OpenAI Says It Shut Down a Reasoning-Extraction Campaign and Links It to People Associated With Moonshot AI

OpenAI published an account of what it calls a coordinated model-distillation campaign aimed at its protected reasoning traces. By the company's description, the operators did not break encryption or reach a database. Instead, they copied encrypted reasoning artifacts out of one session and then prompted a model in a separate context to transcribe the contents, turning a hidden intermediate step into training-grade text.

The volume figures OpenAI gives are specific. It detected the activity in early July, saw a surge on July 24 and 25 with roughly 16,000 requests in a day from more than 4,000 users, identified related prompt patterns across a cluster of more than 15,000 accounts, and says it contained the behavior by July 28. Its remediation combines account enforcement with stricter server-side handling of hidden reasoning across accounts, workspaces and model families. OpenAI attributes the core cluster to individuals associated with Moonshot AI, the Chinese lab behind the Kimi models, a claim CyberScoop and CNBC also report.

What is verified and what is asserted differ here. The request volumes, the account clustering and the transcription technique come from OpenAI's own telemetry, which no outside party can audit. The attribution to Moonshot-linked individuals is OpenAI's inference from that telemetry, and Moonshot has not published a detailed rebuttal. OpenAI also benefits if the claim is accepted: distillation by Chinese labs is already an argument in Washington for tighter controls on model access, and the same facts support charging more for endpoints that expose reasoning.

The defensive problem is now a published research topic rather than a vendor secret. A technical report posted this week on inference-layer security argues that running an LLM as a service requires a distinct defensive layer above the serving stack, covering jailbreaks and infrastructure abuse alongside extraction. That framing matches what OpenAI describes doing: treating the API boundary, not the weights, as the asset under attack.