OpenAI says it disrupted a coordinated campaign to reproduce the hidden reasoning generated by its artificial-intelligence models, attributing a core cluster of the activity to individuals associated with Moonshot AI, the Chinese company behind the Kimi chatbot.
According to Decrypt, the campaign began on July 1. OpenAI recorded 16,000 extraction requests from more than 4,000 users on July 24 and 25 alone. Those users were part of a broader cluster involving more than 15,000 accounts, the company said. OpenAI said it had fully disrupted the activity by July 28.
What OpenAI says happened
The reported operation focused on more than the visible answers produced by an AI system. OpenAI’s models generate internal reasoning before returning a response, working through a problem in a step-by-step process that is not normally shown to the user. OpenAI says this hidden reasoning is encrypted.
The company said the operators did not break that encryption, access a database, or obtain stored conversations directly. Instead, they manipulated interactions with the models so protected reasoning could be reproduced in a form visible to the requester. OpenAI described the activity as coordinated, conducted at scale, and contrary to its terms of service.
One technique identified by OpenAI involved taking encrypted reasoning from one conversation and placing it into another conversation, where a model was asked to decode it. OpenAI said it has now closed a pathway that allowed someone who already possessed another user’s encrypted reasoning to replay it and recover the contents.
OpenAI said it could not determine whether every operator active during the period came from one organization. It nevertheless attributed a central cluster of the activity to people associated with Moonshot AI, the developer of Kimi. Moonshot has not responded to OpenAI’s post, according to the source material.
Why hidden reasoning is valuable
The alleged target is important because internal reasoning can contain information that does not appear in a model’s final response. Access to that process could help another developer study how a stronger system approaches problems and use those outputs to improve a separate model.
That practice is generally known as distillation. It involves training a new model using the outputs of a more capable one, potentially allowing a smaller system to achieve stronger results without undergoing the same intensive training process. When performed without authorization, OpenAI calls it “adversarial distillation” and defines the practice as the systematic, unauthorized use of a model’s outputs or reasoning to train, reproduce, or improve another model.
The dispute is distinct from allegations involving the unauthorized use of copyrighted material to train AI systems. The source material notes that AI outputs are not copyrightable, but companies use contractual restrictions and technical safeguards to prevent competitors from using those outputs in prohibited ways.
A wider dispute over model extraction
OpenAI’s claim follows a series of disputes involving the use of one company’s AI system to develop another. In January 2025, OpenAI said it was reviewing indications that DeepSeek might have distilled its models while US officials were considering national-security concerns.
Anthropic made a similar accusation in February, saying Chinese laboratories had used about 24,000 fraudulent accounts to produce more than 16 million exchanges with its Claude system. In April, the White House said foreign entities, primarily in China, were conducting distillation campaigns on an industrial scale. Elon Musk acknowledged in court the following week that xAI had used distillation on OpenAI models to train Grok.
Anthropic later asked Congress in June to impose penalties for large-scale model extraction. In August, researchers reported that OpenAI, Anthropic and Google each protected reasoning with a single provider-wide encryption key. They also showed that attackers could prompt models to reveal hidden reasoning in plain text. All three companies deployed server-side fixes after that disclosure, although session logs shared earlier remained decodable.
The latest incident therefore highlights both the commercial value of model behavior and the difficulty of keeping internal reasoning private when users can interact with a system repeatedly. OpenAI’s account does not establish that Moonshot AI itself directed the entire campaign, and the company explicitly said the activity may not have come from one actor.
Moneyiar market picture
Moneyiar market data at 09:28-09:29 on October 3, 2026, showed declines across the four listed digital assets:
- Chainlink (LINK) was priced at $13.9500832564, down 3.17% over 24 hours and 0.16% over seven days.
- Ethena (ENA) traded at $0.2319087064, down 4.91% in 24 hours and 15.82% over seven days.
- Holo (HOT) stood at $0.0004430057, down 4.6% over 24 hours and 0.74% over seven days.
- OpenLedger (OPEN) was at $0.1282149405, down 3.65% over 24 hours and 7.55% over seven days.
Moonshot is targeting a $3 billion Hong Kong IPO at a $50 billion valuation, according to the source material. The company’s response to OpenAI’s allegation was not included.
