The Pulse
OpenAI Disrupts Moonshot-Linked Campaign to Extract Model Reasoning
OpenAI says it disrupted a coordinated effort to extract protected reasoning from its models, with a core cluster attributed to people associated with Moonshot AI. The company counted 16,000 extraction-pattern requests from more than 4,000
AI.info Team · Written with AI ·
OpenAI counted 16,000 requests using a model-reasoning extraction pattern in two days, July 24 and 25, as it investigated a coordinated campaign targeting its systems. The requests came from more than 4,000 users, the company said in a report published September 30, 2026. OpenAI later identified related prompt patterns across a cluster of more than 15,000 users and says it disrupted the activity by July 28.
How the extraction attempts worked
The campaign sought protected reasoning: internal model content used to work through a task but withheld from the answer shown to a user. OpenAI said operators tried, among other methods, to copy encrypted reasoning from one conversation and ask a model in another conversation to decrypt and transcribe it. The company said the operators did not break its encryption, compromise a database or gain direct access to stored user conversations.
The figures describe attempted—not necessarily successful—extractions. OpenAI did not report how many attempts produced readable reasoning or specify which models handled the requests. It said activity began July 1 at low volume, then rose sharply on July 24 and 25.
Researchers had disclosed related weaknesses
Independent researchers alerted OpenAI to related risks involving cross-model use and conversation compaction. OpenAI says it confirmed the attack paths and used the disclosure to broaden its investigation and speed up mitigations. The researchers’ August paper, “Stealing Reasoning Traces from Proprietary LLM APIs,” describes a method for feeding encrypted reasoning into a less safeguarded model from the same provider.
“First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google.”
Alexander Panfilov et al., “Stealing Reasoning Traces from Proprietary LLM APIs”
The paper’s finding concerns a broader technical attack class, not proof that every method it describes was used in OpenAI’s campaign. OpenAI says it attributes a core cluster of its observed activity to people associated with Moonshot AI, the company behind Kimi. It cautions that it is unclear whether every operator active during the period belonged to one actor.
OpenAI tightened account and reasoning controls
The company says it banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, and expanded monitoring for related networks. It also closed a pathway that could let someone who already had another user’s encrypted reasoning replay it to recover the contents, and added checks to hold streamed output that might expose reasoning.
OpenAI says it shared findings through the Frontier Model Forum and government information-sharing channels, and worked with third-party providers when related activity moved through their services. It frames adversarial distillation as a risk beyond its own models: extracted reasoning could help train another system without carrying over the safeguards applied to user-facing answers.
The report leaves two points open: how much reasoning the campaign actually recovered, and how many of the more than 15,000 accounts were tied to the Moonshot-linked core cluster. OpenAI says its investigation and mitigation work continue.