# OpenAI Says It Blocked a Campaign to Extract Hidden Reasoning Traces, Naming People Linked to Moonshot AI

Requests peaked at about 16,000 from more than 4,000 accounts over two days in late July, as operators copied encrypted reasoning from one session and asked a model in a separate session to decrypt and transcribe it.

- Published: 2026-10-03T06:33:24.401Z
- Canonical: https://polylog.news/ai/2026-10-03/openai-says-it-blocked-a-campaign-to-extract-hidden-reasonin
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [Decrypt](https://decrypt.co/379890/openai-china-moonshot-copy-ai-hidden-reasoning), [South China Morning Post](https://www.scmp.com/tech/tech-war/article/3361625/global-ai-experts-push-back-us-distillation-claims-against-moonshots-kimi-k3-model)

OpenAI says it detected and disrupted what it calls a coordinated adversarial distillation campaign aimed at its models' protected reasoning traces. The company says it traced the core cluster of this activity to individuals associated with Moonshot AI, the Chinese lab that built the Kimi family of models. According to [OpenAI's account as reported by Decrypt](https://decrypt.co/379890/openai-china-moonshot-copy-ai-hidden-reasoning), activity consistent with distillation appeared in the first week of July. On July 24 and 25, the company counted roughly 16,000 requests from more than 4,000 accounts following a single extraction pattern. A [Russian-language summary circulated by AI ML Big Data](https://t.me/ai_machinelearning_big_data/11066) describes the same cluster of about 4,000 accounts and the attribution to Moonshot.

The technique matters most to anyone serving reasoning models. OpenAI says the operators did not break its encryption or reach stored conversations. Instead, they copied encrypted reasoning emitted in one conversation and asked a model in a separate conversation to decrypt and transcribe it, [as relayed in AI Post's summary](https://t.me/aipost/8344). This is a prompt-level attack on the boundary between a model's visible output and its internal reasoning trace, not a breach of OpenAI's infrastructure. That distinction means the available fix is behavioral and account-level control, not stronger encryption.

What is independently verified here is limited. OpenAI is the sole source for the request counts, the timeline, and the attribution, and no independent party has reproduced its data. Moonshot's head of enterprise business has said Kimi K3 is "not a distillation or replica of existing models" and that its gains came from architectural work. [The South China Morning Post reported that researchers outside China have pushed back on earlier distillation allegations against K3](https://www.scmp.com/tech/tech-war/article/3361625/global-ai-experts-push-back-us-distillation-claims-against-moonshots-kimi-k3-model), calling such claims difficult to establish from model behavior alone. Anthropic made similar claims about several Chinese developers earlier this year.

Both sides have a clear commercial motive. Hidden chain-of-thought reasoning is the asset that justifies premium pricing on frontier reasoning tiers, so a lab that publicizes an extraction attempt is defending its pricing power as well as its intellectual property. A lab accused of copying has strong reason to insist its architecture is original, because such accusations feed directly into Washington's case for restricting Chinese access to American model APIs.

## What this means

The underlying mechanism is access control at the API boundary. If reasoning traces can be extracted through ordinary paid accounts, the only available defenses are identity verification, rate limiting, and geographic gating, and all of them add friction for legitimate developers. The parties exposed are closed-weight vendors whose margins depend on keeping their reasoning traces secret, and Chinese labs that still rely on US model endpoints for evaluation and comparison. The precedent is the DeepSeek distillation dispute of early 2025, which led to tighter know-your-customer rules on frontier APIs rather than litigation. Over the next few months, the likelier outcome is more of the same: stricter enterprise verification, more aggressive trace encryption, and formal referrals through industry bodies, with Chinese labs relying more on their own open-weight systems for benchmarking. That reading would be undercut by a technical disclosure, from either side or a third party, showing the extracted traces were unusable for training, which would reduce this dispute to a terms-of-service matter.

## What to watch

- Whether OpenAI publishes forensic detail that outside researchers can verify, rather than aggregate request counts alone, since independent verification separates a security disclosure from a competitive claim.
- Whether US policymakers cite this episode when writing rules on foreign access to American model APIs, which would turn a company dispute into export-control policy.
- Whether other reasoning-model vendors change how they emit or encrypt intermediate traces, a sign the attack generalizes beyond OpenAI.