OpenAI Says It Blocked a Campaign to Extract Hidden Reasoning Traces, Naming People Linked to Moonshot AI

OpenAI says it detected and disrupted what it calls a coordinated adversarial distillation campaign aimed at its models' protected reasoning traces. The company says it traced the core cluster of this activity to individuals associated with Moonshot AI, the Chinese lab that built the Kimi family of models. According to OpenAI's account as reported by Decrypt, activity consistent with distillation appeared in the first week of July. On July 24 and 25, the company counted roughly 16,000 requests from more than 4,000 accounts following a single extraction pattern. A Russian-language summary circulated by AI ML Big Data describes the same cluster of about 4,000 accounts and the attribution to Moonshot.

The technique matters most to anyone serving reasoning models. OpenAI says the operators did not break its encryption or reach stored conversations. Instead, they copied encrypted reasoning emitted in one conversation and asked a model in a separate conversation to decrypt and transcribe it, as relayed in AI Post's summary. This is a prompt-level attack on the boundary between a model's visible output and its internal reasoning trace, not a breach of OpenAI's infrastructure. That distinction means the available fix is behavioral and account-level control, not stronger encryption.

What is independently verified here is limited. OpenAI is the sole source for the request counts, the timeline, and the attribution, and no independent party has reproduced its data. Moonshot's head of enterprise business has said Kimi K3 is "not a distillation or replica of existing models" and that its gains came from architectural work. The South China Morning Post reported that researchers outside China have pushed back on earlier distillation allegations against K3, calling such claims difficult to establish from model behavior alone. Anthropic made similar claims about several Chinese developers earlier this year.

Both sides have a clear commercial motive. Hidden chain-of-thought reasoning is the asset that justifies premium pricing on frontier reasoning tiers, so a lab that publicizes an extraction attempt is defending its pricing power as well as its intellectual property. A lab accused of copying has strong reason to insist its architecture is original, because such accusations feed directly into Washington's case for restricting Chinese access to American model APIs.