OpenAI says it identified and disrupted a coordinated campaign meant to extract protected reasoning from its models. According to the official post dated September 30, 2026, the earliest observed activity was in the first week of July. OpenAI describes this as adversarial distillation: the systematic, unauthorized use of a model’s outputs or reasoning to help train, reproduce, or improve another model.
What it was not, per OpenAI: the operators did not break encryption, compromise a database, or gain direct access to stored user conversations. Instead, they manipulated model interactions so that protected reasoning could appear in forms visible to the requester, at a coordinated scale that violated the terms of service.
What OpenAI observed
OpenAI describes novel extraction attempts, including copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden content. Independent researchers also disclosed related cross-model and conversation-compaction issues; OpenAI says it confirmed those attack paths were real and that the disclosure helped accelerate mitigations.
Activity began on July 1 at low volume. On July 24–25 there were spikes of about 16,000 requests using a relevant extraction pattern from more than 4,000 users. Further investigation found related prompt-pattern activity across a cluster of more than 15,000 users, fully disrupted by July 28. The figures describe attempted extractions, not necessarily successful ones.
Attribution as OpenAI states it
OpenAI writes that it is unclear whether every operator in the relevant period came from a single actor. It attributes a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi. That is OpenAI’s assessment as published in the post; we do not have an independent source here that confirms or contradicts it.
Why it matters and what OpenAI did
Per OpenAI, adversarial distillation raises safety and national-security risks: extracted reasoning could train another model without the safeguards applied to the original user-facing outputs, and at scale it can speed the transfer of advanced capabilities without the same safety investment. OpenAI stresses the risk is not unique to its systems and shared findings with partners through the Frontier Model Forum.
- Banned or restricted fraudulent accounts
- Strengthened signup and infrastructure controls, and expanded monitoring for related networks
- Stronger protections for hidden reasoning across users, workspaces, and organizations
- Closed a path that let someone who already held another user’s encrypted reasoning replay it and recover contents
- Coordination with third-party providers and government information-sharing channels
How to read this
This is a security report about a disrupted campaign, not a database breach. OpenAI says the work continues, including protections for partner-hosted deployments and tool-output attacks. Alongside it you can read our piece on the GPT-6.1 Sol launch, revisit OpenAI’s Dots, and follow more updates in AI News.
Sources
- OpenAI, Disrupting a coordinated model-distillation campaign: openai.com/index/disrupting-a-coordinated-model-distillation-campaign/
