What OpenAI says happened
OpenAI has publicly attributed a coordinated effort to extract protected reasoning from its models to individuals associated with Moonshot AI, the Chinese lab behind Kimi. In a post published on 30 September the company said the earliest activity it observed was in the first week of July, and that it had fully disrupted the campaign by 28 July.
Protected reasoning is the model’s internal working-out — the part not shown in the answer. OpenAI describes the activity as adversarial distillation: using one model’s outputs or reasoning without authorisation to help train or reproduce another. The company is explicit that no encryption was broken, no database was compromised and nobody gained direct access to stored user conversations.
The trick, and the scale
The method was conversational. Operators copied encrypted reasoning out of one conversation and asked a model in a different conversation to decrypt and transcribe it. Independent security researchers separately disclosed related cross-model and conversation-compaction weaknesses; OpenAI says it checked those findings and confirmed the attack paths were real.
Volume was low at first. On 24 and 25 July OpenAI counted 16,000 requests using a relevant extraction pattern, from more than 4,000 users. Widening the search for similar prompt patterns turned up a cluster of more than 15,000 users in total. A footnote on the company’s own post matters here: those figures describe attempted extractions, not necessarily successful ones.
On attribution, OpenAI hedges in one direction and not the other. It says it is unclear whether every operator it observed came from a single actor, but it attributes a core cluster of the activity to individuals associated with Moonshot AI.
What it changed
OpenAI banned or restricted the accounts, tightened signup and infrastructure controls, and widened monitoring for related networks. Technically, it closed the pathway that let someone holding another user’s encrypted reasoning replay it to recover the contents, and added checks that can detect and hold streamed output which might expose reasoning. Where the activity ran through third-party services, it says it worked with those providers to disrupt the accounts involved.
It also shared the findings through the Frontier Model Forum and government information-sharing channels, and says the underlying manipulation is not unique to its own models — any system that supports portable or replayable reasoning artefacts may be exposed to something similar.
What to watch
Whether Moonshot AI responds, and in what terms. Whether other frontier labs publish matching detections now that the technique has been described through the Frontier Model Forum. And whether anyone outside the labs can verify the attribution: OpenAI has named a company on the basis of evidence it has not published, which is the normal shape of this kind of disclosure and also the reason it is hard for anyone else to check.
