Artificial Intelligence
OpenAI shuts reasoning-theft campaign, Azure tests still worked
OpenAI said it broke up an account network trying to extract protected model reasoning, while researchers said the same method still worked on Microsoft Azure and other hosted endpoints.
- OpenAI said it detected and shut down an adversarial distillation campaign aimed at protected reasoning in its models.
- The company said the activity began on July 1, rose sharply on July 24 and 25, and involved more than 15,000 accounts by July 28.
- OpenAI linked a core group behind the activity to people associated with Moonshot AI, while saying it was unclear whether all the actors came from one source.
- Researchers said that on September 13 the technique still worked on Microsoft Azure against every OpenAI model they tested, including GPT-6 Astra, and against Anthropic models up to Sonnet 5.
- The researchers also said a separate notepad-based method worked on every OpenAI model and on Opus 4.8 and Sonnet 5, but not on Opus 5, Fable 5 or Fable 5.1.
OpenAI said it detected and shut down what it described as an adversarial distillation effort aimed at the internal reasoning of its models. It said the activity started at low volume on July 1 and then rose sharply on July 24 and 25.
According to OpenAI, the peak included 16,000 requests from more than 4,000 users, and its review found a network of more than 15,000 related accounts. A footnote in the company’s account said these were attempted extractions, not necessarily successful ones.
OpenAI said it associated a core group in the operation with people linked to Moonshot AI, which makes the Kimi language model. It also said it was not certain that every actor it observed traced back to the same source.
The company said it had banned fraudulent accounts, tightened sign-up controls, and closed the route that allowed reuse of encrypted reasoning data. It also said it now screens streamed outputs for possible leakage and has shared the findings through the Frontier Model Forum and government channels.
Researchers led by Joachim Schaeffer said they had already shown the same technique in a paper, and OpenAI said it had verified that their attack paths were real. On September 13, they said the method was blocked on OpenAI’s and Anthropic’s own APIs but still worked on Microsoft Azure, including against GPT-6 Astra and Anthropic models up to Sonnet 5.
Named in this story
People
- Joachim Schaeffer
- was a researcher whose team published the paper on the technique
- Can Bölük
- publicly demonstrated the simpler notepad method
Companies
- OpenAI
- said it detected and shut down the campaign and described the countermeasures
- Moonshot AI
- was linked by OpenAI to people in a core group behind the activity
- Anthropic
- was cited in the comparison tests and in a prior report on similar attempts
Organisations
- Frontier Model Forum
- received OpenAI’s account of what it had learned
Products and systems
- Microsoft Azure
- was a cloud platform where the extraction technique still worked in later tests
- GPT-6 Astra
- was one of the models researchers said still exposed reasoning on Azure
- Sonnet 5
- was one of the models researchers said still exposed reasoning on Azure
- Opus 4.8
- was one of the Anthropic models the researchers said revealed reasoning through the notepad method
- Fable 5
- was one of the models the researchers said did not reveal reasoning through the notepad method
- Fable 5.1
- was one of the models the researchers said did not reveal reasoning through the notepad method
- Opus 5
- was one of the models the researchers said did not reveal reasoning through the notepad method
How the source tells it
The piece was mainly a technical security report, but it used urgent framing to stress that the protection gap persisted across cloud platforms.
- urgency repeated timelines and contrasts between blocked APIs and still-working hosted endpoints
- alarm loaded language about hidden reasoning, backdoors and export-control workarounds