What OpenAI disclosed
On September 30, 2026, OpenAI said it had identified and disrupted a coordinated campaign to extract "protected reasoning" from its models: the internal record a model uses to work through a task, which does not appear in the final answer. The practice is called adversarial distillation: the unauthorized use of one model's outputs or reasoning to train or improve another.
Not a classic breach
According to OpenAI, the operators did not break encryption, compromise databases or access user conversations. They manipulated model interactions so protected reasoning was reproduced in visible form, at scale, in violation of the terms of service.
One technique cited: copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe it. Independent researchers also reported related cross-model and conversation-compaction flaws, which OpenAI confirmed were real.
Timeline and scale
- July 1: activity begins at low volume.
- July 24–25: spikes of 16,000 requests using an extraction pattern, from more than 4,000 users.
- Further investigation linked the pattern to a cluster of more than 15,000 users, fully disrupted by July 28.
OpenAI stresses these figures describe attempted, not necessarily successful, extractions.
Attribution
The company says it is unclear whether all operators came from one actor, but it attributes a core cluster to individuals associated with Moonshot AI, the developer of Kimi. This is OpenAI's assessment; as of this writing we found no public response from Moonshot.
How OpenAI responded
- banned or restricted fraudulent accounts and tightened signup and infrastructure controls;
- closed the path that let someone replay another user's encrypted reasoning;
- added checks to detect and hold streamed output that might expose reasoning;
- worked with third-party providers the activity moved through;
- shared findings via the Frontier Model Forum and government channels.
Why it matters
OpenAI argues extracted reasoning can train another model without the original's safeguards, speeding the transfer of capabilities without the same safety investment. It is not alone: Anthropic launched Opus 5.5 with "preserved thinking," an anti-distillation safeguard, and cited its own September report on the topic.
What it means for businesses
- If you use AI APIs, expect more account checks and restrictions around reasoning and context.
- Integrations that pass reasoning artifacts between accounts or providers may break. Check your vendor's docs.
- When choosing models, weigh provenance and safeguards, not just price.
Sources
- OpenAI (Sep 30, 2026): https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign/
- Anthropic, Claude Opus 5.5 (distillation section): https://www.anthropic.com/claude-opus-5-5
Want to use AI safely and with proper governance? KGA IT offers a free consultation: kga-it.com.