OpenAI disrupts campaign extracting hidden reasoning

OpenAI says it identified and disrupted a coordinated adversarial-distillation campaign that tried to extract protected (hidden) model reasoning, with earliest activity in the first week of July 2026. Operators did not break encryption or databases; they manipulated interactions so protected reasoning became visible at scale, violating terms of service. High-volume spikes on 24–25 Jul included 16,000 requests with a relevant extraction pattern from over 4,000 users; related prompt patterns spanned a cluster of more than 15,000 users, fully disrupted by 28 Jul (attempt counts, not confirmed successes). OpenAI attributes a core cluster to individuals associated with Moonshot AI (Kimi developer); it is unclear whether all activity was one actor. Mitigations include account bans, stronger signup/infra controls, closing replay of encrypted reasoning across conversations, and sharing via the Frontier Model Forum.