OpenAI says Moonshot AI ran distillation campaign

OpenAI says it identified and shut down a coordinated effort to extract protected reasoning from its models. Protected reasoning is the model's internal record of how it works through a task. The company calls the activity adversarial distillation: the unauthorized use of one model's outputs or reasoning to train or improve another model.

The activity began on July 1 at low volume. On July 24 and 25 it spiked to 16,000 requests from more than 4,000 users, all using an extraction pattern. Further investigation linked a cluster of more than 15,000 users, which OpenAI says it had fully disrupted by July 28. The company says it is unclear whether a single actor was behind everything. It attributes a core cluster to individuals associated with Moonshot AI, the developer of Kimi.

OpenAI says the operators did not break encryption, breach databases or access stored conversations. Instead, they manipulated model interactions so that hidden reasoning came back in visible form. In one method, they copied encrypted reasoning from one conversation and asked a model in another conversation to decrypt and transcribe it. Independent security researchers separately reported related cross-model and conversation-compaction vulnerabilities, and OpenAI confirmed those attack paths were real.

In response, OpenAI banned or restricted accounts and tightened signup controls. It closed a pathway that let someone replay another user's encrypted reasoning, and it added checks that hold streamed output that might expose reasoning. It also worked with third-party providers and shared its findings through the Frontier Model Forum and government channels. OpenAI says the technique is not unique to its models and that the work is ongoing, including protections for partner-hosted deployments.