OpenAI has accused individuals associated with China's Moonshot AI of conducting a "distillation attack" against its models throughout July. The company stated that this activity, which began on July 1 and was fully disrupted on July 28, involved manipulating model interactions to reproduce protected reasoning at scale, violating its terms of service.
According to OpenAI, the operators did not breach its encryption, compromise databases, or gain direct access to stored user conversations. Instead, they sent bulk queries designed to extract the models' reasoning and capabilities. While the activity started slowly, OpenAI observed significant spikes on July 24 and 25, consisting of 16,000 requests using a relevant extraction pattern from over 4,000 users. The investigation identified related "prompt-pattern activity" across more than 15,000 users.
OpenAI's blog post on Wednesday indicated that while it is unclear if all operators during July were linked to a single rival AI company, the "core cluster" of the theft originated from Moonshot AI, the developer of the Kimi model. This accusation echoes similar claims made by other major US AI companies, including Google and Anthropic, as well as US government officials, who have also accused Moonshot AI of using distillation techniques.
In late July, Michael Kratsios, Assistant for Science and Technology to US President Donald Trump, specifically accused Moonshot AI of creating its Kimi K3 model by distilling Anthropic’s Fable model. Anthropic's Claude Opus 5.5 model, released recently, includes a defense against distillation called "preserved thinking," which was introduced with its Fable 5.1 version.
OpenAI emphasized that adversarial distillation poses safety and national security risks. The company explained that extracted reasoning could be used to train another model without preserving the safeguards applied to the original model’s user-facing outputs. Furthermore, at scale, distillation can accelerate the transfer of advanced capabilities without requiring the same investment in safety, concerns that are heightened as models gain capabilities in dual-use domains.
In response to the incident, OpenAI confirmed it banned the accounts involved in the model-copying activity, tightened signup and infrastructure controls, and expanded its monitoring efforts. The company also "closed a pathway that allowed someone who already possessed another user's encrypted reasoning to replay it and recover its contents" and collaborated with service providers to prevent this type of distillation from moving to third-party services. Additionally, OpenAI shared details of its investigation with other AI firms through the Frontier Model Forum and government information-sharing programs.
