OpenAI Says It Disrupted a Distillation Campaign

In a post dated 30 September 2026, OpenAI says it identified and disrupted a coordinated campaign to extract the protected reasoning of its models, with the earliest observed activity on 1 July. It says a spike on 24 and 25 July consisted of 16,000 requests from over 4,000 users, that related activity spanned more than 15,000 users and was fully disrupted by 28 July, and that it attributes a core cluster to individuals associated with Moonshot AI.

What OpenAI Says It Found

OpenAI says the activity is “consistent with adversarial distillation: the systematic and unauthorized use of one model’s outputs or reasoning to help train, reproduce, or improve another model.” It defines protected reasoning as the model’s internal record for working through a task, and says extracting it can reveal information withheld from the final answer.

OpenAI says the operators did not break its encryption, compromise a database or gain direct access to stored user conversations. Instead, it says, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester, in a coordinated, scaled way that violated its terms of service.

OpenAI says this is not a vulnerability unique to its models, and that it shared information about it with industry partners through the Frontier Model Forum.

How It Says the Extraction Worked

OpenAI says it saw operators try to extract protected reasoning in novel ways, including by copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden reasoning content.

It says independent security researchers also brought related cross-model and conversation-compaction vulnerabilities to its attention through responsible disclosure, that it confirmed the attack paths they identified were real, and that their work helped it understand the broader attack class.

The Numbers

OpenAI says the activity began on 1 July at a low volume, until high-volume spikes on 24 and 25 July consisting of 16,000 requests using a relevant extraction pattern from over 4,000 users. It says further investigation found related prompt-pattern activity across a cluster of more than 15,000 users, which it fully disrupted by 28 July.

Its Attribution

OpenAI says it is unclear whether all the operators it observed in the period came from a single actor. It says it attributes “a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.”

This publication did not read any response from Moonshot AI and did not seek one.

How OpenAI Says It Responded

OpenAI says it banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, and expanded monitoring for related networks. It says it also strengthened protections for hidden reasoning across users, workspaces, organizations and model families.

It says it closed a pathway that allowed someone who already possessed another user’s encrypted reasoning to replay it and recover its contents, and added checks to detect and hold streamed output that might expose reasoning. When related activity moved through third-party services, it says it worked with those providers to identify and disrupt the accounts involved.

OpenAI says it shared its findings through the Frontier Model Forum and appropriate government information-sharing channels.

Why OpenAI Says It Matters

OpenAI says adversarial distillation poses safety and national security risks. It says extracted reasoning could be used to train another model without preserving the safeguards applied to the original model’s user-facing outputs, and that at scale distillation can accelerate the transfer of advanced capabilities without requiring the same investment in safety. It says these concerns become heightened as models gain capabilities in dual use domains.

OpenAI says it expects adversarial distillation attempts to become more sophisticated as frontier models improve, that its work is not finished, and that partner-hosted deployments need the same protections as first-party services.

The Structural Read

OpenAI describes two different scales. The 16,000 requests from over 4,000 users belong to a spike on 24 and 25 July. The more than 15,000 users are a wider cluster of related prompt-pattern activity. The text of the post gives no request count for the wider cluster.

The method OpenAI describes turns on how reasoning is handled between conversations: encrypted reasoning copied from one conversation, and a model in another conversation asked to decrypt and transcribe it. OpenAI says it closed a pathway that let someone who already held another user’s encrypted reasoning replay it and recover its contents.

OpenAI hedges the attribution in its own words. It says it is unclear whether all operators came from a single actor, and attributes only “a core cluster of the activity” to individuals associated with Moonshot AI. This publication read no response from Moonshot AI.

Three Implications

A TERMS-OF-SERVICE PROBLEM AT SCALE OpenAI says the manipulation was coordinated, scaled and violated its terms of service. It says its response combined account enforcement, technical controls and partner coordination, including banning or restricting fraudulent accounts and expanding monitoring for related networks.

A SHARED DEFENCE OpenAI says it shared its findings through the Frontier Model Forum and government information-sharing channels. It says this is not a vulnerability unique to its models and that similar techniques may affect other advanced AI systems.

WHAT REMAINS UNKNOWN The text of the post does not say how much protected reasoning, if any, was successfully extracted, and the footnote on the 16,000 figure was not in the text this publication retrieved. No response from Moonshot AI was read, and OpenAI says its work is not finished.

What Is Not Established

The text of the post this publication retrieved carries a footnote marker on the 16,000-request figure but not the footnote itself. It does not say how much protected reasoning, if any, was successfully extracted, and it gives no amounts, account names or code beyond what is quoted above.

OpenAI’s attribution is its own assessment, stated with the caveat above. This publication read the post only, did not read any response from Moonshot AI and did not seek responses from OpenAI or any other company.

The Bottom Line

OpenAI says it disrupted a coordinated campaign to extract its models’ protected reasoning: activity from 1 July, a 24–25 July spike of 16,000 requests from over 4,000 users, and a wider cluster of more than 15,000 users fully disrupted by 28 July. It attributes a core cluster to individuals associated with Moonshot AI while saying it is unclear whether all operators were a single actor.