OpenAI Links Moonshot Users to 16,000-Request Distillation Push
TL;DR
- OpenAI's post confirms attackers relayed ciphertext across separate conversations to make protected reasoning legible, a novel cross-conversation extraction method not seen in prior distillation campaigns.
- The 16,000-request spike came from 4,000 users over 48 hours; related prompt-pattern activity touched 15,000+ users total before full disruption on July 28.
- Research cited by Wccftech shows specific Claude and GPT reasoning spans are six orders of magnitude more extractable from Kimi K3 than from any other model.
OpenAI says it has disrupted a coordinated campaign to extract its models' hidden reasoning, and pinned a core cluster of the activity on individuals associated with Moonshot AI, the developer of Kimi.
The volume tells the story. Activity began on July 1 at minimal volume, then spiked to 16,000 requests from more than 4,000 users on July 24 and 25. Further investigation identified related prompt-pattern activity across a cluster of more than 15,000 users. OpenAI says it fully shut the operation down by July 28.
The technique itself was blunt. Operators copied encrypted reasoning from one conversation and asked another model instance to decrypt and transcribe it. OpenAI says its encryption was not broken, no databases were accessed, and no stored user conversations were exposed.
OpenAI defines the behavior it caught as "adversarial distillation: the systematic and unauthorized use of one model's outputs or reasoning to help train, reproduce, or improve another model." Caroline Zier, who leads OpenAI's strategic national security policy work, told Bloomberg: "Our concern is about violation of our terms of service, not open models or legitimate distillation."
The company has banned the offending accounts, tightened sign-up verification, added protections for hidden reasoning, and shared the findings through the Frontier Model Forum and government channels. Anthropic has previously leveled similar accusations at Moonshot. The disclosure sits within a wider run of China-AI coverage our team has been logging this quarter.
What others are reporting
-
OpenAI Read →
First-party disclosure confirming cross-conversation ciphertext relay as the extraction method and establishing the Frontier Model Forum government notification chain.
We saw operators attempt to extract protected reasoning in novel ways, including by copying encrypted reasoning from one conversation and asking a model in another to decrypt it.
-
Bloomberg Read →
Tier-1 wire framing positions the incident as mass data extraction capable of reproducing OpenAI's most advanced capabilities, reaching financial and policy decision-maker audiences.
-
CNBC Read →
Business-news framing connects the disclosure directly to Kimi by name, adding market and enterprise audience reach to what security outlets frame as an adversarial AI incident.
-
BankInfoSecurity Read →
Security-sector coverage notes CISA and Anthropic previously flagged Moonshot, and flags Meta's public defense of distillation as complicating the legal case for sanctions.
-
Wccftech Read →
Cites research showing Kimi K3 is six orders of magnitude more susceptible to Claude/GPT reasoning extraction than rival models, linking disclosure to Trump administration prior claims.
We attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.
-
Tom's Hardware Read →
Developer-audience framing centers exact metrics: 16,000 requests from 4,000 accounts and a 15,000-user broader cluster, giving engineers a concrete scale benchmark for the operation.
Originally reported by thenextweb.com
Read the original article →Original headline: OpenAI Discloses Moonshot-Linked Users Ran 16,000-Request Campaign to Extract Its Model Reasoning