OpenAI says it disrupted a campaign that tried to expose protected reasoning—the model’s internal work that is not shown in its answer—across conversations. The company says operators copied encrypted reasoning from one chat into another and asked a model to render its contents as readable text. That used model interactions rather than breaking the encryption or directly accessing a database or stored chats, OpenAI says.
OpenAI says it counted 16,000 requests using a relevant extraction pattern on July 24–25, from more than 4,000 users. It later identified related prompt patterns across a cluster of more than 15,000 users and says it disrupted that activity by July 28; it does not say whether the two user groups overlapped. A footnote clarifies that the request count reflects attempts, not necessarily successful extractions.
A separate August preprint by Alexander Panfilov and colleagues describes a related weakness in some model APIs. To preserve a conversation without server-side storage, an API can return an encrypted reasoning block for the client to pass back on later calls. The authors say compatible blocks could be reused across sessions, users and models within a provider’s system; in their tests, a less capable model could turn a stronger model’s block into readable text. They tested APIs from Anthropic, OpenAI and Google.
Figure 1 from the separate Panfilov et al. preprint, licensed under CC BY 4.0.
The paper is separate evidence, not a measure of OpenAI’s July campaign. Its authors report scanning 315,320 reasoning blocks from public repositories and classifying 367 items as personally identifying information, such as names, addresses or emails, and 182 as credentials, such as access tokens, API keys or passwords. They tested specific model and API versions available in early July; because they lacked a ground-truth copy of private traces, they say they cannot guarantee exact recovery of every hidden token.
OpenAI says the researchers disclosed related cross-model and conversation-compaction vulnerabilities, and that it confirmed their attack paths. The company attributes a core cluster of the observed activity to individuals associated with Moonshot AI, but says it cannot determine whether all operators came from one actor.
OpenAI says it restricted accounts, strengthened signup and infrastructure controls, closed a replay pathway, added checks to detect streamed output that might expose reasoning, and shared findings with industry and government partners.
The next test is whether providers consistently bind each encrypted reasoning block to its original user, session and model, including across partner-hosted services and tool outputs—areas where OpenAI says work remains.
Sources
- OpenAI: Disrupting a coordinated model-distillation campaign
- Panfilov et al., “Stealing Reasoning Traces from Proprietary LLM APIs” (arXiv:2608.09867v1)
- Illustrative cybersecurity graphic: Jaydeep_, “Cybersecurity.png,” CC0 1.0; it does not depict the reported activity (Wikimedia Commons source).
- CC BY 4.0 license
