--- title: Disrupting a coordinated model-distillation campaign description: OpenAI disclosed that it disrupted a coordinated campaign to extract protected model reasoning, beginning July 1 with spikes of 16,000 requests from over 4,000... canonical: https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Disrupting a coordinated model-distillation campaign | daily.dev og:description: OpenAI disclosed that it disrupted a coordinated campaign to extract protected model reasoning, beginning July 1 with spikes of 16,000 requests from over 4,000... og:url: https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy og:image: https://api.daily.dev/og/posts/lWmGyUpzY.png og:image:alt: Disrupting a coordinated model-distillation campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Disrupting a coordinated model-distillation campaign **[OpenAI](https://daily.dev/sources/openai)** · 4 min read · 0 upvotes · 0 comments ## Summary OpenAI disclosed that it disrupted a coordinated campaign to extract protected model reasoning, beginning July 1 with spikes of 16,000 requests from over 4,000 users on July 24-25, and a broader cluster of 15,000+ users fully disrupted by July 28. Operators manipulated model interactions rather than breaching encryption or databases, including copying encrypted reasoning from one conversation and asking another model to decrypt it. OpenAI attributes a core cluster of activity to individuals associated with Moonshot AI, developer of Kimi, though it is unclear if all activity traces to a single actor. Independent researchers also disclosed related cross-model and conversation-compaction vulnerabilities. OpenAI banned accounts, strengthened signup and infrastructure controls, closed a replay vulnerability for encrypted reasoning, and shared findings via the Frontier Model Forum and government channels to help the broader industry defend against adversarial distillation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is adversarial distillation and how did attackers try to extract OpenAI's protected reasoning? Adversarial distillation is the systematic, unauthorized use of one model's outputs or reasoning to train, reproduce, or improve another model. Attackers manipulated model interactions to make protected reasoning visible without breaking encryption or accessing databases, including copying encrypted reasoning from one conversation and asking a model in a separate conversation to decrypt and transcribe it. _Track how frontier labs respond to emerging model-security threats like this on daily.dev._ ### How large was the campaign OpenAI attributed to individuals associated with Moonshot AI? Activity began at low volume on July 1, then spiked to 16,000 requests from over 4,000 users on July 24-25 using a specific extraction pattern. Further investigation found related prompt-pattern activity across a cluster of more than 15,000 users, which OpenAI says it fully disrupted by July 28. OpenAI attributes a core cluster of this activity to individuals associated with Moonshot AI, the developer of Kimi. _Developers evaluating AI vendor trust and model provenance can follow these disclosures on daily.dev._ ### What fixes did OpenAI deploy to stop reasoning-extraction and replay attacks? OpenAI banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, and expanded monitoring for related networks. It closed a pathway letting someone who already had another user's encrypted reasoning replay it to recover contents, added checks to detect and hold streamed output that might expose reasoning, and coordinated with third-party providers to disrupt related accounts. _Teams building on hosted LLM reasoning APIs can keep up with security mitigations like these on daily.dev._ ## Similar posts on daily.dev - [Anthropic accuses Alibaba of using 25,000 fake accounts to scrape Claude AI](https://daily.dev/posts/anthropic-accuses-alibaba-of-using-25-000-fake-accounts-to-scrape-claude-ai-wxxhratg1) · InfoWorld · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#machine-learning](https://daily.dev/tags/machine-learning), [#openai](https://daily.dev/tags/openai), [#ai-security](https://daily.dev/tags/ai-security), [#moonshot-ai](https://daily.dev/tags/moonshot-ai) [View this post on daily.dev](https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Disrupting a coordinated model-distillation campaign","url":"https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy"},"datePublished":"2026-09-30T17:36:54.872Z","dateModified":"2026-10-01T07:16:58.236Z","description":"OpenAI disclosed that it disrupted a coordinated campaign to extract protected model reasoning, beginning July 1 with spikes of 16,000 requests from over 4,000...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ecc9de3b1cd7c3e7e8d1758e0efbdd8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ecc9de3b1cd7c3e7e8d1758e0efbdd8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"OpenAI","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"OpenAI","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/984b3632316f4afaa3d5213d5c64fe65","url":"https://daily.dev/sources/openai"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,machine-learning,openai,ai-security,moonshot-ai","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OpenAI","item":"https://daily.dev/sources/openai"},{"@type":"ListItem","position":3,"name":"Disrupting a coordinated model-distillation campaign"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/disrupting-a-coordinated-model-distillation-campaign-lwmgyupzy#faq","mainEntity":[{"@type":"Question","name":"What is adversarial distillation and how did attackers try to extract OpenAI's protected reasoning?","acceptedAnswer":{"@type":"Answer","text":"Adversarial distillation is the systematic, unauthorized use of one model's outputs or reasoning to train, reproduce, or improve another model. Attackers manipulated model interactions to make protected reasoning visible without breaking encryption or accessing databases, including copying encrypted reasoning from one conversation and asking a model in a separate conversation to decrypt and transcribe it. Track how frontier labs respond to emerging model-security threats like this on daily.dev."}},{"@type":"Question","name":"How large was the campaign OpenAI attributed to individuals associated with Moonshot AI?","acceptedAnswer":{"@type":"Answer","text":"Activity began at low volume on July 1, then spiked to 16,000 requests from over 4,000 users on July 24-25 using a specific extraction pattern. Further investigation found related prompt-pattern activity across a cluster of more than 15,000 users, which OpenAI says it fully disrupted by July 28. OpenAI attributes a core cluster of this activity to individuals associated with Moonshot AI, the developer of Kimi. Developers evaluating AI vendor trust and model provenance can follow these disclosures on daily.dev."}},{"@type":"Question","name":"What fixes did OpenAI deploy to stop reasoning-extraction and replay attacks?","acceptedAnswer":{"@type":"Answer","text":"OpenAI banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, and expanded monitoring for related networks. It closed a pathway letting someone who already had another user's encrypted reasoning replay it to recover contents, added checks to detect and hold streamed output that might expose reasoning, and coordinated with third-party providers to disrupt related accounts. Teams building on hosted LLM reasoning APIs can keep up with security mitigations like these on daily.dev."}}]} ```