A model can give away valuable behavior without anyone breaking into its servers. OpenAI says it detected a campaign that tried to make its models expose protected reasoning, with the main cluster of activity linked to people affiliated with Moonshot AI, the company behind the Kimi assistant.
What OpenAI says happened
The activity began in early July. At its peak, OpenAI recorded 16,000 requests over two days, sent from more than 4,000 accounts. The company also found related activity across a cluster of more than 15,000 users, and said it had shut down the campaign by July 28.
OpenAI described the operation as “adversarial distillation.” The term refers to using one model’s outputs, or its reasoning, to train or improve another. The practical appeal is plain enough: a developer may be able to reproduce some of a model’s capabilities without paying the full cost of building them independently.
No server break-in required
OpenAI said the campaign did not involve breaking encryption, databases, or conversation storage. Instead, the people behind it manipulated interactions with the models to try to make protected internal reasoning appear in responses visible to users.
That distinction matters. The reported target was not stored conversation data, but information the models might produce under carefully shaped prompts. In OpenAI’s assessment, obtaining such outputs could help another developer imitate advanced capabilities without developing its own safeguards. The company also raised concerns about national security and the control of powerful AI systems.
Those are OpenAI’s stated concerns, not proof that every account in the wider activity cluster took part in the same operation. The company said it could not establish whether one actor was responsible for all the activity it observed. It attributed the main concentration to people affiliated with Moonshot AI.
A wider dispute over model distillation
The allegation follows a recent dispute in which Anthropic accused several Chinese developers, including Moonshot AI and Alibaba, of using its Claude model to train their own systems without authorization. The two episodes involve different companies and models, but both put the same practice under scrutiny: using access to a rival’s model as a source of training material.
OpenAI said it shared information about this campaign with other developers through the Frontier Model Forum and through government information-sharing channels. The report does not describe what additional measures those groups or agencies took.
Distillation can be a legitimate way to build smaller or more efficient models. The dispute here is about where the training material comes from, what a model is induced to reveal, and whether the resulting system inherits capabilities without the safeguards its developer built around them. In this case, OpenAI says it stopped the activity. The harder question is how much a model can be coaxed into teaching before anyone notices.