OpenAI Disrupts Coordinated Model-Distillation Campaign Linked to Moonshot AI

OpenAI identified and disrupted a coordinated campaign designed to extract protected reasoning from its models, with the earliest activity observed in the first week of July. This activity constitutes adversarial distillation, where one model's internal reasoning is systematically used to train or improve another model without authorization.

The operators did not breach encryption or access databases directly. Instead, they manipulated model interactions to reproduce protected reasoning in visible forms, violating terms of service. This technique is not unique to OpenAI, and the company has shared findings with industry partners via the Frontier Model Forum to strengthen collective defenses.

Scope and Attribution

The activity began on July 1 at low volume, escalating to high-volume spikes on July 24 and 25. These spikes consisted of 16,000 requests using extraction patterns from over 4,000 users. Further investigation revealed related prompt-pattern activity across a cluster of more than 15,000 users, which was fully disrupted by July 28.

While it is unclear if all operators originated from a single actor, OpenAI attributes a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi. Independent security researchers also reported related cross-model and conversation-compaction vulnerabilities, which OpenAI confirmed and used to accelerate mitigations.

Response and Future Defenses

OpenAI responded by banning fraudulent accounts, strengthening signup controls, and expanding monitoring. Technical mitigations included closing pathways that allowed the replay of encrypted reasoning and adding checks to detect streamed output exposing hidden reasoning. The company also worked with third-party service providers to disrupt accounts involved in the activity.

The company expects adversarial distillation attempts to become more sophisticated as frontier models improve. Future efforts will focus on stronger technical protections, better detection of coordinated campaigns, and deeper threat-information sharing across industry and government. Partner-hosted deployments and tool-output attacks remain key areas for continued defense strengthening.