Frontier access is narrowing while oversight stacks. OpenAI said it disrupted a coordinated adversarial-distillation campaign to extract protected reasoning, attributing a core cluster to individuals associated with Moonshot AI. Activity peaked at 16,000 requests from more than 4,000 users over two July days; operators did not breach encryption or databases.
What OpenAI said it stopped
OpenAI published an account dated 30 September of a coordinated campaign designed to extract protected reasoning from its models — the internal record a model uses to work through a task. The company described the activity as adversarial distillation: the systematic, unauthorised use of one model’s outputs or reasoning to help train, reproduce, or improve another. Operators did not break encryption, compromise a database, or gain direct access to stored user conversations. Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester, in a coordinated way that OpenAI said violated its terms of service.
Observed activity began in the first week of July. OpenAI said volume spiked on 24 and 25 July to 16,000 requests using a relevant extraction pattern from more than 4,000 users. Related prompt-pattern activity was later identified across a cluster of more than 15,000 users and fully disrupted by 28 July. The published figures describe attempted, not necessarily successful, extractions. Independent researchers also disclosed related cross-model and conversation-compaction paths; OpenAI said it confirmed those attack paths and used the findings to accelerate mitigations.
Attribution and what was shared
OpenAI said it is unclear whether every operator originated from a single actor. It attributed a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi. CNBC reported that Moonshot did not immediately respond to a request for comment. OpenAI said it banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, closed a pathway that allowed someone who already possessed another user’s encrypted reasoning to replay it, and shared findings through the Frontier Model Forum and government information-sharing channels. It argued that extracted reasoning could be used to train another model without the original safeguards, with safety and national-security implications.
Coverage context
A model-theft fight is now a public incident report, not only a rumour: coordinated extraction of hidden reasoning, a named core cluster, and no database breach. It arrived beside gated frontier access and new enforcement stacks.
Read the full daily brief hub: www.aifusionautomations.com/news/