OpenAI says a 15,000-user network tried to extract hidden AI reasoning
The campaign targeted the work behind a model’s answers. OpenAI describes coordinated extraction attempts and links a core cluster to people associated with Kimi’s developer.
The target was the work behind the answer
OpenAI says a network spanning more than 15,000 users tried to expose the hidden reasoning its models use to work through problems. Its September 30 account traces the campaign to July 1, with a surge of roughly 16,000 requests from over 4,000 users on July 24 and 25. Those figures count attempts, not confirmed successes.[1]
The operators manipulated conversations to make protected reasoning visible. OpenAI says they did not break its encryption, compromise a database or directly access stored user conversations.[1]
An answer shows the result of a model’s work. The reasoning behind it can reveal how it got there, including material withheld from the final response. That makes it a valuable target for someone trying to reproduce a model’s abilities.
Why the campaign matters
OpenAI links a core cluster to individuals associated with Moonshot AI, which develops Kimi. It has not established that every operator belonged to the same actor.[1]
The company describes the activity as adversarial distillation: unauthorized extraction used to help train or improve another model. It warns that copying capabilities this way may leave the original safeguards behind.[1]
That concern goes beyond copying a useful answer. A competing system could learn from behavior its users were never meant to see. The security boundary has to survive the exchange between conversations as well as protect the information stored behind the service.
Closing the paths between conversations
OpenAI says it disrupted the cluster by July 28, restricted accounts and strengthened checks around reasoning replay and streamed output. Independent researchers also disclosed related weaknesses, helping accelerate fixes.[1]
The response addresses both the requests and the network making them. A single suspicious exchange can look different when viewed alongside thousands of related attempts. That is why the campaign’s scale matters to its detection, not just to its headline.
Sources & context
Based on the sources below, with LLMCurrent’s analysis. Original reporting dated .
About this article
Prepared with AI assistance from the cited material. It does not claim firsthand reporting or independent testing. Source claims are attributed; interpretation is identified in the text. Contact us about a correction.