OpenAI Disrupts Moonshot AI Data Extraction Campaign Targeting Model Reasoning
13 Sources
[1]
OpenAI claims Moonshot extracted its data to train AI models.
In a blog post on Wednesday, OpenAI says it disrupted a "coordinated campaign designed to extract protected reasoning from our models." The company hasn't linked the activity to a single actor, but traced a "core cluster" of it to Moonshot, the Chinese company behind the leading AI model Kimi.
[2]
OpenAI says actors linked to China-based Moonshot AI spearheaded a campaign to extract its models' hidden reasoning -- logged 16,000 extraction requests across 4,000 accounts before cutoff
OpenAI disrupted the campaign from July and has tightened its protections. OpenAI said in a company blog post that people associated with China-based Moonshot AI were at the core of an effort to pull hidden reasoning from its models. The post says that a "coordinated campaign" to extract
[3]
Irony alert: OpenAI whines that Chinese model stole its special IP that it stole from everybody else
OpenAI, which hoovered up vast amounts of internet content amid copyright fights, has accused individuals associated with China's Moonshot AI of being involved in a "distillation attack" that began July 1. The house of Altman warns that extracting its models' reasoning at scale could help rivals
[4]
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates
OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A "core cluster of the activity," going back to the first week of July, has been attributed to
[5]
OpenAI links China's Moonshot AI to attempt to extract its models' reasoning
* OpenAI said the activity surged to 16,000 requests from more than 4,000 users over two days, with related activity ultimately identified across more than 15,000 users. * The company said operators did not breach its encryption, databases or stored user conversations. * The findings come weeks
[6]
OpenAI says Moonshot-linked users tried to extract its AI reasoning
The Moonshot distillation campaign peaked at 16,000 requests in two days in July, OpenAI says. It has banned the accounts and shared its findings with rival labs and government. OpenAI says people linked to Moonshot AI, the Chinese developer of Kimi, were behind a coordinated campaign to extract
[7]
OpenAI disrupts Moonshot AI model reasoning theft campaign
The activity began in early July and surged to 16,000 requests from more than 4,000 users before OpenAI shut it down by July 28 OpenAI has announced that it detected and shut down a coordinated effort by operators to pull protected reasoning out of its AI models, with a central cluster of that
[8]
OpenAI Says People Linked to China's Moonshot Tried to Copy Its AI's Hidden Reasoning
The target was the hidden "reasoning" OpenAI's models generate before answering, which OpenAI says could train another model without the original safeguards. OpenAI claims to have shut down a coordinated effort to copy the way its AI models think, and it traces a core cluster of that activity to
[9]
OpenAI says it disrupted large-scale effort to copy its AI model capabilities
The company said the activity was consistent with what it described as adversarial distillation, a practice involving the systematic and unauthorised use of one model's outputs or reasoning to help develop another model. OpenAI said it has disrupted a coordinated campaign aimed at extracting
[10]
OpenAI Says Moonshot AI-Linked Users Tried to Extract its Models' Secret Reasoning OpenAI Says Moonshot A
OpenAI said individuals allegedly associated with Moonshot AI, the Chinese developer behind Kimi, were part of a broader campaign to extract "protected reasoning" from its AI models, using thousands of requests designed to reproduce information the company keeps hidden. "It is unclear whether all
[11]
Moonshot AI Of Kimi K3 Fame Tried To Crack OpenAI's Encrypted Reasoning Through 16,000 Requests, Bolstering Trump Administration's Distillation Claims
Once or twice can be a fluke, but thrice is a pattern, and OpenAI is now making sure that Moonshot AI - the lab behind the wildly successful Kimi K3 model - is tagged as a serial violator when it comes to orchestrating model distillation campaign, echoing similar calls from the Trump administration
[12]
OpenAI Cracks Down on AI Model Reasoning Extraction Campaign
OpenAI confirmed it disrupted a coordinated campaign that tried to extract protected reasoning from its AI models, with a core cluster of the activity linked to individuals associated with Moonshot AI, the Chinese company behind the Kimi AI models. According to OpenAI, the campaign began on July
[13]
OpenAI Flags 16,000 ChatGPT Extraction Attempts, Accuses Moonshot AI
OpenAI has accused individuals linked to Chinese AI company Moonshot AI of extracting protected reasoning from its models. The campaign allegedly began on July 1, 2026, and targeted OpenAI systems online to support model distillation efforts. OpenAI says operators manipulated model interactions
Share
Copy Link
OpenAI identified and stopped a coordinated campaign designed to extract protected reasoning from its AI models, linking core activity to China-based Moonshot AI. The July operation peaked at 16,000 extraction requests across 4,000 accounts before disruption. Anthropic reported similar attacks involving nearly 300,000 fraudulent requests.
OpenAI Disrupts Coordinated Campaign to Extract Protected Reasoning
OpenAI identified and disrupted a coordinated campaign designed to extract protected reasoning from its AI models, linking a core cluster of activity to individuals associated with Moonshot AI, the Chinese company behind the Kimi AI model
1
. The activity began on July 1, initially at low volume, before spiking dramatically on July 24 and 25 with 16,000 requests using an extraction pattern from over 4,000 users2
. Upon further investigation, OpenAI identified related prompt-pattern activity across more than 15,000 users before fully disrupting the campaign by July 285
.
Source: Hacker News
Understanding Adversarial Distillation and Data Extraction Methods
OpenAI characterized the activity as adversarial distillation, which involves the systematic and unauthorized use of one model's outputs or reasoning to train or improve another model
4
. Protected reasoning refers to the model's internal record for working through a task, which is encrypted to hide the model's chain of thought and handed to clients as an encrypted block2
. The operators manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester in a coordinated, scaled manner that violated OpenAI's terms of service3
. One method attempted by operators took encrypted reasoning from one conversation and asked a model in another to decrypt it2
.
Source: Tom's Hardware
AI Model Security Vulnerabilities Exposed by Researchers
Independent security researchers brought related cross-model and conversation-compaction vulnerabilities to OpenAI through responsible disclosure, confirming the attack paths were real
2
. A study published in August 2026 titled "Stealing Reasoning Traces from Proprietary LLM APIs" found an architectural vulnerability making encrypted reasoning traces fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem4
. Researchers from MATS Research, ELLIS Institute Tübingen, and Synk demonstrated that by injecting an encrypted reasoning trace from a given model into a weaker, less safeguarded model from the same provider, they could force it to decode and output the trace verbatim in plaintext through decryption jailbreaks4
.Security Measures and Response to Reasoning Extraction Campaign
The operators did not break OpenAI's encryption, compromise a database, or gain direct access to stored user conversations
2
. OpenAI deployed additional mitigations including closing a pathway that allowed someone who already possessed another user's encrypted reasoning to replay it and recover its contents through replay attacks4
. The company added checks to detect and hold streamed output that might expose reasoning, strengthened protections for hidden reasoning across users, workspaces, organizations, and model families, and worked with third-party providers to disrupt accounts whose activity moved through their services2
.Related Stories
Anthropic Reports Similar Distillation Attack by Moonshot AI
Anthropic faced similar threats from Moonshot AI in a coordinated campaign. According to Anthropic's report "Detecting and countering misuse of AI: September 2026," during a single ten-day period, Moonshot relayed almost 300,000 customer requests to Anthropic using a proxy network of 5,380 fraudulent accounts
2
. Moonshot saved Claude's reasoning signatures and, in new sessions, got Claude to convert them back into full reasoning traces through what Anthropic calls cross-session replay attacks2
. In late July, US President Donald Trump's Assistant for Science and Technology Michael Kratsios accused Moonshot AI of creating its Kimi K3 model by distilling Anthropic's Fable3
.
Source: The Next Web
AI Safety and National Security Implications of Model Distillation
OpenAI emphasized that adversarial distillation poses AI safety and national security risks. Extracted reasoning could be used to train another model without preserving the safeguards applied to the original model's user-facing outputs
3
. At scale, distillation can accelerate the transfer of advanced capabilities without requiring the same investment in safety, with concerns becoming heightened as models gain capabilities in dual-use domains4
. Extracting protected reasoning allows others to reproduce advanced capabilities without making the same investment in developing and safeguarding frontier models5
. OpenAI shared its findings with the Frontier Model Forum and government information-sharing channels, noting that systems supporting portable or replayable reasoning artifacts may face related risks2
. The company expects distillation attempts to grow more sophisticated as frontier models improve and as attackers look for cheaper ways to mimic them, with ongoing work to protect proprietary data protection and intellectual property2
.References
Summarized by
Navi
[3]
Related Stories
Anthropic accuses Alibaba of massive campaign to steal Claude AI capabilities with fake accounts
24 Jun 2026•Technology
Chinese Robotics Startup JoyIn Accuses OpenAI of Copying AI Model Ideas and Website Design
11 Sept 2026•Technology
Major AI Model Flaw Let Weaker Models Decode Encrypted Reasoning, Exposing 62 API Keys and Passwords
13 Aug 2026•Technology
Recent Highlights
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
