OpenAI says it broke a reasoning-extraction campaign

OpenAI published an account of disrupting a coordinated campaign to extract protected reasoning, which it describes as the model’s internal record for working through a task. The attack pattern is specific: copy encrypted reasoning from one conversation, then ask a model in a different conversation to decrypt and transcribe it. OpenAI stresses there was no encryption break, no database compromise and no direct access to stored conversations.

The timeline starts at low volume on July 1, 2026, then spikes on July 24 and 25 with 16,000 requests from more than 4,000 users. A wider cluster of related prompt pattern activity was identified across more than 15,000 users, and OpenAI says the activity was fully disrupted by July 28.

Attribution is partial and OpenAI is careful about it. A core cluster is attributed to individuals associated with Moonshot AI, developer of Kimi. OpenAI also says it is unclear whether all the operators it observed originated from a single actor, and it reports the volume figures as attempted, not necessarily successful, extractions.

The response involved banning fraudulent accounts, stronger signup and infrastructure controls, closing the encrypted-reasoning replay path, and adding streamed-output detection. OpenAI says it shared findings through the Frontier Model Forum and government channels, and it credits independent researchers who surfaced related cross-model and conversation-compaction vulnerabilities through responsible disclosure, citing arXiv 2608.09867.

The limits OpenAI states itself: no specific affected model is named, the attribution is uncertain, and the work is not finished. It also notes this manipulation is not a vulnerability unique to OpenAI’s models.

(Original source: OpenAI)