OpenAI Attributes a Reasoning-Extraction Cluster to Moonshot AI

Adversarial distillation just moved from FMF intel-sharing rhetoric to a named July campaign with volume numbers — and OpenAI’s first public attribution of an industrial-scale reasoning-extraction cluster to individuals associated with Moonshot AI, the Beijing lab behind Kimi.

OpenAI published on September 30 that it “identified and disrupted a coordinated campaign designed to extract protected reasoning from our models,” with earliest observed activity in the first week of July. Protected reasoning, in the lab’s definition, is the model’s internal working record — extraction can reveal information withheld from the final answer and help reproduce capabilities. The operators, OpenAI says, did not break encryption, compromise a database, or gain direct access to stored conversations. They manipulated multi-session interactions — copying encrypted reasoning from one conversation and asking another session to decrypt and transcribe it — at scale, in violation of terms of service. Independent security researchers also disclosed related cross-model / conversation-compaction paths; OpenAI says it confirmed those attack paths and accelerated mitigations.

Volume and disruption (company figures)

Activity began July 1 at low volume, then spiked July 24–25: ~16,000 requests using a relevant extraction pattern from >4,000 users. Related prompt-pattern activity spanned a cluster of >15,000 users; OpenAI says it fully disrupted the operation by July 28. A footnote on the post clarifies these figures describe attempted, not necessarily successful, extractions. CyberScoop, The Verge, and CNBC carry the same timeline from the blog.

Attribution — and what it is not

OpenAI states it is unclear whether all operators in the period came from a single actor. Separately: “we attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.” That is a company assessment, not a published forensic exhibit — CyberScoop notes the blog does not cite technical evidence for the attribution, and OpenAI told CyberScoop it would share no further detail “for security reasons.” CyberScoop says it reached out to Moonshot; no company response appears in that account, and Verge/CNBC likewise do not report a Moonshot admission. Treat the Moonshot link as OpenAI accusation / attribution, not an adjudicated finding or a Moonshot confession.

OpenAI framed the risk as safety and national security: extracted reasoning could train another model without the original safeguards, accelerating capability transfer without matching safety investment. It says the manipulation class is not unique to OpenAI, shared findings via the Frontier Model Forum and government channels, banned or restricted fraudulent accounts, hardened signup/infrastructure controls, expanded monitoring, closed a cross-conversation decrypt/replay pathway, and added checks on streamed output that might expose reasoning.

Prior thread

April’s FMF distillation piece already had Anthropic naming Moonshot among Chinese labs in distillation allegations, and OpenAI citing DeepSeek. Wednesday’s post is narrower and more operational: a dated July campaign, session-replay mechanics, volume spikes, and a core-cluster Moonshot attribution from OpenAI itself. It is not a new Arena Elo story and not a restatement of the White House voluntary accord.

Limits

• Primary account is OpenAI’s September 30 security post. Independent wires (Verge, CyberScoop, CNBC) largely restate that post; CyberScoop adds the “no hard evidence published” and Moonshot outreach notes.
• Moonshot attribution is OpenAI’s; no forensic packet is public. Unclear single-actor caveat is OpenAI’s own.
• Volume numbers are attempted extractions per OpenAI’s footnote.
• Moonshot formal response was not in the CyberScoop/Verge/CNBC accounts used at draft time.
• Distinct from excluded same-window FTC probe and White House accord coverage — link those threads; this slug is the distillation attribution.

Sources

• OpenAI: Disrupting a coordinated model-distillation campaign (September 30, 2026)
• The Verge: OpenAI claims Moonshot extracted its data to train AI models (September 30, 2026)
• CyberScoop: OpenAI reveals ‘novel’ encryption bypass used in distillation attack (September 30, 2026)
• CNBC: OpenAI links China’s Moonshot AI to attempt to extract its models’ reasoning (September 30, 2026)
• Times of AI: FMF intelligence share on adversarial distillation (April 6, 2026)