The Wall Around the Reasoning

OpenAI, Anthropic and Google are sharing intelligence about attempts to extract their models’ capabilities through the Frontier Model Forum, reporting indicates this week. The cooperating rivals are trading indicators of “adversarial distillation” — unusual request volumes, prompt patterns, IP fingerprints and account-creation behavior — while the companies separately describe harvesting campaigns run through fraudulent accounts and proxy networks at industrial scale.

Distillation is the industry’s quietest competitive practice: run enormous volumes of prompts through a frontier model, capture the outputs, and train a smaller system on them. Done at scale it is a way to buy someone else’s reasoning at API prices. The labs have spent the year describing it in terms borrowed from security rather than commerce — campaigns, indicators, extraction — because the volume described looks less like a customer and more like an operation.

What the Companies Say

OpenAI disclosed what it called a coordinated campaign linked to China-based Moonshot AI, reporting roughly 16,000 extraction-related requests from more than 4,000 users across two days in late July, with related activity spanning over 15,000 accounts. The company said the activity involved no breach of encryption, databases or stored conversations, and that its findings were shared with industry and government partners.

Anthropic has described a broader field: Chinese firms including DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI allegedly using fraudulent accounts and proxy networks to harvest Claude outputs across millions of exchanges. Its published defenses — a two-stage classifier for reasoning extraction, tighter limits on new accounts, and the banning of tens of thousands of accounts — reportedly cut extracted reasoning tokens by 90% to 99%, with a false-positive rate under 0.1%.

The frontier labs used to guard their benchmarks. Now they are guarding their conversations, one request at a time.

The Forum’s role is the part that is genuinely new. Its information-sharing agreement covers threats, vulnerabilities and attack vectors, and its February issue brief already named adversarial distillation as a workstream. What the current reporting adds is operational texture: indicators moving between the three largest labs while the campaigns are live, not in a postmortem six months later.

Rivals cooperating, carefully Again

Coordination among competitors is exactly the sort of thing antitrust law watches, and the reporting notes the companies remain cautious about the scope of what they share. The line they are drawing is legible: share the fingerprints of abuse, not the shape of the business. Traffic anomalies and account patterns are closer to threat intelligence — a register where rivals compare notes routinely — than to anything about pricing, customers or roadmaps.

Whether it works is an empirical question with a short answer already in hand: Anthropic says its defenses cut extraction by an order of magnitude or more, and OpenAI says it disrupted a campaign. The harder question is the one every security posture eventually faces. Extraction is cheap, copying is patient, and the defenses that hold this quarter are being described by the same companies that told users their safeguards were strong. The wall around the reasoning is being built in public, by parties who have every commercial reason to overstate how high it already stands.