Disrupting a coordinated model-distillation campaign

OpenAI’s security post describes a coordinated effort, earliest activity in the first week of July, to extract protected reasoning — the model’s internal working record — in ways that could help train or reproduce another system. Operators didn’t break encryption or steal stored chats; they manipulated interactions so reasoning became visible at scale, violating terms of service.

Volume spiked July 24–25 with about 16,000 extraction-pattern requests from over 4,000 users, and related patterns across a cluster of more than 15,000 users before disruption by July 28. OpenAI attributes a core cluster to individuals associated with Moonshot AI (Kimi), shared findings via the Frontier Model Forum, and says mitigations and partner coordination continue.

We’re treating distillation as the quiet theft vector that sits beside flashy agent hacks.

If protected reasoning can be coaxed into the clear, every lab’s “hidden chain of thought” becomes a training dataset for someone else’s model — often without the original safety stack. Sharing with the Frontier Model Forum is the right industry reflex. Naming Moonshot-associated operators raises the diplomatic temperature; attribution still leaves room for multiple actors.

I’m watching whether partner-hosted deployments get the same hardening OpenAI admits is unfinished. Useful competition shouldn’t mean cloning a frontier model through ToS gymnastics.

We’ll cover distillation fights as infrastructure security, not gossip. The public needs labs that can detect scaled extraction before it becomes a product launch elsewhere.

OpenAI Security blog, September 30, 2026.