OpenAI disrupted an 'adversarial distillation' campaign it linked to China's Moonshot AI, developer of Kimi
OpenAI said it identified and disrupted a coordinated campaign in which operators manipulated interactions with its AI models to extract protected hidden reasoning, a practice it called "adversarial distillation." The activity began in early July and surged to 16,000 requests from more than 4,000 users over two days. OpenAI identified related activity across more than 15,000 users and said it fully disrupted the campaign by July 28. It alleges that a core cluster was tied to individuals associated with Chinese startup Moonshot AI and has shared its findings with other AI developers and government channels; Moonshot did not immediately comment.
What the AI did
OpenAI's AI models were the target. OpenAI says operators sent them coordinated, manipulated requests to draw out the models' protected, hidden reasoning in a form the requester could see, so that it could be used to help train or improve another model. According to OpenAI, the operators did not break into its encryption, databases or stored user conversations.
First reported October 1, 2026 · Added to the register October 1, 2026 · 1 source
- Affected
- OpenAI
- Country
- China
- When it happened
- July 2026
- First reported
- October 1, 2026
What this means for you
Could this affect you?
OpenAI's models were targeted, and any AI provider that shows model reasoning through its services could face similar copying attempts, while businesses using outside models could end up relying on models built this way.
What to check
- Monitor for coordinated, high-volume requests across many accounts aimed at drawing out hidden reasoning.
- Share warning signs of such campaigns through industry channels.
- Check your AI vendors' terms on copying model outputs to train other models.
- Check where the AI models you adopt came from and how they were built.
Areas of your AI programme this touches
Timeline
- July 2026Happened
- October 1, 2026First reported
Every fact and its source (7)
- Campaign fully disruptedBy July 28“said it had fully disrupted the campaign by July 28”[1]
- Size of related activity clusterMore than 15,000 users“identified related activity across a cluster of more than 15,000 users”[1]
- Attack methodAdversarial distillation to reproduce hidden reasoning“OpenAI described the latest activity as "adversarial distillation,"”[1]
- Scope limitationNo breach of encryption, databases or stored user conversations“The operators did not breach OpenAI's encryption, databases or stored user conversations”[1]
- ResponseFindings shared via Frontier Model Forum and government channels“shared its findings with other AI developers through the Frontier Model Forum as well as government information-sharing channels”[1]
- Alleged party linked to core clusterMoonshot AI (developer of Kimi)“linking a core cluster of the activity with Chinese startup Moonshot AI, the developer of Kimi”[1]
- Peak activity16,000 requests from more than 4,000 users over two days“later surged to 16,000 requests from more than 4,000 users over two days”[1]
Sources
- OpenAI links China Moonshot AI to extraction attemptcnbc.com · October 1, 2026
How this record is classified. Severity S (4/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Alleged, meaning one party's claim.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and reviewed by an editor before publication. Records reflect what has been disclosed, not everything that has happened.
