According to an announcement by OpenAI on September 30, 2026, the company discovered and completely mitigated a large-scale organized campaign aimed at extracting the model’s hidden reasoning chain. This series of activities escalated from early July 2026 and peaked during the two days of July 24–25 with approximately 16,000 requests executed by more than 4,000 user accounts. By July 28, the entire campaign had been completely neutralized.

OpenAI clearly delineated the technical scope of the incident: the threat actor group did not breach databases, break encryption, or gain unauthorized access to saved user conversations. The execution method primarily relied on manipulating system interaction mechanisms to force the model to render the hidden reasoning portion in a visible display format. This coordinated, large-scale manipulation constitutes a serious violation of the company’s terms of use.

The reasoning extraction technique recently patched by OpenAI

The most notable point in OpenAI’s report is how the perpetrators carried out the reasoning extraction: They copied the encrypted reasoning text from one chat session, then asked the model in another chat session to decrypt and transcribe the full content. In essence, this was not a direct data theft attempt, but rather leveraging the ciphertext generated by the model itself to bypass protective controls.

In addition, independent security researchers proactively reported similar attack vectors, including cross-model reasoning vulnerabilities and chat history compression vulnerabilities. After investigating and confirming the accuracy of these warnings, OpenAI stated that contributions from the research community helped them gain a more comprehensive understanding of this attack pattern, enabling them to deploy timely remediation measures.

To completely stop this, OpenAI blocked the ability to replay encrypted reasoning text to recover content. The company added verification layers to detect and prevent reasoning leakage through live data streams, while tightening controls protecting hidden reasoning across all user accounts, workspaces, organizations, and model families. For activities originating through third-party services, OpenAI also coordinated with providers to disable the associated violating accounts.

Why this cannot be viewed merely as a technical leak

This behavior is defined by OpenAI as “adversarial distillation”, a method of exploiting the outputs or reasoning chains of a model to train, reconstruct, or upgrade another model. The company presented a safety argument covering two main aspects:

  • Risks from bypassing safety guardrails: Extracted reasoning chains can be used as training data for another system without preserving the safety controls inherent to the end-user output interface.
  • Cost and technological impact: When deployed at scale, distillation enables the transfer of advanced artificial intelligence capabilities to third parties without requiring proportional investment in safety research.

The severity of this risk increases further for models possessing high capabilities in dual-use domains. Asserting that this is not an isolated internal issue, OpenAI emphasized that other advanced AI systems face similar risks. Consequently, the company proactively shared warning details through the Frontier Model Forum as well as official communication channels with regulatory authorities.

The unclear aspect: extent of involvement

Regarding attribution, OpenAI offered a fairly cautious assessment: they do not claim that all participating actors belong to the same organization. However, the primary activity cluster was identified as being linked to individuals associated with Moonshot AI—the team behind the Kimi model. Notably, this conclusion is based on OpenAI’s internal analysis rather than widely publicized evidence, and Moonshot AI has not yet commented when contacted by CNBC.

To properly evaluate the scale of the incident, it must be viewed in the broader context: less than a month earlier, Anthropic also accused several Chinese AI developers (including Moonshot AI and Alibaba) of improperly exploiting data from Claude for training.

Although the scale of 16,000 requests in this instance is far more modest than the 151-million-interaction campaign Anthropic recorded in September 2026, the core difference lies in its nature: OpenAI identified these as attempts to extract the form of reasoning. At the same time, the figure of 16,000 represents only the number of extraction attempts, which were not necessarily all successful.

Another notable point is OpenAI’s warning about a new systemic risk: any AI model operating under a mechanism that allows retaining, transferring, or replaying the reasoning stream could face a similar security vulnerability. This represents a shared risk across the entire technology architecture, rather than being confined to an individual company.

Rather than focusing solely on OpenAI’s announcement, the key factor to watch next will be the official response from Moonshot AI alongside independent third-party reports.