OpenAI says it shut a reasoning-extraction campaign; researchers say Azure stayed open longer

OpenAI said it detected and shut down a coordinated adversarial distillation campaign aimed at copying protected chain-of-thought reasoning that users normally do not see. Coverage by THE DECODER (1 October 2026) summarises OpenAI’s blog: activity began at low volume on 1 July, spiked on 24–25 July to about 16,000 requests from more than 4,000 users, and OpenAI associated a related network of more than 15,000 accounts that it says it had fully shut down by 28 July. A footnote clarifies these were attempted extractions, not necessarily successful ones.

How the trick worked

According to OpenAI and researchers it credits (including Joachim Schaeffer and colleagues), attackers reused encrypted reasoning packets from one conversation and asked another model in a separate session to decrypt and print them. Because packets used shared keys, weaker models from the same family could act as a decryption oracle. OpenAI links a core group to people associated with Moonshot AI (maker of the Kimi model) while saying it is unclear whether all observed actors share a single source. The company says it banned fraudulent accounts, tightened sign-ups, closed reuse of encrypted reasoning, and screens streamed outputs that might reveal reasoning.

The Azure gap

On the same day, researchers updated their study: when they retested on 13 September, the attack was blocked on OpenAI’s and Anthropic’s own APIs, but on Microsoft Azure it still worked against every OpenAI model they tried — including GPT-6 Astra — and against Anthropic models up to Sonnet 5. THE DECODER reports their timeline that OpenAI added Azure endpoint safeguards around 27 September, and Anthropic models on Azure could no longer be reproduced for the reported extraction from 28 September. A second, simpler method (a virtual notepad tool, demonstrated publicly by developer Can Bölük) also elicited reasoning on many models. OpenAI acknowledges partner-hosted models need equivalent protections and says the work continues. This article reports company claims and independent research — not a how-to.