OpenAI said it disrupted a coordinated campaign in which operators attempted to extract protected reasoning from its artificial intelligence models, linking a core cluster of the activity to Chinese AI startup Moonshot AI, the developer of Kimi.
The activity began in early July and surged to 16,000 requests from more than 4,000 users over two days, OpenAI said. The company later identified related activity across a cluster of more than 15,000 users and said it had fully disrupted the campaign by July 28.
OpenAI described the activity as “adversarial distillation”, a process in which the outputs or reasoning of one AI model are used to train or improve another. The company said attempts to extract protected reasoning could allow other developers to reproduce advanced capabilities without making comparable investments in developing and safeguarding frontier models.
According to OpenAI, the operators did not breach its encryption, databases or stored user conversations. Instead, they manipulated interactions with its models in an effort to reproduce hidden reasoning in a form that could be accessed by the requester.
OpenAI said it could not determine whether all of the operators were connected to a single actor. However, it attributed a core cluster of the activity to individuals associated with Moonshot AI. The company said it had shared its findings with other AI developers through the Frontier Model Forum and with government information-sharing channels.
The disclosure comes weeks after OpenAI rival Anthropic accused several Chinese AI developers, including Moonshot AI and Alibaba, of secretly using its Claude model to help train their own AI systems. Those allegations have added to concerns among US AI companies about competitors using established models to accelerate the development of competing systems.
The latest OpenAI findings centre on the extraction of model capabilities rather than a conventional breach of computer infrastructure. By repeatedly interacting with an AI system, operators can attempt to obtain enough information about its responses or reasoning to help develop another model. OpenAI said such activity presents potential safety and national security risks because it could enable advanced capabilities to be reproduced without equivalent investment in their development and safeguards.
The scale of the activity expanded considerably during the campaign. OpenAI said the initial activity began in early July before reaching 16,000 requests from more than 4,000 users over a two-day period. The company subsequently identified related activity involving more than 15,000 users before disrupting the campaign on July 28.
Moonshot AI did not immediately respond to CNBC’s request for comment.
OpenAI’s disclosure comes as major AI developers increasingly monitor how their models are being used, particularly where repeated or coordinated interactions could be intended to extract capabilities for use in other systems. The company said its investigation had not found evidence that the operators penetrated its encryption, databases or stored conversations.
