OpenAI saw 16,000 extraction requests from more than 4,000 accounts in two days, about four each. Per-key quotas can’t see an actor shaped like a crowd. Account controls can.
Why rate limits can't stop distillation attacks
calendar_today
October 2, 2026
domain
workos