OpenAI says it disrupted a coordinated campaign to extract its models’ hidden reasoning that peaked on 24 and 25 July with 16,000 requests from more than 4,000 users. It attributed a core cluster of the activity to people associated with Moonshot AI, the Chinese developer of Kimi.
The campaign began on 1 July. By 28 July, when OpenAI says it was fully disrupted, a wider cluster of more than 15,000 users was sending similar prompts. OpenAI said it could not be certain all the operators were one entity.
The target was not answers but the step-by-step reasoning models produce before they reply, which OpenAI keeps encrypted and out of view. One technique was to copy encrypted reasoning from one conversation and ask a model in another to decrypt and transcribe it.
OpenAI was careful about what did not happen. Nobody broke its encryption, compromised a database or reached stored user conversations, it said. The attack lay entirely in how the models were prompted.
The accusation lands in a well-worn argument. OpenAI raised possible distillation by DeepSeek in January 2025, Anthropic reported similar activity earlier this year, and US security agencies have since named Chinese firms over copying at industrial scale.
Moonshot had not responded, Decrypt reported. The company is reportedly preparing a Hong Kong listing, which gives the allegation a commercial edge.
The numbers describe attempts, not results. OpenAI has not said how much protected reasoning the operators obtained, or whether any of it surfaces in Kimi’s models, and without that the report establishes intent far more clearly than harm.
