OpenAI ties Moonshot-linked users to July distillation push

Reasoning models work through a problem in hidden steps before they answer. OpenAI keeps that record from users and calls it “protected reasoning.” In July, OpenAI says, a coordinated campaign tried to get its models to give it up at scale. The company says a core cluster of that activity came from people associated with Moonshot AI, the developer of Kimi.

OpenAI says this was not a hack. “The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations,” OpenAI wrote in a Sept. 30 post. Instead, it says, they “manipulated model interactions” so the hidden reasoning came back in a readable form, “in a coordinated, scaled manner that violated our terms of service.”

OpenAI calls this adversarial distillation: “the systematic and unauthorized use of one model’s outputs or reasoning to help train, reproduce, or improve another model.”

What OpenAI says happened

The numbers, all from OpenAI:

• Activity “began on July 1, initially at a low volume.”
• On July 24 and 25, OpenAI saw “16,000 requests using a relevant extraction pattern from over 4,000 users.”
• Further digging found related activity “across a cluster of more than 15,000 users, which we fully disrupted by July 28.”

A footnote matters. The figures “describe attempted, not necessarily successful, extractions.” OpenAI does not say how much reasoning, if any, actually got out.

One method OpenAI describes: “copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden reasoning content.” OpenAI says outside security researchers separately reported related “cross-model and conversation-compaction vulnerabilities,” and that it “confirmed that the attack paths they identified were real.” Their paper, posted Aug. 10, is titled “Stealing Reasoning Traces from Proprietary LLM APIs.”

Who OpenAI blames, and how

OpenAI hedges its own attribution. “It is unclear whether all operators we observed during the relevant time period originated from a single actor,” the post says. “However, we attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.”

That is a claim about individuals, not the company. The post does not say Moonshot directed the campaign. It does not say what ties those people to Moonshot.

What OpenAI says it did

OpenAI says it “banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, and expanded monitoring for related networks.” It gives no count of accounts.

It says it closed “a pathway that allowed someone who already possessed another user’s encrypted reasoning to replay it and recover its contents.” It added checks “to detect and hold streamed output that might expose reasoning.” When activity moved through third-party services, it worked with those providers to shut accounts.

It shared findings through the Frontier Model Forum, an industry group, and “appropriate government information-sharing channels.” It names no agency.

What OpenAI does not say

The post does not name which OpenAI models were targeted. It does not say whether the traffic came through the API, ChatGPT or both. It does not say any Kimi model was trained on the output. It publishes no evidence for the attribution.

We found no independent confirmation of OpenAI’s numbers or its attribution. Early coverage, including CNBC’s, rests on the same post.

Moonshot’s side

Moonshot AI had not commented publicly as of 4:58 a.m. CT Friday. Its websites and Kimi’s official X account, @Kimi_Moonshot, carried nothing on the claim; the account’s latest post was Sept. 22. CNBC reported Wednesday night that Moonshot “did not immediately respond to CNBC’s requests for comment.”

Earlier: On Sept. 8, CISA, the NSA and the FBI named Moonshot AI among six China-based AI companies they accused of industrial-scale distillation of U.S. models (our coverage).

The rule in English

The post cites no law. The rule it invokes is OpenAI’s own contract.

OpenAI’s Terms of Use, for individual users, say you may not “Automatically or programmatically extract data or Output” or “Use Output to develop models that compete with OpenAI.” Its Services Agreement, which covers API and business customers, bars using output “to develop artificial intelligence models that compete with OpenAI’s products and services” and extracting data “other than as permitted through the Services.”

The post does not say which clause the operators broke. The remedy it describes is losing access, not a lawsuit. OpenAI does argue the stakes go beyond contract: distillation “poses safety and national security risks,” it says, because extracted reasoning “could be used to train another model without preserving the safeguards” of the original.

Who it binds

Anyone using OpenAI’s services under those terms, from a ChatGPT user to an API customer. The new technical controls apply, OpenAI says, “across users, workspaces, organizations, and model families.” OpenAI says the technique is “not a vulnerability unique to OpenAI’s models.”

Who it exempts

The Services Agreement carves out a “Permitted Exception.” Customers may use output to build models “primarily intended to categorize, classify, or organize data,” such as embeddings or classifiers, if those models are not distributed or sold. They may also fine-tune models through OpenAI’s own services. Distillation as a technique is not banned. OpenAI’s definition turns on the word “unauthorized.”

What a founder or developer should do differently

• Don’t move reasoning artifacts around. “Systems that support portable or replayable reasoning artifacts may face related risks,” OpenAI warns. Don’t pass encrypted reasoning between users or conversations, and expect more streamed output to be held.
• Read the competing-models clause before training on outputs. The exception is narrow: internal classifiers and OpenAI-hosted fine-tunes.
• If you run a model API, copy the signals. OpenAI flagged 16,000 requests from more than 4,000 users in two days, related prompt patterns across more than 15,000 users, and traffic routed through third parties.
• If you resell or host OpenAI models, OpenAI says: “Partner-hosted deployments need the same protections as first-party services.”

What’s next

• Any response from Moonshot AI or Kimi’s official accounts.
• Whether OpenAI publishes the evidence behind its attribution.
• Whether other labs report similar activity through the Frontier Model Forum.
• Which government channels received OpenAI’s findings, and whether any agency acts.
• More from OpenAI itself: “Additional mitigation and investigation work is continuing.”

Earlier coverage

• CISA names six China AI labs for industrial-scale distillation of U.S. models (Sep 10)

— Simone Adler