.
The research team published an update to its study the same day. When they tested again on September 13, the attack was blocked on OpenAI’s and Anthropic’s own APIs, but on Microsoft Azure it worked against every OpenAI model they tried, including the new GPT-6 Astra, and against Anthropic models up to Sonnet 5, with a single attempt enough to pull out the reasoning verbatim. According to the researchers’ timeline, GPT-6 Astra launched on third-party platforms without any of the protections, and OpenAI did not add safeguards to the Azure endpoint until September 27; for Anthropic models, the extraction could no longer be reproduced on Azure from September 28.
Developer Can Bölük publicly demonstrated an even simpler method: give the model a virtual notepad tool, tell it to write its reasoning there, and then read what it wrote. The researchers say this worked on every OpenAI model as well as Opus 4.8 and Sonnet 5; only Opus 5, Fable 5 and Fable 5.1 did not reveal their reasoning. The researchers describe the fixes so far as piecemeal and superficial, many relying on brittle matching of specific request patterns; the paper argues that cloud providers that do not enforce equivalent protections should not be allowed to serve reasoning models at all, since open backdoors would effectively let people sidestep export controls at the API level. OpenAI acknowledges that partner-hosted models need the same protection as its own services and says the work is not finished.
Sources
- OpenAI says it stopped a campaign to steal its models' reasoning, but the trick still worked on Azure — The Decoder：AI News（RSS）