OpenAI says July query flood extracted its models' reasoning

OpenAI said on 30 September 2026 that it detected and shut down an adversarial distillation campaign against its reasoning models that ran from 1 July to 28 July 2026, and that the core cluster of operators was linked to Chinese AI firm Moonshot AI. Distillation is a machine learning technique in which one model's outputs are used to train another; in adversarial cases it involves sending bulk queries designed to reproduce a larger model's reasoning and capabilities.

In a blog post reported by The Register, OpenAI said the operators "did not break our encryption, compromise a database, or gain direct access to stored user conversations". Instead, the company said, "they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester in a coordinated, scaled manner that violated our terms of service".

The queries began slowly on 1 July, according to OpenAI. "We observed high-volume spikes on July 24 and 25 consisting of 16,000 requests using a relevant extraction pattern from over 4,000 users," the company said. Investigators later found related prompt-pattern activity across more than 15,000 users. OpenAI said it fully disrupted the campaign on 28 July. It did not tell The Register which of its models were targeted.

OpenAI said it was not clear whether every operator active in July was linked to a single rival company, but that the core cluster came from Moonshot AI, the developer of the Kimi models. The Register said it contacted Moonshot AI for comment and did not receive an immediate response.

The company's stated fixes were mostly account and infrastructure controls. OpenAI said it banned the accounts involved, tightened signup and infrastructure controls, and expanded monitoring. It also said it "closed a pathway that allowed someone who already possessed another user's encrypted reasoning to replay it and recover its contents" — a bug that let an attacker holding encrypted reasoning output turn it back into readable text. OpenAI said it worked with service providers so the activity would not simply shift to third-party platforms, and shared its investigation with other AI companies through the Frontier Model Forum and with government information-sharing programmes.

OpenAI framed the incident as a safety problem rather than only a commercial one. "Adversarial distillation poses safety and national security risks," the company said. "Extracted reasoning could be used to train another model without preserving the safeguards applied to the original model's user-facing outputs. At scale, distillation can also accelerate the transfer of advanced capabilities without requiring the same investment in safety. These concerns become heightened as models gain capabilities in dual use domains."

The accusation is not the first aimed at Moonshot AI. The Register noted that US federal officials and major American AI companies, including Google and Anthropic, have accused Chinese rivals, and Moonshot AI specifically, of using distillation to reproduce capabilities from American models. In late July, US President Donald Trump's Assistant for Science and Technology accused Moonshot AI of building its Kimi K3 model by distilling Anthropic's Fable model. Anthropic's Claude Opus 5.5, released a week before OpenAI's disclosure, ships with an anti-distillation defence called "preserved thinking", which Anthropic introduced with Fable 5.1.

The Register also pointed out the tension in the complaint, noting that OpenAI itself absorbed large volumes of internet content while fighting copyright claims.