AI distillation: OpenAI's accusation against Moonshot

Imagine a student who doesn't just want the answer to the test. He wants the teacher's scratch work, with every calculation, every attempt and every correction. That's what OpenAI accuses people linked to Chinese company Moonshot AI of: trying, thousands of times, to extract from GPT models, the programs that make ChatGPT work, the reasoning they hide.

The technical name for the practice is AI distillation, and it sits at the center of the dispute between the United States and China. The curious thing is that the same technique is used every day, legitimately, by the American companies themselves.

This article explains what OpenAI said, what distillation is, how the described trick works and what has actually been proven. You'll also see the other side: China's response and researchers who doubt the story.

Quick summary: the answer in 30 seconds. On September 30, 2026, OpenAI said it had blocked a campaign to extract the hidden reasoning from its models, with a core linked to Moonshot AI, owner of Kimi, a Chinese ChatGPT rival. There were 16,000 requests in two days: attempts, not confirmed extractions. Distilling means training one model with another's responses: a common technique that becomes a problem when done in secret. Moonshot did not comment; China denies it.

Index

• What did OpenAI say on September 30?
• What is AI distillation?
• What is protected reasoning and how did they try to extract it?
• Who is Moonshot AI and what is Kimi K3?
• How did the accusations get here?
• What do China and experts say?
• What this changes for you
• Frequently asked questions

What did OpenAI say on September 30?

OpenAI stated it had identified and stopped a coordinated campaign to extract the "protected reasoning" from its models. According to the company, the activity began on July 1, 2026, peaked on July 24 and 25, and was blocked by the 28th. A core of it was attributed to people associated with Moonshot AI.

Everything is in OpenAI's official statement, published in the security section of the site. The company calls the case "adversarial distillation": the systematic and unauthorized use of a model's responses or reasoning to train, reproduce or improve another.

The campaign's numbers

On the two peak days, OpenAI recorded 16,000 requests with the same extraction pattern, coming from more than 4,000 users. Upon investigation, it found similar activity in a larger group of more than 15,000 users.

Notice the distance between the blocking and the announcement: two months. OpenAI says it used that time to measure the scope of the problem, apply fixes and notify other companies in the sector and the government before making the case public.

What OpenAI does not claim

Three caveats are in the statement itself, and they change the size of the news.

The first: the numbers describe attempts, "not necessarily successful ones." The company doesn't say how much reasoning actually got out.

The second: OpenAI admits it doesn't know if everyone making the requests belonged to the same group. It attributes to Moonshot only a "core" of the activity, and speaks of "individuals associated" with the company.

The third: nobody broke encryption (the scrambling that makes text unreadable to those without the key), invaded a database or read stored conversations from other users. What happened was manipulation of conversations with the model, in violation of the terms of use.

In one sentence: OpenAI says it blocked, in July, thousands of attempts to extract GPT's hidden reasoning, and points to people linked to Moonshot as the center of them, without stating that the attempts succeeded.

We still need to know what this distillation is.

What is AI distillation?

AI distillation is the process of training a smaller or newer model using the responses of a more capable model. Instead of learning everything from scratch, the "student" learns by imitating the "teacher." The result is a cheaper model to run that retains much of the original's ability.

Think of an apprentice cook. He can spend years testing recipes on his own, or he can stand beside an experienced chef, watching what he does with each dish. The second path is much faster. Distilling a model is putting the apprentice AI beside the chef, millions of times.

The idea was born in 2015, in a scientific paper by three Google researchers, including Geoffrey Hinton, who would later win the Nobel Prize in Physics. They showed that a small model learns better when it receives not just the right answer from the large model, but also its doubts.

An example helps. Faced with a photo, the large model doesn't just say "dog." It says there's a high chance of it being a dog, some chance of it being a cat and almost no chance of it being a car. This gradation teaches the student that dog and cat are similar, and that both are very different from a car.

Since then the technique has become routine. OpenAI itself offers distillation as a service for its clients to create smaller, cheaper versions of the models. As Wired summarized in a report about the technique's origin, it's one of the most widely used tools for making AI more efficient.

Why does this matter to you? Because much of the fast, cheap models you use on your phone exist thanks to distillation. The "mini" version of an assistant is usually a student of the large version.

When does distillation become "adversarial"?

The problem, according to American companies, isn't the technique. It's who distills what, and how. Distilling your own model is legitimate. Distilling a competitor's model, hidden, with fake accounts and against the terms of use, is what they call an attack.

There's a technical detail. Classic distillation requires seeing the teacher from the inside, with those percentages of dog, cat and car. A competitor doesn't have that access. What remains is the outside path: making thousands or millions of queries and saving the responses to train the student.

Anthropic, owner of Claude and OpenAI competitor, described this pattern in February 2026: an isolated request seems innocent. When variations of it arrive tens of thousands of times, from hundreds of coordinated accounts, all targeting the same ability, the pattern becomes clear.

But the most valuable prize isn't in the model's final answer. It's in the scratch work.

What is protected reasoning and how did they try to extract it?

Protected reasoning is the scratch work the model writes before answering: the steps, tests and corrections that lead to the answer. Companies hide this scratch work from the user. According to OpenAI, the authors of the requests copied the encrypted scratch work, that is, scrambled in code, and asked a model, in another conversation, to decrypt and transcribe it.

The newest models are called reasoning models because they "think" in writing before answering. In English, this scratch work is the chain of thought.

Go back to the math test. The final answer is "x = 4." The scratch work shows how you get there. Someone who only sees the answer learns little. Someone who sees the scratch work learns the method, and method is what a student model most wants to copy. That's why the scratch work stays hidden.

Hidden doesn't mean absent. The study by independent researchers cited by OpenAI explains the mechanism: instead of storing the scratch work on their own servers, providers return it to the client as a block of encrypted text, which comes back with each new request.

The flaw described in the study is in a detail. These blocks were interchangeable between conversations, users and models from the same company. The attack, step by step, went like this:

1. The operator asks a difficult question to the most advanced model and receives the answer, along with the encrypted block of reasoning.
2. He copies this block, which to him is an unreadable jumble of characters.
3. He opens another conversation, with a smaller and less protected model from the same company, and pastes the block there.
4. He asks this smaller model to transcribe the content. The model decrypts the block and writes the reasoning in plain text.
5. Repeating this thousands of times, a bank of reasoning is formed to train another model.

It's like a safe with two doors and the same key. The front door has a strict guard, which is the large model, trained to refuse. The back door has a distracted doorman, which is the smaller model. The safe was never broken into: someone convinced the doorman to open it.

OpenAI says it has closed this path. The encrypted scratch work from one user or model stopped opening in another, and the company began withholding responses that might expose the reasoning.

The research that found the same flaw

The study, published on August 10, 2026, demonstrated the attack on models from Anthropic, OpenAI and Google. It wasn't an exclusive GPT defect, and OpenAI acknowledges this in the statement.

The researchers also showed a risk for ordinary people. Programmers often publish the history of their conversations with AI without knowing what's inside the encrypted blocks. By decrypting 315,320 blocks collected from public repositories, the sites where code is shared, the team recovered 367 personal data items and 182 credentials, which are passwords and access keys.

The most cited part is a test with Kimi K3. Upon receiving a small excerpt of Claude Opus 4.8's reasoning as a starting point, the Chinese model changed the response style and, in some cases, produced text almost identical to Claude's. The suspicion is this: a model that reacts so strongly to another's way of thinking may have been trained with it.

The authors themselves warn that this is little. The appendix says, in so many words, that the analysis doesn't allow stating that distillation occurred. It used only 90 problems and was done after the companies fixed the flaw.

In one sentence: protected reasoning is the model's scratch work, and the trick was taking this encrypted scratch work to a smaller model from the same company, which agreed to translate it.

Who is Moonshot AI and what is Kimi K3?

Moonshot AI is a Chinese artificial intelligence company, registered in Beijing, that develops the Kimi family of models. The most recent, Kimi K3, was launched in July 2026 with 2.8 trillion parameters. The company presents it as the first open-weight model to reach that size.

Parameters are the internal adjustments the model learns in training, like the knobs on a giant mixing board. The more knobs, the more nuance the model can store. According to Moonshot, no other open model had reached 2.8 trillion.

"Open weights" means the company publishes the file with these adjustments. Anyone with powerful enough computers can download the model and run it on their own. The Kimi K3 technical blog promised the complete weights by July 27, 2026, and the model page reports today that they are available for download.

It's this combination that worries Washington. GPT and Claude stay locked on their owners' servers, who can cut off access to those who abuse. An open-weight model, once published, has no return: it spreads and nobody controls who uses it anymore.

As of the last check of this article, on October 2, 2026, Moonshot had not publicly responded to OpenAI's accusation.

How did the accusations get here?

OpenAI's accusation is the most recent in a series that began in February 2026, when Anthropic pointed to three Chinese labs. In July, the White House and the US Treasury entered the matter. In September came a joint alert from three security agencies and a new Anthropic report.

Two terms appear in the table. "Exchange" is a pair of question and answer between an account and the model. Token is the piece of word that models read and write, the unit in which AI use is measured.

The post by Michael Kratsios, director of the White House Office of Science and Technology, was the moment the case became a government matter. He also stated that Moonshot obtained servers with advanced Nvidia chips and accessed them in Thailand. According to TechCrunch, which covered the Treasury's reaction, the sale of these chips to Chinese companies is prohibited by the United States. In the same text, Kratsios acknowledged that legitimate distillation has a "vital role" in open innovation.

Hours later, the Treasury Secretary wrote that open source is not a license to appropriate American intellectual property.

The most detailed document is the joint alert from the NSA, CISA and FBI. It cites DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and says that distillation is "the core, not a complement" of these companies' strategy. About Moonshot, it states that it extracted data from Claude Fable 5 to train K3 and from GPT-4o to train K2.

Two days later, Anthropic's September report brought a curious case. According to the company, Moonshot passed to Claude requests from its own clients, who thought they were talking to Kimi. In ten days there were almost 300,000 requests, through a network of 5,380 fraudulent accounts.

The numbers at scale

Here a comparison helps measure OpenAI's case. The 16,000 peak requests are little compared to what Anthropic reported.

The Alibaba case is more than 9,000 times larger in volume. The comparison has limits, because the measures are different: on one side, requests with a specific pattern in two days; on the other, all exchanges from a three-month campaign. Still, it shows the order of magnitude. What makes OpenAI's case relevant isn't the size, but the method, which aimed directly at the encrypted scratch work.

What do China and experts say?

China denies it. And researchers heard by the American press doubt that distillation, alone, explains Kimi K3's quality. For them, Chinese teams have the competence to build advanced models on their own, and the gain from copying others' responses diminishes as models become more sophisticated.

On September 9, one day after the American agencies' alert, spokesperson Mao Ning addressed the topic at the Chinese Ministry of Foreign Affairs press conference. She said China's AI advancement comes from scientific and technological self-reliance and open cooperation.

On the technical side, the doubt is about timing and method. Braden Hancock, a researcher at the Laude Institute, told TechCrunch, in a report about Kimi K3, that you don't reach such a strong model, so fast, only with distillation. For him, Americans underestimate the capability of Chinese teams.

In the same report, researcher Nathan Lambert, from the Allen Institute for AI, argues that distillation matters less and less. If copying responses were enough, he says, any lab would reach the Chinese models by doing the same with them, and that doesn't happen.

Wired, covering the study about the flaw, heard from Kyle Miller, from a security and technology studies center in Washington. His assessment: nobody in the United States knows how much distillation helps Chinese labs, and taking it out of the picture wouldn't change the dispute much.

There's also the irony many people pointed out. The companies that complain about copying today trained their models with texts written by other people and published on the internet. This argument doesn't exonerate anyone, but explains why the accusation is received with skepticism outside the American government.

No report published so far resolves the central question. Separating what each side showed, the picture looks like this:

In one sentence: that there were extraction attempts, the companies claim to have recorded; that these attempts explain the strength of Chinese models, nobody has demonstrated in public.

What this changes for you

For those who just chat with ChatGPT, almost nothing changes in the short term, and OpenAI states that user conversations were not accessed. The effects appear gradually: stricter registration, more surveillance over non-standard use and a debate about restricting Chinese open-weight models.

The American agencies' alert recommends three measures to companies, and two touch the user. One is to strengthen account identity verification. The other is to subtly alter the responses given to those suspected of distilling, or to serve them with an inferior model, without notice.

As Ars Technica observed when analyzing the alert, the risk is hitting those who have nothing to do with it. A legitimate user mistaken for an operator may receive worse responses without knowing why.

The discussion about banning Chinese open-weight models in the United States remains open. It matters beyond the US because these models are the cheap alternative for those who can't pay for American ones. In the artificial intelligence section of Kalkazu we follow this dispute, which also appears in our article about the fight over AI regulation in the United States.

Frequently asked questions

Was only OpenAI the target of this type of extraction?

No. The independent study demonstrated the same flaw in models from Anthropic and Google, and OpenAI says in the statement that the problem isn't exclusive to it. Anthropic reports distillation campaigns against Claude since February 2026, in much larger volume.

Is distilling an AI model illegal?

It depends on how it's done. Distilling your own model, or a model with permission, is normal practice. What OpenAI and Anthropic denounce is distillation done in secret, with fake accounts and against the terms of use. So far, the accusations are in statements and alerts, not in a court decision.

Is Kimi a copy of ChatGPT?

There's no public proof of that. OpenAI accuses people linked to Moonshot of trying to extract reasoning from its models, and admits the numbers are of attempts. Independent researchers found similarities between Kimi K3 and American models, but wrote that the analysis doesn't prove distillation.

Did my ChatGPT data leak in this case?

According to OpenAI, no. The company states that the operators didn't break encryption, didn't invade databases and didn't have direct access to stored conversations from users. The target was the model's reasoning in conversations the operators themselves opened.

Why does OpenAI accuse Moonshot only now?

The activity was from July 2026, and the announcement came out on September 30. The company says that, before disclosing, it investigated the scope, applied fixes and shared the information with other companies and the government. This is the first time OpenAI has cited Moonshot by name in such a case.

Why does OpenAI speak of security risk, and not just copying?

Because, according to the company, the extracted reasoning can train another model without the safeguards applied to the original. The responses the user sees go through filters; the scratch work doesn't. A model trained with this material would gain capability without the same investment in protection.

The Moonshot story is still at the beginning: the company's response is missing and someone needs to show, with open data, how much distillation actually yields. Until then, the safest thing is to read each new statement separating what was measured from what was only alleged.