Open weights flood the decision-model market as OpenAI admits its reasoning was stolen

The disclosure came in an OpenAI blog post, reported by The Decoder and The Hacker News on 1 October. According to OpenAI, the activity began at low volume on 1 July 2026. It spiked on 24 and 25 July to 16,000 requests from more than 4,000 users, and was fully shut down by 28 July. A footnote in OpenAI's post says these were attempted extractions, not necessarily successful ones.

OpenAI attributes "a core cluster" of the activity to people associated with Moonshot AI, the Beijing company behind the Kimi model. The Hacker News notes OpenAI did not cite technical evidence for that attribution. The company also says it is unclear whether every actor it observed traces back to one source.

The trick that survived the fix

The mechanism is not a hack in the conventional sense. Providers return a model's reasoning to customers as encrypted packets. Customers pass these along with follow-up requests. Researchers Joachim Schaeffer and colleagues showed that because those packets use shared keys, they can be moved between sessions, users and models from the same provider. A cheaper model then acts as a decryption oracle, printing the stronger model's hidden thoughts in plaintext. OpenAI credits the researchers by name and says it confirmed their attack paths were real. It has since banned accounts, tightened sign-ups, closed the replay pathway and added screening of streamed output. The Decoder reports that on the same day the researchers published an update. "We stole reasoning. Again," Schaeffer wrote on X, arguing that securing your own API does not secure the wider ecosystem of cloud providers that resell access to the same models.

That framing matters for open weights.

Anthropic has spent the past week warning that Chinese open models such as GLM-5.3 reach elite exploit-writing ability without equivalent safeguards, according to reporting carried by the South China Morning Post and Tom's Hardware. Yann LeCun publicly called Dario Amodei's cybersecurity claims overblown, Startup Fortune reported on 1 October. The dossier contains the dispute, not a resolution.

Decision models, not chatbots

The most concrete open-weight news on 1 October is smaller than a frontier model. Cloudflare released Clef and Clef-flash, two decision models hosted on Workers AI and open-sourced on Hugging Face under Apache 2.0. Cloudflare says Clef leads the Jev Decision Index. In an internal threat-intelligence test, it classified a website in 2.2 seconds, against 4.7 seconds for gpt-oss-120b in the same workflow.

Others are moving into the same category. TechCrunch reported on 1 October that Amazon released its own Jev clone as decision models proliferate. It also reported on 30 September that OpenAI's new Decisions API gives its Luna model a predefined set of options to choose between. TypeSafe AI's Jev, which returns typed probabilities instead of text, was covered by InfoQ on 1 October. Sebastian Raschka's 29 September analysis argues Jev is a text classifier that is faster and cheaper than general LLMs, not a replacement for them.

Elsewhere in the dossier, the open-weight current runs through research and hardware. Meta's Superintelligence Labs published Context Language Models on 29 September, with code on GitHub, claiming 11.4 percent higher accuracy and 21.5 percent fewer FLOPs on BrowseComp-Plus. A volunteer project called Coop is pretraining a 145M-parameter model on donated consumer hardware. A seven-node ESP32-S3 cluster runs a 0.5B BitNet model over SPI. None of these threaten frontier labs. Together they show where the cheap end of the market is heading.