OpenAI Discloses: Moonshot AI-Linked Accounts Tried to Mass-Extract Model Reasoning

On September 30, OpenAI published a blog post saying it had detected and disrupted an “adversarial distillation” campaign targeting its models.

What Happened

The timeline is specific. Activity began on July 1, at low volume. Then on July 24–25 it spiked: in two days, more than 4,000 user accounts submitted roughly 16,000 requests matching extraction patterns. Following the trail, OpenAI found another 15,000+ users with related prompt-pattern activity. On July 28, the campaign was fully disrupted.

OpenAI attributed “a core cluster” of the activity to individuals linked to Moonshot AI, the Beijing company behind Kimi. But it hedged: it could not confirm whether all operators belonged to the same organization, and it did not publish the technical evidence behind the attribution, citing security concerns.

How They Did It

The key detail: nobody broke encryption, breached a database, or directly accessed stored user conversations.

According to OpenAI, the operators manipulated model interactions so that reasoning normally hidden from the requester was reproduced in visible form. One concrete technique it cited: copying encrypted reasoning from one conversation, pasting it into another, and getting the model to “decrypt and transcribe” the hidden content.

OpenAI calls this “adversarial distillation”: systematically and without authorization using one model’s outputs or reasoning to train, replicate, or improve another model.

Afterward, OpenAI took several steps: banned the fraudulent accounts, tightened signup verification, closed a “replay channel” — anyone who had obtained someone else’s encrypted reasoning could previously recover its contents via replay — and added new checks to intercept streaming outputs that might leak reasoning. The findings were also shared with peers through the Frontier Model Forum and government channels.

Why This Matters

OpenAI put it strongly in the blog post: “adversarial distillation poses safety and national security risks.” Extracted reasoning can be used to train another model — and the safety measures applied to the original model’s user-facing outputs don’t carry over.

In other words, once distillation reaches scale, it’s a low-cost way to copy capabilities using someone else’s safety investment. The stronger models get in dual-use domains, the bigger this problem becomes.

Caroline Zier, who leads strategic national security policy, added a clarifying line to Bloomberg, drawing the boundary: “We care about terms-of-service violations, not open models or legitimate distillation.”

A Few Reasons for Calm

First, this was an attempt at extraction, not successful extraction. OpenAI published the scale of the attempts, not a success rate.

Second, the attribution is to “individuals linked to Moonshot,” not to Moonshot the company. OpenAI did not say these people acted on company orders, nor that the founders knew. Equating “linked individuals” directly with “company conduct” is overreach.

Third, this isn’t the first time. A few months ago, Anthropic accused Chinese AI developers including Moonshot AI and Alibaba of large-scale distillation using Claude’s models. Two US companies naming the same Chinese company in succession — the front line of US-China model competition is shifting from “whose scores are higher” to “who’s stealing whose chain of thought.”

This offense-defense game is just getting started. Hidden reasoning is a reasoning model’s core asset — and its most sensitive part. What companies compete on next isn’t just building stronger models, but keeping their “thought processes” well hidden.