OpenAI says Moonshot used thousands of accounts to copy model reasoning

OpenAI says it disrupted a coordinated model-distillation campaign linked to people associated with Moonshot AI, the Chinese company behind Kimi. The activity began on July 1 and peaked on July 24–25, when more than 4,000 accounts generated roughly 16,000 requests. A related prompt cluster ultimately involved more than 15,000 users.

The technique was unusually direct. One conversation elicited encrypted model reasoning; another was instructed to decrypt and transcribe it. That made the target’s internal problem-solving traces usable as data for improving another model. OpenAI says the attackers did not break its encryption, enter its databases or gain access to stored user conversations.

Attribution remains less certain than the activity pattern. OpenAI says a core cluster was connected to people associated with Moonshot, but it cannot establish that every participating account belonged to the same campaign. Moonshot’s response was not included in the disclosure. The scale figures and national-security framing therefore come from the company defending its own system.

OpenAI banned or restricted the accounts, added signup and infrastructure controls, expanded monitoring, closed the replay pathway and introduced output holds. Those measures show how model security is migrating outward: a laboratory can keep weights and servers protected while an adversary reconstructs valuable behaviour through ordinary-looking interactions distributed across thousands of accounts. The hard problem is distinguishing industrial extraction from legitimate high-volume use without making capable models inaccessible to researchers and developers.