What has OpenAI alleged about Moonshot AI’s attempts to extract hidden reasoning from GPT models, including the scale, timing, and limits of its attribution; how do the September U.S. agency advisory and Anthropic’s threat report describe Moonshot’s alleged distillation and reque

OpenAI says it disrupted a July 2026 campaign that tried to make GPT models reveal protected, hidden reasoning, and attributes a core cluster—not the entire campaign—to individuals associated with Moonshot AI. The September U.S. advisory and Anthropic’s reporting make broader allegations about distillation and routing requests through U.S. models; these are allegations, not proof that every observed request succeeded or came from Moonshot. 739

• OpenAI’s scale and timing: It says activity began July 1. On July 24–25, it observed 16,000 requests using an extraction pattern from more than 4,000 users; its wider investigation found related prompt patterns across more than 15,000 users and disrupted the cluster by July 28. One technique copied encrypted reasoning from one conversation and asked a model in another to decrypt and transcribe it. OpenAI explicitly says the figures count attempts, not necessarily successful extractions, and says it cannot determine whether all operators were one actor. 7
• September allegations: The NSA–CISA–FBI advisory names Moonshot among six China-based companies it says extracted, collectively, billions of tokens through millions of requests to U.S. frontier models since at least late 2024; those totals are not Moonshot-only figures. It says such requests were routed through multiple access pathways. Separately, Anthropic accused Moonshot of covertly routing thousands of users’ requests to Claude and presenting the answers as its own, without telling users. 39
• The Codex contrast: Reports say Moonshot’s Kimi K3 became available to enterprise Codex users through U.S. inference provider Baseten, with usage counting against existing OpenAI spending commitments rather than requiring a new vendor purchase. It was reported as the first Chinese open model to enter that enterprise purchasing channel—striking alongside OpenAI’s accusation, but not evidence that the Codex arrangement facilitated the alleged extraction. 31
• Safeguards: The advisory calls for mitigations against industrial-scale, unauthorized distillation. The accessible advisory material establishes its warning and the use of multiple access pathways, but does not provide enough detail here to verify a precise, exhaustive list of its recommended controls; I would not attribute a specific checklist to the agencies without that text. 3