OpenAI claims to have identified and interrupted a coordinated campaign of model distillation of artificial intelligence (AI) aimed at extracting protected reasoning capabilities from its systems. According to the company, a central part of the activity was attributed to individuals associated with the Chinese Moonshot AI, developer of the chatbot Kimi.
The activity had started at the beginning of July and reached its peak between the 24th and 25th of that month, when OpenAI identified 16 thousand requests made by more than four thousand users, following a similar extraction pattern. The investigation later found related activities involving more than 15 thousand users. The company claims to have completely interrupted the campaign on July 28th.
How the extraction attempt worked
- According to OpenAI, the operators did not hack their databases nor directly break the encryption used to protect the models' reasoning; Users copied encrypted reasoning data from a conversation and, in a second interaction, requested the model to decrypt and transcribe the hidden content into visible text;
- “The operators did not break our encryption, compromise a database, or gain direct access to the stored conversations of users. Instead, they manipulated interactions with the model to reproduce protected reasoning in forms visible to the requester, in a coordinated and scalable manner, violating our terms of service,” stated OpenAI;
- The company classified the technique as a new form of distillation attack. According to the company, it is unclear whether the entire activity stemmed from a single operator using thousands of accounts or involved different groups;
- However, OpenAI claims that a core of the activity can be associated with people linked to Moonshot AI. The company did not publicly present detailed technical evidence supporting this attribution.
What is AI distillation?
The model distillation is a legitimate training technique in which a more powerful system, called the “teacher,” produces responses that can be used to train a smaller model, the “student.”
The goal may be to create cheaper and more efficient systems capable of reproducing certain capabilities of the larger model without requiring the same amount of processing. The practice is usually used in the development of AI models.
The controversy arises when companies use third-party proprietary models to collect large volumes of responses without authorization and reproduce capabilities considered protected. In this context, US AI companies have started to refer to certain operations as illegal distillation.
The intermediate reasoning of the models became especially relevant in this process. Instead of using only final answers, a distillation operation may attempt to collect information on how a system solves complex problems, providing the model being trained with more detailed examples of how to arrive at a certain conclusion.
Moonshot had already been accused by Anthropic
The OpenAI accusation occurs amidst a broader dispute involving Chinese companies and US AI laboratories.
In February, Anthropic stated that it had identified distillation campaigns involving three Chinese laboratories, including Moonshot. At that time, the company said it had identified more than 16 million interactions with Claude linked to approximately 24,000 fraudulent accounts. According to Anthropic, Moonshot would have been responsible for more than 3.4 million of these interactions.
In September, Anthropic again accused Moonshot of using its models for training. According to a report from the company, the startup would have silently forwarded requests from its own customers to the Claude, causing users who believed they were using the Kimi to receive responses from the Anthropic model.
The company claims to have identified nearly 300,000 requests forwarded to the Claude during a ten-day period, mainly for the Opus model, using a network of 5,380 fraudulent accounts. The Anthropic also stated that it had identified mechanisms aimed at extracting reasoning records from the obtained responses.
According to Anthropic, Moonshot would have observed more than 23 million interactions related to distillation campaigns between May and July 2026. These numbers refer to investigations conducted by Anthropic itself and not to the campaign now described by OpenAI.
Moonshot denies the allegations – Image: gguy/Shutterstock
Read more:
- Rival of the Muse: OpenAI launches Dots, AI agents that work alone
- OpenAI negotiates a $15.61 billion round and could reach a valuation of $730 billion
- US investigates OpenAI and Anthropic after incidents with AI agents
US has already threatened sanctions
The discussion has also reached the US government. In July, Treasury Secretary Scott Bessent stated that the government could impose sanctions on open-weight Chinese models if evidence of model distillation from U.S. models was confirmed.
At the time, Bessent said U.S. authorities were finding signs associated with large U.S. language models in various Chinese models and classified the situation as unacceptable.
The possibility of sanctions arose amid accusations that Chinese companies were using U.S. models to accelerate the development of their own systems. The Reuters reported at the time that U.S. authorities were also evaluating potential restrictions against Chinese companies, while Beijing rejected the accusations of improper technology appropriation.
The Moonshot had previously rejected the claim that the performance of its Kimi K3 model was the result of distillation. According to the Reuters, the company stated that the performance gains came from its own changes to the system architecture.
OpenAI promises to strengthen defenses
OpenAI claims that the incident does not represent a unique vulnerability of its models. The company shared information about the campaign with sector partners through the Frontier Model Forum, aiming to improve defenses against similar attempts.
In addition to blocking the involved accounts, the company claims to have reinforced account creation controls and infrastructure, expanded network monitoring, and corrected the mechanism that allowed encrypted reasoning data to be transported from one conversation to another and attempted to convert them back into readable text.
The company expects this type of operation to become more sophisticated as frontier models advance.
"We expect adversarial distillation attempts to become more sophisticated as frontier models improve and agents seek cheaper ways to reproduce their capabilities. Defense against this activity requires controls at multiple layers and continuous adaptation," said OpenAI.
Rodrigo Mozelli is a journalist graduated from the Methodist University of São Paulo (UMESP) and is currently a writer at Olhar Digital.
