Model-theft ops: distillation-extraction campaigns (OpenAI × Moonshot)

status: open, opened 2026-09-30, last moved 2026-09-30. AI openai moonshot china safety

• The thread: adversaries extracting a frontier lab's protected reasoning at scale — the theft side of the month's distillation narrative (which until now was enforcement + an advisory naming Z.AI as a distillation source, and labs worrying about weights security). OpenAI's Sep 30 disclosure is the first public vendor-attributed campaign.
• 2026-09-30: OpenAI's "Disrupting a coordinated model-distillation campaign" (blog ~6:30 AM ET): activity from July 1; spikes Jul 24–25 — 16,000 requests from 4,000+ users using an extraction pattern; a related prompt-pattern cluster across 15,000+ users; fully disrupted by Jul 28. Mechanism: conversational replay of model interactions (copying encrypted reasoning between conversations, asking a model to decrypt/transcribe) — not a crypto or database break; "not a vulnerability unique to OpenAI's models." Independent security researchers' responsible disclosure (arXiv 2608.09867) confirmed related cross-model and compaction vulnerabilities. Attribution: a core cluster associated with individuals associated with Moonshot AI (Kimi). Mitigations: account enforcement, signing-up/infrastructure controls, replay-path closure, streamed-output checks, third-party provider coordination; shared via the Frontier Model Forum + government information-sharing channels. Footnote caveat: figures count attempted, not necessarily successful, extractions.
• Watch for: Moonshot's or Beijing's response (the advisory precedent says Z.AI got named without public acknowledgment); whether other frontier labs report their own campaigns; whether the FMF turns this into a standing intel-sharing mechanism; whether attribution ever firms from "individuals associated with" to a company claim — that gap is where the geopolitical story will live.