OpenAI discloses coordinated model-distillation attack, attributes a core cluster to Moonshot AI, and hardens defenses against adversarial reasoning extraction

On Sept 30–Oct 1, 2026 OpenAI published details of a coordinated campaign (peaking Jul 24–25 at ~16,000 extraction requests across 4,000+ users; fully disrupted Jul 28; >15,000 users tied to related patterns) that used adversarial distillation to extract protected model reasoning, with the core operator cluster attributed to individuals associated with Moonshot AI. OpenAI said it deployed new mitigations, banned accounts, closed a pathway allowing replay/decryption of another user's encrypted reasoning, and added streaming-output checks that can hold output exposing reasoning.

It is the first public, dated account of a scaled adversarial-distillation operation directly targeting protected reasoning traces, and it names the follow-on risk (mimicry without safeguards, dual-use capability transfer). It also validates the cross-session encrypted-reasoning decryption research and prompted a concrete platform hardening change at a frontier lab — an important data point for AI-SPM/model-security buyers on reasoning-trace protection.

AI platform teams and model providers should treat encrypted reasoning traces as adversarial target #1: inventory reasoning-exposure surfaces, add anomaly detection on extraction-style prompt volumes, and review cross-session/cross-model trace substitutability before evaluating third-party model-security tooling.