OpenAI Disrupts Model Distillation Campaign Linked to Moonshot AI

OpenAI said on Wednesday it identified and disrupted a coordinated campaign designed to extract the protected internal reasoning from its models, tracing a "core cluster" of the activity to Moonshot AI, the Chinese lab behind the Kimi models.

What happened

The campaign, which OpenAI describes as "adversarial distillation," began in the first week of July and spiked on July 24 and 25 with roughly 16,000 requests from more than 4,000 users. By July 28, the company said it had identified related prompt patterns across a cluster of more than 15,000 accounts and fully disrupted the operation.

The operators never breached OpenAI's encryption, databases, or stored user conversations. Instead, they manipulated model interactions so that hidden reasoning could be surfaced in a form visible to the requester. In one novel technique, attackers copied encrypted reasoning from one conversation and asked a model in a separate conversation to decrypt and transcribe the hidden content.

Why it matters

Adversarial distillation lets a competitor reproduce frontier capabilities without paying for the underlying research. OpenAI warned that extracting protected reasoning can reveal information normally withheld from final answers and help others reproduce the model's capabilities at a fraction of the cost.

The disclosure lands weeks after Anthropic accused several Chinese developers, including Moonshot AI and Alibaba, of secretly using Claude to train their own models. The U.S. Cybersecurity and Infrastructure Security Agency has also named Moonshot among companies it believes are extracting data and reasoning from American models.

What this means for builders

For AI builders, the episode is a reminder that model security is now an adversarial problem, not just a safety one. OpenAI said it is strengthening protections for hidden reasoning across users, workspaces, and model families, closing a pathway that had let someone replay another user's encrypted reasoning, and adding checks to detect streamed output that might leak reasoning. It is also sharing technical indicators through the Frontier Model Forum and government channels.

The takeaway is blunt: reasoning traces are now the crown jewels, and every frontier lab is hardening its inference stack against extraction. For teams shipping agents on top of these models, expect reasoning-level access controls and monitoring to become a standard part of the API surface.

Sources: OpenAI, CNBC, The Verge