OpenAI reported a campaign aimed at extracting encrypted reasoning data from its models, which began on July 1. The activity intensified on July 24 and 25, involving 16,000 requests from over 4,000 users. OpenAI stated the campaign was fully disrupted by July 28 and noted that the encryption itself was not broken.
The company linked the activity to actors associated with the China-based firm Moonshot AI. Attackers attempted to use encrypted reasoning blocks from one conversation to decrypt them in another. OpenAI responded by closing specific pathways, adding output checks, and strengthening protections across its model families and workspaces.
Independent researchers also identified vulnerabilities related to cross-model and conversation-compaction attacks. In a report dated August 10, they demonstrated how encrypted reasoning from frontier models could be converted to plain text by weaker models. Providers, including OpenAI, Anthropic, and Google, have since addressed these paths.
Anthropic reported a separate incident where Moonshot allegedly used a proxy network of 5,380 fraudulent accounts to relay nearly 300,000 requests. These attempts involved cross-session replay attacks to recover reasoning signatures. Moonshot previously denied that its Kimi K3 model was developed through distillation of other proprietary models.
OpenAI is now focusing on ensuring that partner-hosted deployments maintain the same security standards as its internal tools. The company shared its findings with the Frontier Model Forum and government channels, anticipating that distillation attempts will become more sophisticated as frontier models continue to evolve.
