OpenAI Says It Disrupted a Reasoning-Extraction Campaign Linked to Moonshot AI Associates

OpenAI disclosed on September 30, 2026 that it had disrupted a coordinated campaign to extract the hidden reasoning its models use to work through problems, and pointed at people tied to Moonshot AI, the Chinese developer of the Kimi family of models. In a post titled "Disrupting a coordinated model-distillation campaign," the company said the activity began in the first week of July and ended when it shut the operation down on July 28.

Related reading: OpenAI Moves Frontier Training Off the Live Internet and Onto a Cached Copy of the Web · OpenAI Revenue Below Expectations Sends AI-Linked Stocks Lower.

The disclosure came amid a widening dispute over distillation, the practice of using one model's outputs to train another. OpenAI calls this case adversarial distillation, because it says the operators violated its terms of service and targeted reasoning the company deliberately keeps out of view.

What OpenAI says happened

OpenAI says it first noticed low-level activity on July 1. Volume stayed small until July 24 and 25, when it recorded 16,000 requests from more than 4,000 users that matched what the company calls a relevant extraction pattern. A closer look turned up related prompt activity across a cluster of more than 15,000 accounts. By July 28, OpenAI said it had fully disrupted the operation.

The company attached a footnote to those figures: they describe attempted, not necessarily successful, extractions. OpenAI has not said how much reasoning, if any, the operators recovered, and that gap runs through the whole disclosure.

The targeting was specific. OpenAI has increasingly hidden the reasoning a model produces before it answers, so the operators went after a spot where that reasoning can still surface: the encrypted data a model uses to carry its internal state between messages.

The method: encrypted reasoning, moved between conversations

OpenAI called the technique novel. The operators copied encrypted reasoning data from one conversation, then opened a separate conversation and asked the model to decrypt the content and write it out in plain text. According to the company, the operators did not break its encryption, compromise a database, or reach stored user conversations. They manipulated model interactions instead, at a scale that violated the terms of service.

The immediate cause was a bug: the system let a user take encrypted data from one conversation and decrypt it in another. OpenAI says it closed that pathway and added checks to hold back streamed output that might expose reasoning.

The flaw was not OpenAI's alone. Researchers at MATS Research, the ELLIS Institute Tübingen and Synk reported a similar architectural vulnerability in August 2026, finding that encrypted reasoning traces could be replayed across sessions, users and models inside a single provider's ecosystem. A weaker and less guarded model, the researchers said, could be induced to decode a stronger model's trace without jailbreaking the stronger model directly. The Hacker News reported that OpenAI recreated the researchers' findings and confirmed the attack paths. OpenAI has said the same vulnerability exists in other AI models.

Why the bug matters beyond one provider

The campaign exposes a design tension. Providers began hiding their reasoning because it can be copied, and because it can reveal information a model otherwise withholds. But a model still needs to pass that reasoning between turns, so the system encrypts it and hands it back to the client. The bug OpenAI fixed sat in that handoff.

The Hacker News reported that the outside researchers described the encrypted traces as "fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem." If that holds, the weakness is not specific to OpenAI or to one model. It is a property of treating encrypted reasoning as portable state, and it puts every lab that does so in the same category. OpenAI's note that the vulnerability exists elsewhere fits that view.

The attribution gap

OpenAI attributes a core cluster of the activity to individuals associated with Moonshot AI, the developer of the Kimi family of models. It also says it is unclear whether all the activity it observed came from a single actor, which leaves room for unrelated users who happened to trip the same pattern.

The company published no technical evidence for the Moonshot link. CyberScoop reported that the blog post cites no technical evidence or reasoning for the attribution. OpenAI told the outlet it would not share more "for security reasons." Moonshot did not immediately respond to requests for comment from CyberScoop or CNBC.

That gap matters. "Individuals associated with Moonshot AI" is narrower than "Moonshot AI did this," and OpenAI's own language keeps the two separate. The implication is serious, but the public record so far is an accusation without the underlying evidence attached to it.

Context: a widening fight over distillation

OpenAI's disclosure arrived into a dispute that had been building for months. On September 8, 2026, CISA, the NSA and the FBI released a joint advisory, AA26-251A, describing what it called industrial-scale distillation by China-based AI companies. The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It says Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train Kimi-K2, and it describes "transfer stations," proxy networks that resell access to frontier models and help buyers get around regional restrictions and safeguards.

Distillation itself is not the target, and the advisory says as much. Training a smaller model on a larger model's outputs is a standard and useful technique in AI research. What the advisory and OpenAI describe is a different activity: gathering a rival's outputs at industrial scale, against terms of service, to close a capability gap quickly.

The advisory recommended three broad responses: better detection of anomalous prompts, accounts and networks; changes that quietly degrade the value of suspected distillation requests; and intelligence sharing across providers, cloud platforms and API aggregators so distributed campaigns become visible.

OpenAI's account matches a pattern the federal advisory describes: fraudulent accounts, shared subscriptions and proxy infrastructure, with requests spread across providers so no single company sees the whole campaign. That is why the advisory calls for correlating activity across companies.

Two days after the federal advisory, Anthropic published its September 2026 threat-intelligence report. In a case it tracked as GTG-16002, Anthropic said Moonshot AI silently forwarded customer requests to Claude instead of processing them with Kimi, then displayed Claude's answers to users who believed they were talking to Kimi. In one ten-day stretch, Anthropic said Moonshot relayed almost 300,000 customer requests through a network of 5,380 fraudulent accounts. Anthropic also said Moonshot built a pipeline to extract Claude's reasoning transcripts from the saved exchanges.

Earlier, White House Office of Science and Technology Policy director Michael Kratsios had accused Moonshot of large-scale distillation and of acquiring restricted Nvidia chips to build Kimi K3, as Quartz noted. Moonshot has not publicly answered the latest allegations.

The dispute is also about economics. Frontier labs increasingly treat hidden reasoning as the asset that separates an answer from a competitor's model, which is why it is now withheld. Distillation offers a shortcut around that: harvest another lab's reasoning, train against it, and skip years of trial and error.

What OpenAI changed

OpenAI described its response in layers. It banned or restricted fraudulent accounts, tightened signup and infrastructure controls, and expanded monitoring for related networks. It also strengthened protections for hidden reasoning, the fix meant to stop anyone who holds another user's encrypted reasoning from recovering its contents.

The company said it shared its findings with the Frontier Model Forum, an industry group, and through government information-sharing channels. It said its work continues in three areas: stronger technical protections against extraction, better detection and enforcement against coordinated campaigns, and deeper threat-information sharing across industry and government. The post does not say how many accounts were banned, which models were targeted, or whether OpenAI contacted Moonshot AI directly.

The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations.

That is OpenAI's own description of the campaign, from its September 30 post.

Caveats

• The July figures are attempts, not confirmed successes. OpenAI's footnote is explicit, and the company has not said what the campaign actually obtained.
• The attribution stops short of the company. OpenAI ties a core cluster to individuals associated with Moonshot AI, not to the firm as an institution, and says some of what it saw may be unrelated.
• No technical evidence is public. The strongest source for the Moonshot link is OpenAI's own characterization, repeated by outlets that also note the absence of supporting detail.
• The fix may not be complete everywhere. The Decoder reported that outside researchers found the same class of technique still working on cloud platforms for weeks, with some safeguards arriving late. If that holds, the weakness is a shared architectural problem, not one patched bug.

What to watch

Three things will shape where this goes next.

First, Moonshot's response. The company has stayed quiet so far. A denial, a technical rebuttal or continued silence each carries different weight, and none of them would settle the underlying question on its own.

Second, whether OpenAI publishes more. Its refusal to share evidence "for security reasons" is understandable when attackers are still active, but an unattributed finding is hard for the rest of the industry to act on. The Frontier Model Forum is the likeliest place for more detail to surface first.

Third, regulation. The federal advisory already frames distillation as a national-security concern, and policy attention to Chinese model development keeps rising. New rules or enforcement could follow, and they would land on an industry that has so far handled distillation through terms of service and account bans.

None of those three developments would settle the central factual question, which is whether OpenAI's evidence would hold up outside the company. Until it publishes more, the disclosure is one lab's account of a real technical failure, attached to an attribution that no outside party has yet been able to check.

Cover: OpenAI CEO Sam Altman. Image: Village Global / Wikimedia Commons, CC BY 2.0.