OpenAI Names Moonshot AI in a "Coordinated Model-Distillation Campaign" — 15,000+ Accounts, Encrypted-Reasoning Replay
On Wednesday, September 30, 2026, OpenAI published "Disrupting a coordinated model-distillation campaign" — its first public attribution of industrial-scale "adversarial distillation" to a named Chinese rival. The campaign began July 1; OpenAI saw high-volume spikes on July 24–25 of 16,000 requests using a relevant extraction pattern from over 4,000 users, then identified related prompt-pattern activity "across a cluster of more than 15,000 users, which we fully disrupted by July 28."
The method was not a hack of OpenAI's infrastructure: "The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations. Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester." The signature technique: "copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden reasoning content." Independent researchers (arXiv 2608.09867) had confirmed related cross-model and conversation-compansion attack paths through responsible disclosure.
Attribution, stated carefully: "It is unclear whether all operators we observed during the relevant time period originated from a single actor. However, we attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi." OpenAI framed the stakes in national-security terms: "Adversarial distillation poses safety and national security risks... At scale, distillation can also accelerate the transfer of advanced capabilities without requiring the same investment in safety." Findings were shared "through the Frontier Model Forum and appropriate government information-sharing channels."
The broader US–China distillation war
- OpenAI's move joins a pile-on: Anthropic has separately accused Moonshot of silently forwarding Kimi customer requests to Claude and extracting protected reasoning data (Tokenpost), and its largest documented case involved millions of interactions — versus OpenAI's 16,000 requests (Korea Herald). White House tech advisor Michael Kratsios previously accused Moonshot of building Kimi K3 by distilling Anthropic's Fable using Blackwell-equipped servers (The Register).
- China has denied all distillation allegations and warned it will retaliate if Washington imposes sanctions over them (Korea Herald). Venture capitalist David Sacks argues the allegations are aimed at pushing the US to ban open models (BigGo Finance).
- The skepticism cuts both ways: OpenAI — itself fighting copyright suits over training data — got the "irony alert" treatment from The Register, and a recent study found GPT-6 Astra and GPT-6.1 Sol reasoning traces remain extractable through third-party API providers.
Why it matters: this is the first time OpenAI has publicly named a Chinese lab, and it converts "distillation" from an abstraction in US–China trade talks into a specific, dated incident report — filed through the same industry/government channels (US–China: From "No AI Guardrails" to an AI Incident Channel and a November Dialogue) that are supposed to mature into the November AI dialogue. It also hands Washington a fresh predicate for export-control or sanctions action, which Beijing has explicitly promised to answer.