16:32Machine-translated from Azerbaijani by AIRead in Azerbaijani
OpenAI Links Attempt to Steal Reasoning Traces to Moonshot AI
“OpenAI” has disclosed that individuals linked to China-based “Moonshot AI” attempted in July to obtain its models’ hidden reasoning processes. The company described it as a coordinated campaign to capture the models’ protected reasoning. The attempts began at a low level on July 1. Activity rose sharply on July 24 and 25. According to “OpenAI,” this behavior resembles a method of collecting data without authorization to train another model.
During those 2 days, 16 000 requests using a specialized extraction method were recorded. The requests were sent from more than 4 000 user accounts. The campaign stopped completely on July 28. “OpenAI” is not certain that all the accounts were linked to the same party. The company did not disclose which models were targeted or how successful the attempts were. It is also unclear how many of the users were linked to “Moonshot AI.” Protected reasoning is an internal record showing how a model solves a task. To prevent the chain of thought from being visible, this information is encrypted and sent to the customer as a separate block. The customer returns that block with each new request. This eliminates the need for the company providing the service to store it on its own server. The operators tried to get another model to decrypt a block taken from one conversation. However, the encryption was not broken, and no access was gained to user conversations or the database. “OpenAI” closed a vulnerability that allowed encrypted reasoning taken from another user to be reprocessed and its content recovered. It also added checks that detect the exposure of hidden reasoning while a model sends its response in segments. Protections across users, workspaces, organizations and model families were strengthened. The company worked with the owners of third-party services to suspend suspicious accounts operating through those services.
Independent security researchers had previously warned companies about similar vulnerabilities. Their August 10 study, “Stealing Reasoning Traces from Proprietary LLM APIs,” tested models from “OpenAI,” “Anthropic” and “Google.” The tests were conducted in early July. After the vulnerabilities were reported to the companies, the same attacks could no longer be replicated.
Information disclosed by “Anthropic” in September 2026 also revealed similar activity linked to “Moonshot AI.” Over 10 days, the company identified a network of 5 380 fake accounts. Approximately 300 000 customer requests were transmitted through this network. The “Claude” model’s reasoning signatures were retained and later converted into complete reasoning traces in new conversations. “Moonshot AI” denied in July that its “Kimi K3” model had been developed using this method. “OpenAI” executives said it was still too early to draw conclusions. In the next phase, “OpenAI” wants to protect models running on partners’ servers in the same way as models on its own services. Additional checks will be developed to prevent attacks that could be carried out using responses from tools. The company shared its findings through the “Frontier Model Forum” and government agencies’ information-sharing channels. As models become more powerful and attempts to imitate them more cheaply increase, these attacks are also expected to become more sophisticated.
During those 2 days, 16 000 requests using a specialized extraction method were recorded. The requests were sent from more than 4 000 user accounts. The campaign stopped completely on July 28. “OpenAI” is not certain that all the accounts were linked to the same party. The company did not disclose which models were targeted or how successful the attempts were. It is also unclear how many of the users were linked to “Moonshot AI.” Protected reasoning is an internal record showing how a model solves a task. To prevent the chain of thought from being visible, this information is encrypted and sent to the customer as a separate block. The customer returns that block with each new request. This eliminates the need for the company providing the service to store it on its own server. The operators tried to get another model to decrypt a block taken from one conversation. However, the encryption was not broken, and no access was gained to user conversations or the database. “OpenAI” closed a vulnerability that allowed encrypted reasoning taken from another user to be reprocessed and its content recovered. It also added checks that detect the exposure of hidden reasoning while a model sends its response in segments. Protections across users, workspaces, organizations and model families were strengthened. The company worked with the owners of third-party services to suspend suspicious accounts operating through those services. Independent security researchers had previously warned companies about similar vulnerabilities. Their August 10 study, “Stealing Reasoning Traces from Proprietary LLM APIs,” tested models from “OpenAI,” “Anthropic” and “Google.” The tests were conducted in early July. After the vulnerabilities were reported to the companies, the same attacks could no longer be replicated. Information disclosed by “Anthropic” in September 2026 also revealed similar activity linked to “Moonshot AI.” Over 10 days, the company identified a network of 5 380 fake accounts. Approximately 300 000 customer requests were transmitted through this network. The “Claude” model’s reasoning signatures were retained and later converted into complete reasoning traces in new conversations. “Moonshot AI” denied in July that its “Kimi K3” model had been developed using this method. “OpenAI” executives said it was still too early to draw conclusions. In the next phase, “OpenAI” wants to protect models running on partners’ servers in the same way as models on its own services. Additional checks will be developed to prevent attacks that could be carried out using responses from tools. The company shared its findings through the “Frontier Model Forum” and government agencies’ information-sharing channels. As models become more powerful and attempts to imitate them more cheaply increase, these attacks are also expected to become more sophisticated.