Your model's secrets are only as safe as the cloud that serves it

OpenAI's version of events, and it is OpenAI's version, label it as such: starting July 1, a campaign began trying to steal its models' hidden chain-of-thought reasoning. On July 24 and 25, it spiked to 16,000 requests from more than 4,000 users. Behind it, OpenAI says it found a network of more than 15,000 accounts with related patterns, fully shut down by July 28. OpenAI links "a core group behind the activity to people associated with Moonshot AI," the maker of Kimi, while adding it is unclear whether all the actors trace back to a single source. One footnote deserves to stay attached to the whole story: these were "attempted extractions, not necessarily successful ones."

The company says it has since banned the accounts, tightened sign-ups, closed the hole that let people reuse encrypted reasoning, and now screens streamed outputs. It credits the researchers who found the attack path, Joachim Schaeffer's team, whose work it says helped roll out countermeasures faster.

On the same day OpenAI published that account, the researchers published a retest. "We stole reasoning. Again." When they ran the attack on September 13, it was blocked on OpenAI's and Anthropic's own APIs. On Microsoft Azure, it worked against every OpenAI model they tried, including the new GPT-6 Astra, and against Anthropic models up to Sonnet 5. A single attempt was enough to pull the reasoning out verbatim. "Same models, but different protections depending on which platform serves them."

Understand the mechanism, because it explains why the platform is the vulnerability. Providers send reasoning back to customers only as encrypted packets, which the customer's software passes back with follow-up requests. Those packets are encrypted with shared keys, so researchers found they can be moved between sessions, between users, and even between different models from the same provider. That lets a weaker, cheaper model from the same family act as a "decryption oracle" that prints the stronger model's hidden thoughts word for word. There is also a second, simpler method, demonstrated publicly by developer Can Bölük: give the model a virtual notepad tool, tell it to write its reasoning there, and read what it wrote. The researchers say that worked on every OpenAI model tested and on Opus 4.8 and Sonnet 5; only Opus 5, Fable 5, and Fable 5.1 held out.

The researchers describe the fixes so far as "piecemeal and superficial," many relying on brittle matching of specific request patterns, and protections that reached cloud platforms days after the labs' own APIs. Their timeline says GPT-6 Astra launched on third-party platforms without any of the protections in place, and OpenAI did not add safeguards to the Azure endpoint until September 27. For Anthropic's models, the extraction reportedly could no longer be reproduced on Azure starting September 28.

Here is the decision this informs. If your competitive moat, your compliance posture, or your security assumptions depend on a model's reasoning staying private, you cannot treat that as a property of the model. It is a property of every platform that serves the model. The same weights, served two ways, had two different confidentiality outcomes. Your threat model has to include the serving path, not just the model card.

Three concrete moves. First, inventory which clouds and resellers serve the models your products depend on, and ask each one what reasoning protections they have deployed and when. "Same as the lab's API" is a claim you should see evidenced, given that this week it was false for at least fourteen days. Second, assume anything you send to a reasoning model can be recovered through the weakest platform in your serving chain, and design your prompts and data handling accordingly. Third, watch the researchers' policy argument, which goes further than engineering: they argue cloud providers without equivalent protections should not be allowed to serve reasoning models at all, because open backdoors let attackers "sidestep export controls at the API level." That is the researchers' argument, not law. But it is the kind of argument that becomes law once a regulator reads it, and it points at the same conclusion: the perimeter around a frontier model is now drawn at the serving contract, not the model weights.

OpenAI says it knows the work is not finished. On this one, the evidence agrees.