A reasoning-replay attack OpenAI blocked on its own API still worked on Azure in September
OpenAI says it shut down a 15,000-account campaign to extract its models' hidden reasoning by July 28. A September 13 retest still pulled that reasoning verbatim through Azure, so the protection a team gets depends on which platform serves the model.
The Engineer · Build desk
What happened
- The attackers copied encrypted reasoning out of one conversation and asked a model in a separate conversation to decrypt it and write it out.
- Activity started at low volume on July 1, then spiked on July 24 and 25 to 16,000 requests from more than 4,000 users.
- OpenAI links a core group to people associated with Moonshot AI, the maker of Kimi, but says it is unclear whether all the actors trace back to one source.
- OpenAI says it banned fraudulent accounts, tightened sign-ups, closed the hole for reading other users' encrypted reasoning, and now holds back streamed output that might reveal it.
- Anthropic separately reported Moonshot relaying almost 300,000 requests through 5,380 fraudulent accounts in ten days, replaying Claude's reasoning signatures in new sessions.
Why it matters
- What doesn't add up contradiction OpenAI describes the replay hole as closed, while the researchers say many fixes are brittle matches on specific request patterns, so a reworded request may pass where the known one is blocked.
- What it limits constraint Closing the ciphertext replay path leaves the notepad-tool route open, so providers need a separate set of tool-output checks before hidden reasoning can be called protected.
- What it sets up precedent Any service that hands clients encrypted state to carry back now faces a documented attack class: a shared key lets one tenant's block be read through another session or a cheaper model.
Next story · Security · Sep 30
OpenAI says a distillation campaign got its models to decrypt their own protected reasoningConfirmed3 publishers
The design under attack is a reasonable one. A reasoning model's internal record goes to the client only as an encrypted block, and the client sends that block back with each request so the provider does not have to store it [4]. The defect was key scope. Joachim Schaeffer's team, in a paper dated August 10 that tested OpenAI, Anthropic and Google, found the blocks were encrypted with shared keys [18][8]. They could move between sessions, between users, and between models from the same provider [8]. That lets a weaker, cheaper model in the same family act as a "decryption oracle" that prints the stronger model's hidden reasoning word for word [8]. OpenAI says the encryption was not broken and no database was compromised [5]. The hidden steps are worth the effort. OpenAI says they can hold information deliberately kept out of the final answer, and can help others recreate a model's capabilities [19]. The traffic was spread thin. The late-July spike works out to at most four requests per user over two days [21], and OpenAI found the wider network through related patterns across accounts [2]. Anthropic's figures come to about 56 requests per account over ten days [26]. OpenAI counts its cases as attempted extractions, not necessarily successful ones [7]. The post does not give a success rate, the models targeted, or how many users were linked to Moonshot [9]. Moonshot denied in July that Kimi K3 was built by distillation, and OpenAI President Greg Brockman said at the time it was "too early" to tell [28]. Beyond the bans and the closed replay path, OpenAI says it strengthened protections for hidden reasoning across users, workspaces, organizations and model families [11]. If that means each block is now bound to the tenant and model that produced it, it is the correct fix for a shared-key problem. OpenAI credited the researchers by name and says their findings sped up its countermeasures [12]. The campaign also crossed hosts. OpenAI says it worked with third-party providers to disrupt accounts whose activity moved through their services [17]. The researchers retested on September 13. The attack was blocked on OpenAI's and Anthropic's own APIs [13]. On Azure it worked against every OpenAI model they tried, including GPT-6 Astra, and against Anthropic models up to Sonnet 5 [13]. One attempt was enough to pull the reasoning out verbatim [13]. That was 47 days after OpenAI says the campaign was fully disrupted [22]. "Same models, but different protections depending on which platform serves them," Schaeffer said [14]. The researchers call the fixes so far piecemeal and superficial, and say some reached cloud platforms only days late [23]. OpenAI's stated next step is to give partner-hosted deployments the same protections as its first-party tools [15]. A second route skips the ciphertext entirely. Developer Can Bölük showed publicly that a model given a virtual notepad tool, and told to write its reasoning there, leaves that reasoning where the user can read it [24]. The researchers say this worked on every OpenAI model and on Opus 4.8 and Sonnet 5. Only Opus 5, Fable 5 and Fable 5.1 kept their reasoning back [25]. The researchers believe the output would likely be as useful for distillation as the decrypted traces [25]. No block is replayed, so a check on replayed blocks has nothing to match. OpenAI says additional checks are needed to prevent tool-output attacks [15]. I think a team serving these models through a cloud host has to treat reasoning protection as a property of that host's deployment, and test it there. The same applies to any system that hands clients encrypted state to carry back: the key has to be scoped to the tenant that produced the block.
What to watch
- Whether Azure ships the partner-hosted parity OpenAI names as its next step, and whether a fresh retest by Schaeffer's team then fails there.
- Tool-output checks against the notepad method, which in the researchers' tests only Opus 5, Fable 5 and Fable 5.1 resisted.
- Retest results for cloud hosts other than Azure that resell the same OpenAI and Anthropic models.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+30
- Incentives65
- Confidence60
Perspective Coverage
4 publishers- Builder
- Builder 37%
- Operator
- Operator 39%
- Investor
- Investor 24%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
OpenAI says it detected and shut down an adversarial distillation campaign targeting its models' protected reasoning, the internal steps a model works through before giving an answer.
- [2]
A closer look uncovered a network of more than 15,000 accounts with related patterns, which OpenAI says it had fully shut down by July 28.
- [3]
According to OpenAI, the attackers copied encrypted reasoning from one conversation and asked a model in a separate conversation to decrypt it and write it out.
- [4]
Protected reasoning is encrypted and handed to the client as an encrypted block; the client sends that block back with each request so the provider does not have to store it.
- [5]
OpenAI says the encryption was not broken, there was no direct access to stored user conversations, and no database was compromised.
- [6]
The activity began at low volume on July 1 and spiked on July 24 and 25 to 16,000 requests from more than 4,000 users using an extraction pattern.
- [7]
OpenAI's footnote says these were attempted extractions, not necessarily successful ones.
- [8]
Joachim Schaeffer's team found reasoning packets are encrypted with shared keys and can be moved between sessions, between users, and between different models from the same provider, letting a weaker, cheaper model from the same family act as a "decryption oracle" that prints the stronger model's hidden thoughts word for word.
- [9]
OpenAI's post did not clarify any measure of success rate, which models were specifically targeted, or how many of the users were Moonshot-linked.
- [10]
OpenAI says it banned fraudulent accounts, tightened sign-ups, closed the hole that let people reuse and read encrypted reasoning that did not belong to them, and now screens streamed outputs and holds them back if they might reveal reasoning.
- [11]
OpenAI says it strengthened protections for hidden reasoning across users, workspaces, organizations, and model families.
- [12]
OpenAI credits the researchers by name, says it confirmed the attack paths they reported were real, and says their findings helped it roll out countermeasures faster.
- [13]
When the researchers tested again on September 13, the attack was blocked on OpenAI's and Anthropic's own APIs; on Microsoft Azure it worked against every OpenAI model they tried, including GPT-6 Astra, and against Anthropic models up to Sonnet 5, and a single attempt was enough to pull out the reasoning verbatim.
- [14]
"Same models, but different protections depending on which platform serves them," Schaeffer said.
- [15]
OpenAI's next step is to ensure partner-hosted deployments have the same protections as first-party tools; additional checks are needed to prevent tool-output attacks.
- [16]
OpenAI shared its findings with the Frontier Model Forum and government information-sharing channels, noting that "systems that support portable or replayable reasoning artifacts may face related risks."
- [17]
OpenAI worked with third-party providers to disrupt accounts whose activity moved through their services.
- [18]
The paper "Stealing Reasoning Traces from Proprietary LLM APIs" is dated Aug. 10 and tested OpenAI, Anthropic and Google.
- [19]
OpenAI says reasoning steps can contain information deliberately kept out of the final answer and can help others recreate a model's capabilities.
- [20]
Anthropic's September 2026 misuse report detailed a ten-day period in which Moonshot relayed almost 300,000 customer requests to Anthropic through a proxy network of 5,380 fraudulent accounts, and saved Claude's reasoning signatures to convert back into full reasoning traces in new sessions, which Anthropic calls cross-session replay attacks.
- [21]
The July 24-25 spike averaged at most four requests per user over two days.
- [22]
The September 13 Azure retest came 47 days after the July 28 date by which OpenAI says the campaign was fully disrupted.
- [23]
The researchers describe the fixes so far as piecemeal and superficial; many rely on brittle matching of specific request patterns, and some reached the cloud platforms only days late.
- [24]
Developer Can Bölük publicly demonstrated a second method: the model gets a virtual notepad as a tool and is told to write its reasoning there, and the user can then read what it wrote.
- [25]
The researchers say the notepad method worked on every OpenAI model and on Opus 4.8 and Sonnet 5; only Opus 5, Fable 5 and Fable 5.1 did not reveal their reasoning; they believe the output would likely be just as useful for distillation.
- [26]
Anthropic's reported Moonshot traffic averaged about 56 requests per fraudulent account over ten days.
- [27]
OpenAI links a core group behind the activity to people associated with Moonshot AI, maker of the Kimi model, and says it is unclear whether all the actors trace back to a single source.
- [28]
In July Moonshot denied that Kimi K3 was created from a distillation, and OpenAI President Greg Brockman said it was "too early" to tell whether Moonshot had distilled OpenAI's models.
Sources
4 independent publishers whose own reporting we read for this story.
- economictimes.indiatimes.comOpenAI says it disrupted large-scale effort to copy its AI model capabilities - The Economic Times
1 article · October 1, 2026
- runtimewire.comOpenAI says Moonshot-linked operators tried to extract hidden model reasoning
1 article · October 1, 2026
- the-decoder.comOpenAI says it stopped a campaign to steal its models' reasoning, but the trick still worked on Azure
2 articles · October 1, 2026
- tomshardware.comOpenAI says actors linked to China-based Moonshot AI spearheaded a campaign to extract its models’ hidden reasoning
1 article · October 1, 2026
Topics and entities
Topics
- Cloud model hosting
- Reasoning trace security
- Adversarial distillation