On 1 October 2026, The Decoder expanded the story of the adversarial distillation campaign OpenAI says it shut down: the same day, researchers led by Joachim Schaeffer updated their study with an unsettling finding—“We stole reasoning. Again”—locking down a first-party API is not enough if third-party cloud stays open.
OpenAI says it detected and dismantled a coordinated campaign to copy protected reasoning from its models: the internal steps an AI works through before the final answer. In distillation, one model learns from another’s full output, including chains of thought, not just the visible answer.
According to OpenAI, activity began at low volume on 1 July. On 24 and 25 July it spiked to about 16,000 requests from more than 4,000 users using a typical extraction pattern. The investigation uncovered a network of more than 15,000 related accounts, fully shut down by 28 July. A footnote clarifies these were attempted extractions, not necessarily successful ones.
The company links a core group to people associated with Moonshot AI, maker of the Kimi model, without claiming every actor traces to a single source. Anthropic had reported similar attempts by Chinese AI firms. OpenAI says it shared lessons through the Frontier Model Forum and government channels.
The technical mechanism, documented by Schaeffer and colleagues, exploits encrypted reasoning packets providers send clients to continue a conversation. Because keys are shared within a model family, those packets can move across sessions, users and even different models from the same provider. A cheaper model then acts as a “decryption oracle” for the stronger model’s hidden thoughts.
OpenAI says it banned fraudulent accounts, tightened sign-ups and closed the hole that let people reuse and read encrypted reasoning that was not theirs. It also screens streamed outputs and holds them back if they might reveal reasoning. It credits the researchers with speeding countermeasures.
When the team retested on 13 September, the attack was blocked on OpenAI’s and Anthropic’s own APIs. On Microsoft Azure, it worked against every OpenAI model tried—including new GPT-6 Astra—and against Anthropic models up to Sonnet 5. A single attempt pulled out reasoning verbatim. “Same models, but different protections depending on which platform serves them,” Schaeffer wrote.
A second, even simpler method, demonstrated publicly by developer Can Bölük, gives the model a virtual notepad tool and tells it to write its reasoning there. Researchers say it worked on every OpenAI model they tried, plus Opus 4.8 and Sonnet 5; only Opus 5, Fable 5 and Fable 5.1 did not reveal reasoning that way.
The researchers call the fixes piecemeal and superficial. Many rely on brittle request-pattern matching, and some reached cloud platforms only days later. GPT-6 Astra launched on third-party platforms without those protections. On their timeline, OpenAI did not add Azure-endpoint safeguards until 27 September; for Anthropic models, reported extraction could no longer be reproduced on Azure from 28 September.
Schaeffer argues patches must cover every attack type and every cloud that hosts the models; otherwise attackers pick the weakest route. The paper goes further, arguing cloud providers without equivalent protections should not serve reasoning models at all, because open backdoors would sidestep export controls at the API level.
OpenAI acknowledges partner-hosted models need the same protection as its own services and says the work is unfinished. For enterprise buyers who choose Azure for compliance or latency, the episode shows a configuration risk: the model brand does not guarantee the same hardening on every endpoint.
Neural Pulse reads the case as a complement—not a repeat—of the Moonshot campaign report: the focus here is the platform gap. Until protections travel with the model to every cloud, adversarial distillation remains an ecosystem problem, not only a lab problem.
