OpenAI disrupts coordinated GPT-6 Astra distillation campaign, attributes core cluster to Moonshot AI
OpenAI disclosed on September 30 that it identified and disrupted a months-long adversarial distillation campaign that peaked with 16,000 requests on July 24-25, attributing the core cluster of activity to individuals associated with Moonshot AI, developer of Kimi.
OpenAI disclosed on September 30 a coordinated adversarial distillation campaign it identified and disrupted against its models. Distillation in this context means systematically querying a model's outputs and internal reasoning patterns and using them to train a cheaper imitation; OpenAI characterized the activity as intellectual-property theft in violation of its terms of service and shared information with industry partners through the Frontier Model Forum.
The earliest observed activity dates to July 1, 2026, initially at low volume, with a high-volume spike of 16,000 requests using a relevant extraction pattern from more than 4,000 users on July 24-25. Further investigation tied related prompt-pattern activity across a cluster of more than 15,000 users, which OpenAI fully disrupted by July 28. The operators did not break OpenAI's encryption, compromise a database, or directly access stored user conversations; instead they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester. One technique involved copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden content.
On attribution, OpenAI said it is unclear whether every operator observed during the relevant period originated from a single actor, but attributed a core cluster of the activity to individuals associated with Moonshot AI, developer of Kimi. On September 8, the NSA, CISA, and FBI released a joint cybersecurity advisory stating that Moonshot AI had run a large-scale distillation campaign against US frontier AI companies since at least mid-2025, using Claude Fable 5 data to train Kimi-K3 and GPT-4o data to train Kimi-K2. The advisory also named DeepSeek, Alibaba, MiniMax, StepFun, and Z.AI as entities that may have extracted billions of tokens across millions of exchanges from US frontier models since late 2024. OpenAI said it has deployed adaptive access controls and information-gain mitigation, and is continuing to work with industry partners.