CONFIRMED: OpenAI says it disrupted a coordinated campaign to extract protected reasoning from its models
OpenAI announced on September 30 that it identified and disrupted a coordinated campaign to extract what the company calls protected reasoning, the internal record a model uses to work through a task before delivering its final answer. The company attributes a core cluster of the activity to individuals associated with Moonshot AI, the maker of the Chinese chatbot Kimi, while stating it remains unclear whether every operator observed belongs to a single group. The case reopens, with a named company and a detailed technical method, the ongoing dispute between Western and Chinese labs over how open models keep getting this good this fast.
What protected reasoning is, and why stealing it matters
Advanced reasoning models generate an internal chain of thought before the final answer, and that chain is often encrypted or hidden from the user, precisely so it does not reveal shortcuts, training biases, or information the company chose to withhold. OpenAI says the operators did not break encryption or breach a database: they manipulated model interactions to make that hidden reasoning reappear as visible text, including copying encrypted reasoning from one conversation and asking a model in a separate conversation to decrypt and transcribe the hidden content. This is social engineering against the system itself, not a server breach.
The scale of the attack, according to OpenAI
The company reports activity starting at low volume on July 1, with high-volume spikes on July 24 and 25 totaling 16,000 requests from more than 4,000 users using a relevant extraction pattern. A broader investigation identified a related cluster involving more than 15,000 users, fully disrupted by July 28. OpenAI classifies this practice as adversarial distillation: using a competing model's outputs and reasoning without authorization to train, reproduce, or improve another model, skipping the safety investment the original model received.
Why this is more than a lab feud
OpenAI argues that extracting reasoning without the safeguards applied to the original model's user-facing outputs could accelerate the transfer of advanced capabilities without the same safety investment, a risk the company describes as more serious in dual-use domains such as biology and cybersecurity. For a business reader, the practical point is different: confidence that a model provider can protect the intellectual property embedded in its reasoning is starting to become an evaluation criterion, not just price and performance. Companies building products on top of a third-party model should now ask what protection that vendor has against this type of extraction and how it affects the security roadmap of the product they are buying.
What remains unproven
OpenAI speaks of extraction attempts, not necessarily successful extractions in every case, and acknowledges the technique is not unique to its models: the company shared the findings with the Frontier Model Forum, a consortium of competing labs working to strengthen collective defenses, and with government partners. The direct accusation against individuals associated with Moonshot AI comes from OpenAI itself, without public confirmation from Moonshot as of this publication, and the Chinese company is not cited as having officially orchestrated the campaign as a company. Independent security researchers also reported related cross-model conversation-compaction vulnerabilities through responsible disclosure, which OpenAI says it confirmed and used to accelerate fixes.
MaxAssistant's read
This episode is the technical version of a dispute that has already been public for months: American labs accusing open Chinese models, including Kimi K3 itself, of advancing too fast and too cheap to be explained by original training alone. OpenAI turned a generic accusation into a concrete case with a date, a request volume, and a declared technical mechanism, which shifts the tone of the debate from rhetoric to evidence stated by one of the parties involved. A public response from Moonshot and an independent assessment beyond OpenAI's own account are still missing, but for anyone deciding where to run production workloads, the relevant news is that reasoning extraction has become a documented, real attack vector, and that should now be on the security checklist for evaluating any model provider, not just the two named here.
Sources
OpenAI: Disrupting a coordinated model-distillation campaign; Business Today: ChatGPT copied to train Kimi AI? OpenAI makes serious allegations against China's Moonshot AI.