OpenAI has announced the termination of a significant campaign aimed at distilling protected reasoning from its AI models. This operation was primarily attributed to individuals associated with Moonshot AI, a Chinese company that has been under scrutiny in the AI community. The campaign reportedly began on July 1, 2026, with a modest number of requests, but by July 24 and 25, activity surged dramatically, resulting in over 16,000 requests from more than 4,000 users within just two days. Further investigation revealed similar behavior from accounts linked to 15,000 users. OpenAI managed to completely halt the operation by July 28. The report clarifies that the attackers did not breach encryption or access user chat histories. Instead, they interacted with the models in a manner that prompted them to produce internal reasoning in a user-accessible format. OpenAI refers to this incident as "adversarial distillation," a tactic used to collect responses and reasoning from powerful models for training or enhancing other large language models (LLMs). The company has not disclosed which specific models were targeted. It is important to note that not all participants in this campaign were necessarily linked to Moonshot AI. Following the investigation, OpenAI engineers blocked the accounts involved, tightened registration and infrastructure checks, and enhanced monitoring. They also disabled the ability to transfer encrypted blocks of internal reasoning obtained from other users’ dialogues, which had previously allowed for content recovery. The issue echoes findings from a research study published in August 2026, which indicated that encrypted blocks could be reused across different sessions and accounts, potentially allowing for the decryption of content by less secure models. Researchers had warned that this tactic could facilitate jailbreaking, bypass security measures against distillation, extract private data, and conceal prompt injections within encrypted blocks. OpenAI also expressed concerns that large-scale distillation poses commercial risks, as well as risks to information security and national security. The unauthorized reasoning could be used to train other models without the original's protective measures, effectively transferring advanced capabilities without comparable security investments. This is not the first time Moonshot AI has faced allegations; in September 2026, representatives from Anthropic claimed that the Kimi model was secretly forwarding client requests to Claude, presenting the responses as its own. This led users to believe they were interacting with Kimi when they were actually engaging with Claude, with some dialogues reportedly saved and used for training Moonshot AI's model. The recent developments signal heightened scrutiny and regulatory challenges for companies in the AI landscape, particularly those involved in contentious practices. Competitors may need to reassess their security protocols and operational transparency to avoid similar issues in the future.
Informational material. 18+.
