OpenAI Says People Linked to China's Moonshot Tried to Copy Its AI's Hidden Reasoning

OpenAI reported it disrupted a coordinated effort that sought to extract the encrypted internal "reasoning" its models generate before producing final answers. According to the company, the campaign began on July 1 and produced a surge of activity on July 24-25, when the service recorded roughly 16,000 extraction requests from more than 4,000 users as part of a broader cluster exceeding 15,000 accounts. OpenAI says it fully blocked the activity by July 28.

The company clarified that attackers did not break encryption keys, access databases, or obtain stored user conversations directly. Instead, operators manipulated model interactions to make the protected, internal scratchpad — the step-by-step reasoning models use internally — reproducible in responses visible to requesters. One described technique involved copying encrypted reasoning from one conversation and prompting a model in another session to decode it.

OpenAI linked a core cluster of the campaign to individuals associated with Moonshot AI, the Chinese startup behind the Kimi chatbot, while noting it was unclear whether all participants were from a single actor. Moonshot had not responded to OpenAI's post; public reporting notes the company is targeting a HKD $3 billion IPO at a reported $50 billion valuation. OpenAI also said it closed the pathway that allowed one user’s encrypted reasoning to be replayed and recovered by another.

OpenAI framed the activity as "adversarial distillation" — the unauthorized use of one model's outputs or reasoning to train or reproduce another model. The company placed the incident in a broader context of similar disputes this year, including OpenAI's earlier extraction concerns, Anthropic's allegations of large-scale fraudulently created accounts, government warnings about foreign distillation campaigns, and academic findings about shared encryption keys that prompted server-side fixes at major providers.