October 2, 2026 — OpenAI says it caught and shut down a coordinated effort to extract the hidden reasoning behind its AI models, tracing a core group of the operators to individuals associated with Moonshot AI, the Beijing company behind the Kimi chatbot.
What happened
OpenAI said the campaign began on July 1, running at low volume before exploding on July 24 and 25, when more than 4,000 accounts fired off 16,000 requests matching an extraction pattern. Its investigation turned up related prompt-pattern activity across more than 15,000 users. The operation was fully disrupted by July 28, the company said.
The technique, as OpenAI describes it, was blunt rather than sophisticated. Operators copied encrypted reasoning from one conversation and pasted it into another model interaction with instructions to decrypt and transcribe it. “The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations,” OpenAI said. “Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester in a coordinated, scaled manner that violated our terms of service.”
Attribution — and its limits
OpenAI called the behavior “adversarial distillation” — the systematic, unauthorized use of one model’s outputs or reasoning to train, reproduce, or improve another model. It attributed a “core cluster” of the activity to individuals associated with Moonshot AI, but acknowledged it could not confirm that every account or operator involved belonged to a single actor, and it did not claim Moonshot’s leadership directed the effort.
Caroline Zier, who leads OpenAI’s strategic national security policy work, told Bloomberg the issue is terms-of-service enforcement: “Our concern is about violation of our terms of service, not open models or legitimate distillation.”
What OpenAI changed in response
The company said it banned or restricted the fraudulent accounts, tightened sign-up verification, and increased monitoring for related account networks. It also closed a “replay pathway” that could have let someone who obtained another user’s encrypted reasoning recover its contents, and added checks to detect and hold streamed output that might expose hidden reasoning. OpenAI says it shared its findings through the Frontier Model Forum and government information-sharing channels, arguing the risk applies to other frontier developers too.
Why it matters
This is the frontier-lab version of industrial espionage, and it’s not the first accusation: Anthropic previously accused several Chinese developers, including Moonshot, of distilling Claude’s capabilities. The new battle in the AI race isn’t just who builds the best model — it’s who can protect how their model thinks. Distilled reasoning is valuable precisely because it captures the expensive, hard-to-replicate part of a model, minus the safety guardrails built into the original. Expect model APIs to get noticeably stricter about what reasoning traces users can see.
Quick answers
Did the attackers break OpenAI’s encryption?
According to OpenAI, no. They manipulated model interactions to surface protected reasoning rather than breaking encryption or accessing stored conversations.
Did OpenAI blame Moonshot AI as a company?
It attributed a “core cluster” of activity to individuals associated with Moonshot AI, while saying it could not attribute every operator or confirm who directed them.
What is adversarial distillation?
OpenAI’s term for the systematic, unauthorized use of one model’s outputs or reasoning to train, reproduce, or improve another model.
Sources: The Hacker News, Bloomberg (via AI Weekly), cybersecuritynews.com, StockTwits.