OpenAI says it detected and disrupted a coordinated campaign to distill its models by extracting their protected reasoning, and it attributed a core cluster of the activity to people working for China's Moonshot AI, CyberScoop reported Wednesday. OpenAI published no technical evidence for that attribution, and Moonshot had not responded to CyberScoop's request for comment.

What Happened

According to an unsigned OpenAI blog post described by CyberScoop, low-level suspicious activity began on July 1. It spiked on July 24 and 25, when OpenAI saw roughly 16,000 prompts using a similar extraction pattern from more than 4,000 users. By July 28 the number of linked users had grown past 15,000, and OpenAI said it had fully disrupted the operation.

OpenAI described the technique as novel. OpenAI does not show users the raw reasoning its models generate; developers can receive it as an encrypted blob to pass back into later requests. The operators copied that encrypted reasoning data out of one conversation, then opened separate sessions and asked the model to decrypt and transcribe it as plain text. OpenAI stressed that the operators did not break its encryption, compromise a database or gain direct access to stored user conversations. The weakness was the model's willingness to process reasoning data carried over from another conversation.

RelatedNew York City Comptroller Urges Anthropic to Delay IPO Over Safety and Governance Concerns

In response, OpenAI said it banned the accounts involved, tightened signup and infrastructure controls, expanded monitoring and fixed the bug that allowed cross-conversation decryption. It shared its findings with the Frontier Model Forum, the industry group of leading AI developers. CyberScoop noted that outside researchers had reported a similar vulnerability to OpenAI in August, and that OpenAI declined to share further details, citing security.

Why It Matters

Distillation, in which a smaller model is trained on the outputs of a stronger one, is a cheap way to close a capability gap. Hidden reasoning traces are especially valuable training material because they show how a model works through a problem, not just its final answer. That is a main reason labs withhold or encrypt them, and why a method to recover them in plain text at scale would be worth the effort of running thousands of accounts.

CyberScoop cited security experts who say operators behind such campaigns buy thousands of accounts on black or gray markets and then send millions of requests to systems such as ChatGPT and Claude. The scale OpenAI describes fits that pattern.

The Attribution Question

Moonshot, maker of the Kimi models, has faced distillation accusations before. The Register recalled that in late July, White House science and technology adviser Michael Kratsios accused Moonshot of building Kimi K3 by distilling an Anthropic model. Kimi is one of several Chinese open models that offer good-enough performance at low or no cost, which makes the allegations commercially significant as well as political.

Without published indicators, however, OpenAI's claim cannot be independently checked. The Register also questioned OpenAI's standing to complain, given that the company built its own models on large volumes of web content amid copyright disputes.

What to Watch

Key open questions are whether Moonshot responds, whether OpenAI or government agencies release evidence supporting the attribution, and whether Washington moves from accusations toward restrictions on distillation by foreign labs. Other AI developers that return encrypted or summarized reasoning may also review whether their systems will decode data carried in from another session.