OpenAI says it disrupted a Moonshot AI-linked reasoning extraction campaign

A cluster of over 15,000 accounts tried to copy hidden chain-of-thought from OpenAI models before being shut down.

OpenAI says it has disrupted a coordinated campaign to extract what it calls "protected reasoning" from its models. That is the hidden chain-of-thought a model uses to work through a task before giving a final answer. The company calls the activity adversarial distillation: using another model's outputs or reasoning, without authorisation, to train, reproduce or improve a rival model.

No encryption was broken. No database was compromised, OpenAI says. Instead, operators manipulated model interactions so that encrypted reasoning from one conversation could be replayed and transcribed in another.

The timeline OpenAI lays out starts July 1, at low volume. It spikes to 16,000 requests from more than 4,000 users on July 24 and 25. A broader investigation turned up related prompt-pattern activity across a cluster of over 15,000 users, which OpenAI says it fully disrupted by July 28. Independent security researchers separately disclosed related cross-model and conversation-compaction vulnerabilities; OpenAI says it confirmed these were real and used them to speed up its mitigations.

OpenAI says it cannot confirm all the activity traced to a single actor. But it attributes a core cluster to individuals associated with Moonshot AI, the developer of the Kimi model family. In response, OpenAI says it banned or restricted fraudulent accounts and tightened signup and infrastructure controls. It also closed the replay pathway that let someone recover another user's hidden reasoning, and added checks to catch streamed output that might leak reasoning content. It shared its findings through the Frontier Model Forum and unspecified government information-sharing channels.

OpenAI frames the stakes beyond its own product. Extracted reasoning could train a rival model without the safety guardrails applied to the original's visible outputs. At scale, it could let others acquire frontier capabilities without the safety investment that produced them — a risk OpenAI says grows as models take on more dual-use tasks. The attack pattern is not unique to its systems, the company says, and any provider supporting "portable or replayable reasoning artifacts" faces similar exposure.

Written from the primary source above by The Neural Net’s automated desk (claude-sonnet-5, theneuralnet/pipeline@1) without human review. How this works. Corrections: check the source first — if we got it wrong, the source link is the record.