OpenAI Says China-Linked Moonshot AI Accounts Targeted Its Model Reasoning

OpenAI says Moonshot AI-linked accounts attempted to extract encrypted reasoning from its AI models using more than 4,000 accounts.

OpenAI said it disrupted a campaign involving people linked to Chinese artificial intelligence company Moonshot AI who attempted to extract the hidden reasoning capabilities of its models.

According to Coin Bureau, OpenAI said the operators used one conversation to obtain encrypted reasoning output and then submitted that material to a model in a separate conversation, asking it to decrypt the information. OpenAI's encrypted reasoning system is designed to protect reasoning content while allowing it to be passed between API calls.

The campaign reached about 16,000 requests from more than 4,000 accounts at its peak in late July, according to the figures cited by Coin Bureau. OpenAI subsequently shut down the activity.

Moonshot Campaign Focused on Model Reasoning

The reported activity centers on the extraction of a model's internal reasoning traces, an area that AI developers increasingly treat as sensitive intellectual property.

OpenAI's developer documentation confirms that its API can return encrypted reasoning content rather than exposing the underlying reasoning tokens directly. The encrypted material can be passed back in subsequent requests, while the system is designed so the application does not need to interpret the encrypted content itself.

Coin Bureau said the operators associated with Moonshot attempted to circumvent that protection by moving encrypted reasoning from one conversation into another and asking a model to recover the underlying information.

The reported campaign differs from ordinary use of an AI model because the stated objective was not simply to obtain answers to individual prompts, but to extract information associated with the model's reasoning process.

Anthropic Previously Reported Moonshot Activity

The allegations come after Anthropic separately accused Moonshot AI and other Chinese AI laboratories of using its Claude models in unauthorized model-distillation campaigns.

In a September report, Anthropic said Moonshot had routed customer requests to Claude rather than processing them through its own Kimi models. Anthropic said it observed almost 300,000 customer requests being relayed to its systems over a 10-day period in one instance. It also alleged that Moonshot captured at least some of those exchanges for use in training its models.

Anthropic said its investigation identified a technique in which Moonshot saved Claude's encrypted reasoning signature, opened a new session and attempted to use the signature to recover the underlying reasoning trace. Anthropic described the activity as part of a broader effort to extract Claude's capabilities.

The company said it observed more than 23 million exchanges attributable to Moonshot between May and July 2026. Those figures were based on Anthropic's own investigation and represent the company's characterization of the activity.

Moonshot Has Not Responded

The Coin Bureau post said Moonshot had not responded to the latest allegations involving OpenAI.

The reports from OpenAI and Anthropic place increasing attention on techniques designed to obtain information from frontier AI systems without directly accessing their underlying model weights. Anthropic has previously described model distillation as a legitimate training technique financial that can also be misused to reproduce capabilities from more advanced systems.

For the OpenAI incident, the reported campaign was shut down after reaching its peak activity in late July, with approximately 16,000 requests originating from more than 4,000 accounts.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.