OpenAI blocked model distillation attack involving 15,000 users linked to Moonshot AI

Summary

OpenAI announced that it thwarted a coordinated adversarial distillation campaign that began in July 2026 and involved over 15,000 accounts. The campaign employed a dual-model jailbreaking technique to extract encrypted model 'thought' content. OpenAI alleges that these actions were carried out by actors linked to China's Moonshot AI (the developer of Kimi).

Why it matters

This marks the first instance of a major lab publicly detailing a large-scale, multi-account data leak that encompasses not just output text but internal reasoning traces. This significantly heightens risks regarding the protection of model intellectual property. The incident coincides with the week the FBI, NSA, and CISA issued a joint warning seemingly referencing multiple Chinese labs, indicating that distillation disputes are evolving into a US-China AI security conflict. The disclosed technique—transferring a strong model's reasoning process to a weaker sibling model and then exploiting that weaker model via jailbreaking—suggests that encrypting the chain of thought alone is insufficient.

Highlights

• The attack began with a few users on July 1. On July 24-25, over 4,000 accounts sent 16,000 requests. The operation was terminated on July 28.
• The core trick: Encrypted thought content from a high-tier model is loaded into a lower-tier model. This weaker model is then exploited via jailbreaking to exfiltrate the reasoning process as plain text.
• OpenAI explicitly states that it could not verify that the 15,000+ accounts were operated by a single organization. However, it 'suspects' that Moonshot AI is at the center of the operation.

Critical take

OpenAI's own language is cautious, using terms like 'suspected' and 'could not be verified to be under the control of a single organization.' However, the framing of the headline attributes the accusation to a seemingly named Chinese company. This pattern easily reinforces a geopolitical narrative before technical evidence (correlated account behavior, request patterns) is made public for independent verification. Furthermore, the figure of '15,000 users' is not clarified. Whether these accounts belong to real humans or cheaply generated API keys fundamentally changes the threat assessment. The article fails to distinguish between these two scenarios.