model extraction attack worked on Azure for weeks

What happened

OpenAI says it has stopped a coordinated campaign in which more than 15,000 accounts attempted to copy the hidden reasoning behind its models. The company linked part of that activity to people connected to Moonshot AI.

Researchers have since found that the same extraction technique continued to work on Microsoft Azure for weeks, including against GPT-6 Astra, the newest model in the sources. OpenAI's protections, as reported so far, do not appear to extend to the cloud platforms that also distribute its models.

Why it matters

The story is less about one blocked campaign than about where model security is enforced. A model's safeguards are only as strong as the weakest channel through which it can be reached. When the same model is sold directly and through a hyperscale cloud, a control in one place does not automatically protect the other.

For organisations building on AI, this changes the procurement and risk conversation. Reasoning traces, outputs and API access are now recognised as valuable assets that can be targeted at scale. Leaders need to understand which protections apply on each route to a model, and who is accountable when they differ.

By the numbers

• More than 15,000 accounts were involved in the coordinated attempt to copy models' hidden reasoning, according to OpenAI.
• Weeks is how long researchers say the same attack kept working on Microsoft Azure.
• GPT-6 Astra is the model against which the attack was reportedly still effective on Azure.

The Renascence take

Most readers will treat this as a story about a single vendor's defences. The more useful lesson is that customers now experience AI security through whichever channel they buy from, not through the model's brand.

Trust is being designed in pieces across suppliers, and customers rarely see the seams until something leaks. The behavioural principle at work is that people judge a service by its weakest touchpoint, and AI platforms have many touchpoints. Operators should map security and data-handling controls channel by channel, then write the gaps into service-level commitments rather than assuming parity. Those that do this early will be far better placed to explain, and defend, what their customers' data and outputs are actually protected by.