DISRUPTING A COORDINATED MODEL-DISTILLATION CAMPAIGN

Summary from the TLDR InfoSec newsletter

OpenAI detected an extraction campaign beginning July 1, with spikes on July 24–25 involving 16,000 requests from more than 4,000 users. Related activity affected over 15,000 users and was disrupted by July 28. Operators replayed encrypted reasoning and used cross-conversation prompts, with OpenAI linking a core cluster to Moonshot AI personnel, restricted accounts, closed replay paths, added output checks, and shared indicators with partners.