OpenAI Says It Disrupted Distillation Campaign Tied to Moonshot AI

What OpenAI says happened

According to OpenAI, the campaign was designed to pull out "protected reasoning," which the company defines as the model's internal record for working through a task. Extracting it can reveal information withheld from the final answer and help others reproduce the model's capabilities. OpenAI calls the broader practice adversarial distillation: the systematic and unauthorized use of one model's outputs or reasoning to help train, reproduce, or improve another model.

OpenAI stresses that the operators did not break its encryption, compromise a database, or gain direct access to stored user conversations. Instead, it says, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester, in a coordinated and scaled way that violated its terms of service.

One method the company describes was copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden content. Independent security researchers also reported related cross-model and conversation-compaction vulnerabilities through responsible disclosure. OpenAI says it confirmed the attack paths were real and that the work helped it speed up mitigations.

Timeline and attribution

OpenAI says the activity began on July 1 at low volume. It saw high-volume spikes on July 24 and 25, consisting of 16,000 requests using a relevant extraction pattern from over 4,000 users. Further investigation found related prompt-pattern activity across a cluster of more than 15,000 users, which the company says it fully disrupted by July 28.

On attribution, OpenAI says it is unclear whether all operators it observed came from a single actor. It does, however, attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.

How OpenAI responded

The company says it combined account enforcement, technical controls and partner coordination. Its measures included:

• Banning or restricting fraudulent accounts, strengthening signup and infrastructure controls, and expanding monitoring for related networks.
• Strengthening protections for hidden reasoning across users, workspaces, organizations and model families.
• Closing a pathway that let someone who already held another user's encrypted reasoning replay it and recover its contents.
• Adding checks to detect and hold streamed output that might expose reasoning.

When related activity ran through third-party services, OpenAI says it worked with those providers to identify and disrupt the accounts involved. It also shared findings through the Frontier Model Forum and government information-sharing channels. OpenAI says the manipulation is not a vulnerability unique to its models, and warns that systems supporting portable or replayable reasoning artifacts may face related risks.

Why it matters and what comes next

OpenAI argues that adversarial distillation poses safety and national security risks. Extracted reasoning could be used to train another model without preserving the safeguards applied to the original model's user-facing outputs. At scale, the company says, distillation can accelerate the transfer of advanced capabilities without requiring the same investment in safety, a concern that grows as models gain capabilities in dual use domains.

The company expects attempts to become more sophisticated as frontier models improve and as actors look for cheaper ways to mimic their capabilities. It says the work is not finished: partner-hosted deployments need the same protections as first-party services, and tool-output attacks require protections that examine more than ordinary visible text. OpenAI says it is continuing to improve tool defenses, classifier coverage and model refusals, and to propagate controls across cloud partners. Its response will focus on stronger technical protections, better detection and enforcement against coordinated campaigns, and deeper threat-information sharing across industry and government.