OpenAI says it disrupted a coordinated campaign to extract protected model reasoning, combining account restrictions, technical changes and work with third-party providers. In a September 30, 2026 security post, the company attributed a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi, according to Unite.ai’s reporting.
The campaign targeted the internal reasoning used to work through tasks. OpenAI described the activity as consistent with adversarial distillation: the systematic, unauthorized use of a model’s outputs or reasoning to train, reproduce or improve another model. Its announcement says it disrupted the campaign and is strengthening defenses against that practice.
The distinction between attempted extraction and confirmed disclosure is central to assessing the incident. OpenAI’s reported request counts measure attempts, and its attribution concerns a core cluster rather than every user associated with the broader activity.
What OpenAI observed
According to OpenAI’s account, as reported by Unite.ai, activity began at low volume on July 1, 2026. Spikes on July 24 and 25 involved 16,000 requests using a relevant extraction pattern from more than 4,000 users. A footnote qualified those figures as attempted, not necessarily successful, extractions.
Further investigation identified related prompt-pattern activity across a cluster of more than 15,000 users, which OpenAI said it fully disrupted by July 28. Those figures describe different scopes: the two-day request spike and the wider cluster found during investigation. Neither establishes how much protected reasoning the operators successfully obtained.
One observed technique involved copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden content. OpenAI said the operators manipulated model interactions to reproduce protected reasoning in requester-visible form at scale, violating its terms of service.
The company said the operators did not break its encryption, compromise a database or gain direct access to stored user conversations. That qualification matters: the reported failure concerned how models handled protected material during interactions. It does not establish a breach of a conversation database.
How the disruption worked
OpenAI described a response spanning accounts, reasoning protections and service partners. According to Unite.ai’s account, the measures included:
- Banning or restricting fraudulent accounts, strengthening signup and infrastructure controls, and expanding monitoring for related networks.
- Closing a pathway through which someone already possessing another user’s encrypted reasoning could replay it and recover its contents.
- Adding checks to detect and hold streamed output that might expose reasoning.
- Working with third-party providers to identify and disrupt accounts when related activity moved through their services.
OpenAI said it strengthened hidden-reasoning protections across users, workspaces, organizations and model families. It also said independent researchers disclosed related cross-model and conversation-compaction vulnerabilities, and that it shared information with industry partners through the Frontier Model Forum.
For security engineers, these measures point to several distinct control surfaces. Account enforcement addresses access to the service; replay protections address reuse of protected reasoning; output checks address disclosure during generation. Partner coordination extends the response to activity passing through other providers. This is an interpretation of the reported measures, rather than an independently tested assessment of their effectiveness.
Why encrypted reasoning creates a separate security question
Related research described by Unite.ai helps explain the architectural concern. In an August 10, 2026 arXiv submission, researchers reported that leading providers return concealed reasoning to clients as encrypted text blocks, which clients pass back in subsequent requests. The researchers identified interchangeability of those blocks across sessions, users and models within a provider’s ecosystem as a vulnerability.
Their reported technique injected an encrypted trace into a weaker, less safeguarded model from the same provider to obtain plaintext reasoning without directly jailbreaking the more capable model. That research describes a related mechanism; it does not establish that every technique it examined was used in the disrupted campaign.
The security implication is that protecting reasoning requires attention to where encrypted material can be accepted and reproduced, alongside protections on the model that originally generated it. OpenAI’s reported replay and cross-model protections address that concern, although the available account does not provide a measured post-mitigation success rate.
What the evidence leaves unresolved
OpenAI argues that extracted reasoning could help train another model without preserving safeguards applied to the original model’s visible answers. It frames capability transfer through adversarial distillation as a safety and national security concern, particularly in dual-use domains. These are the company’s stated risks, rather than demonstrated downstream outcomes of this campaign.
The detailed incident account here comes through Unite.ai’s reporting of OpenAI’s findings. It provides no independent confirmation of the Moonshot-linked attribution or quantified evidence of successful capability transfer. The supported conclusion is narrower: OpenAI says it disrupted a large extraction effort and closed specific disclosure pathways, while the amount successfully extracted and any resulting training benefit remain unresolved.
