OpenAI Accuses Moonshot AI of 'Adversarial Distillation' to Extract Hidden Reasoning for Kimi

OpenAI has accused Chinese artificial intelligence startup Moonshot AI, the company behind the Kimi chatbot, of running a coordinated campaign to extract the hidden reasoning of its AI models, a practice it calls adversarial distillation, in a blog post published on Wednesday.

According to OpenAI, the campaign began on July 1 with low-volume activity before surging on July 24 and 25, when the company detected 16,000 requests using a particular prompting technique from more than 4,000 users.

Further investigation uncovered related prompt patterns across a cluster of more than 15,000 users, which OpenAI says it fully disrupted by July 28.

OpenAI stressed that the operators did not break its encryption, access a database, or read stored user conversations. Instead, they allegedly manipulated ordinary model interactions with carefully designed prompts meant to make the model's protected reasoning visible to the requester.

In one technique described by the company, operators copied the encrypted reasoning output from one conversation and pasted it into a separate conversation, asking a different model instance to decrypt and transcribe it.

OpenAI encrypts the chain-of-thought its reasoning models produce specifically so competitors cannot read and learn from it.

Protected reasoning is the model's internal record for working through a task, the company wrote, and extracting it can reveal information withheld from the final answer and help others reproduce the model's capabilities.

The company said it could not determine whether all operators belonged to a single actor, but attributed a core cluster of the activity to individuals associated with Moonshot AI. Moonshot, whose Kimi models are open-weight and which is backed by Alibaba and Tencent at a valuation of around $35 billion, has not publicly responded to the allegations.

OpenAI said it has banned the accounts involved, tightened sign-up verification, and added new protections around hidden reasoning. It has also shared its findings with other AI labs through the Frontier Model Forum and with government information-sharing channels.

The disclosure follows a similar allegation last month, when Anthropic accused several Chinese developers, including Moonshot AI and Alibaba, of using its Claude models in large-scale distillation attempts to help train their own systems.

OpenAI warned that adversarial distillation goes beyond intellectual-property theft, saying it could allow advanced capabilities to be transferred to other models without the safeguards or safety investment applied to the original system. As models develop capabilities in dual-use domains, the company said, those risks could increase.