OpenAI says it disrupted a campaign that manipulated its models into revealing protected reasoning, with activity beginning July 1 and the main cluster disrupted by July 28, 2026. It attributes a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi—but says it is unclear whether every operator it observed was part of one actor. The reported request totals describe attempted, not necessarily successful, extractions.
What OpenAI says happened
In a disclosure published September 30, OpenAI described activity it considers consistent with adversarial distillation: “the systematic and unauthorized use of one model’s outputs or reasoning to help train, reproduce, or improve another model.” OpenAI says protected reasoning is an internal record of a model’s work on a task. It may contain information not present in the final answer and, if exposed, could make a model’s capabilities easier to reproduce. OpenAI’s account is the source for the campaign description and figures.
As an Amazon Associate I earn from qualifying purchases.
OpenAI says the activity began at low volume on July 1, 2026, then increased sharply on July 24 and 25. It observed 16,000 requests using a relevant extraction pattern from more than 4,000 users during those two days. Further investigation found related prompt-pattern activity across a cluster of more than 15,000 users, which OpenAI says it fully disrupted by July 28.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Those numbers are not confirmed counts of successful extractions. OpenAI’s disclosure explicitly characterizes them as attempts; it does not quantify how much reasoning, if any, was successfully recovered. The cluster of more than 15,000 users is also not the stated size of the Moonshot-associated core cluster.
#1 Best Overall
How the reasoning was exposed—and whether OpenAI was hacked
OpenAI describes a method in which operators copied encrypted reasoning from one conversation, then prompted a model in a different conversation to decrypt and transcribe it. The method relied on manipulating model interactions to make protected content appear in visible output.
That is different from breaking encryption or gaining access to stored conversations. OpenAI says the operators “did not break our encryption, compromise a database, or gain direct access to stored user conversations.” Its account is of an extraction path involving model behavior, not a reported database breach or direct intrusion into conversation storage.
What is known about the Moonshot AI attribution
OpenAI’s wording is deliberately limited: “It is unclear whether all operators we observed during the relevant time period originated from a single actor. However, we attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.” That is OpenAI’s attribution, not an independently established finding that Moonshot AI as a company conducted the campaign.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
OpenAI did not name the individuals or publish technical evidence supporting the attribution in its disclosure. The Hacker News’ October 1 coverage also noted that the disclosure did not cite technical evidence for the attribution. The public material therefore supports reporting what OpenAI says, but does not let readers independently assess the attribution’s underlying evidence. A Moonshot response to this specific disclosure is not established by the sources cited here.
Rank #3
What independent research establishes—and what it does not
An August 10, 2026 arXiv preprint, Stealing Reasoning Traces from Proprietary LLM APIs, by Alexander Panfilov and co-authors, describes a broader technical attack class. The authors report that encrypted reasoning blocks could be compatible across sessions, users, and models within a provider ecosystem. Their approach injects a trace into a weaker model from the same provider and prompts it to decode the trace as plaintext; the paper says the authors demonstrated extraction across Anthropic, OpenAI, and Google.
The preprint reports decoding 315,320 reasoning blocks scraped from public repositories, recovering 367 personally identifiable information artifacts and 182 credentials. Those are the paper’s results on public-repository material, not measurements of OpenAI’s July campaign. The work supports the plausibility of reasoning-trace extraction in general; it does not independently verify OpenAI’s campaign counts or its attribution to Moonshot-associated individuals.
OpenAI says independent researchers reported related cross-model and conversation-compaction vulnerabilities through responsible disclosure. It says it confirmed the attack paths and used that work to accelerate mitigations.
What OpenAI says it changed
OpenAI says it banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, expanded monitoring for related networks, and strengthened hidden-reasoning protections across users, workspaces, organizations, and model families. It also says it closed a pathway that let someone already holding another user’s encrypted reasoning replay it to recover its contents, and added checks to detect and hold streamed output that might expose reasoning.
Best Value
The company says it worked with third-party services where related activity appeared and shared findings through the Frontier Model Forum and government information-sharing channels. These are OpenAI’s reported actions, not independently audited outcomes.
What remains unsettled
OpenAI says it is continuing work on protections for partner-hosted deployments and tool-output attacks, as well as tool defenses, classifier coverage, model refusals, and cloud-partner controls. Its disclosure does not establish that the July attempts produced usable reasoning, that any recovered material was used to train another model, or that the activity was carried out by one actor throughout.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
