On 30 September 2026 OpenAI published a security report saying it had identified and disrupted a coordinated adversarial distillation campaign. The goal was not to break encryption on stored chats, but to manipulate interactions so protected reasoning—the model’s internal working record—could be extracted and used to train or improve other systems without authorisation.
Per the company, the earliest observed activity came in the first week of July. Volume stayed low until spikes on 24–25 July: about 16,000 requests with a relevant extraction pattern from more than 4,000 users. Investigation widened to a cluster of more than 15,000 accounts with related patterns, which OpenAI says it fully disrupted by 28 July. A footnote clarifies these were attempted extractions, not necessarily confirmed successes in every case.
OpenAI links a core group of operators to people associated with Moonshot AI, the firm behind the Kimi model. It adds that it is unclear whether all observed activity traces to a single source. The report notes Anthropic has described similar attempts attributed to Chinese AI companies, framing adversarial distillation as an ecosystem risk rather than a one-vendor incident.
The described mechanism matches academic work by researcher Joachim Schaeffer and colleagues: providers send reasoning to customers as encrypted packets that must be replayed on later turns. Because keys are shared within a model family, those packets can move across sessions, users and even different models from the same provider. A cheaper model then acts as a “decryption oracle” and prints the expensive model’s hidden thoughts.
OpenAI says it closed the hole that let people reuse and read encrypted reasoning that was not theirs, tightened sign-ups, added screening of streamed outputs that might reveal reasoning, and shared findings with the Frontier Model Forum and government channels. The institutional message is that the problem is not limited to its own APIs.
THE DECODER, on 1 October 2026, adds the sharpest enterprise detail: when Schaeffer’s team retested on 13 September, the attack was already blocked on OpenAI’s and Anthropic’s own APIs, yet still worked on Microsoft Azure against every OpenAI model tried—including GPT-6 Astra—and against Anthropic models up to Sonnet 5. A single attempt was enough to pull out reasoning verbatim.
Uneven protections between a lab’s API and the same model served by a hyperscaler turn reasoning security into a supply-chain problem. Schaeffer put it plainly: same models, different protections depending on who hosts them. Researchers call many fixes piecemeal and reliant on brittle matching of request patterns.
Their timeline is especially hard on GPT-6 Astra’s third-party launch: it reportedly shipped without the safeguards OpenAI already applied on its own perimeter. On that timeline, Azure endpoint protections for OpenAI arrived only on 27 September; for Anthropic models, the extraction could no longer be reproduced on Azure from 28 September.
There is also a simpler second vector, shown publicly by developer Can Bölük: give the model a virtual notepad tool and tell it to write its reasoning there. Researchers say that worked on every OpenAI model tested and on Opus 4.8 and Sonnet 5; only Opus 5, Fable 5 and Fable 5.1 did not reveal reasoning that way.
For cloud AI buyers, the operational lesson is to demand safeguard parity between the frontier vendor and every region or partner that serves the same model. Contracts, risk reviews and prompt-penetration tests must cover Azure, Bedrock and other clouds—not only the official playground. An RFP that ignores hosting is measuring the wrong system.
Geopolitically, the partial Moonshot attribution and the parallel with Anthropic’s reports reinforce a narrative of capability competition via cheap distillation. OpenAI expects these attempts to grow more sophisticated as leading models improve. Sharing indicators through the Frontier Model Forum is one step; homogenising partner protections is the one still missing.
Neural Pulse reads the episode as a maturity warning for the agentic market: portable or replayable reasoning is both intellectual property and a proliferation risk. While labs close holes on their APIs and hyperscalers lag, the exposure window is paid for by customers who assumed “same model” meant “same defences.”
