OpenAI Disrupts a Moonshot AI-Linked Campaign That Replayed Encrypted Reasoning Across Conversations to Extract It

OpenAI models' hidden reasoning

OpenAI disclosed a distillation campaign that began at low volume on July 1, 2026, spiked on July 24-25 with 16,000 extraction-pattern requests from more than 4,000 users, involved related prompt patterns across more than 15,000 users, and was disrupted on July 28. The operators copied encrypted reasoning from one conversation and asked the model in another to decrypt and transcribe it. OpenAI attributed a core cluster to individuals associated with Moonshot AI, a Beijing-based AI company, closed the replay pathway, added checks that detect and hold streamed output exposing reasoning, and banned accounts. "The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations." Moonshot AI was among the six companies named in the joint NSA, FBI, and CISA distillation advisory AA26-251A in September

Ciphertext issued to the client could be fed back to the model that can read it, so the model became the decryption oracle for its own protected output