OpenAI found 15,000 accounts probing hidden reasoning, then named a Chinese rival

THE SIGNAL IN ONE SENTENCE

A model provider can encrypt its hidden reasoning, hide the key, block the raw trace from the user and still leave a door open. The door is not a cracked database or a stolen password. It is the product itself accepting a protected reasoning artifact in one place and revealing what it means somewhere else. That is the uncomfortable center of a security disclosure OpenAI published on September 30. The company says it detected and disrupted a coordinated campaign that tried to recover protected reasoning from its models at scale. It attributes a core cluster of the activity to individuals associated with Moonshot AI, the Beijing company behind Kimi. The disclosure contains two stories that deserve to be separated. The first is a technical story with independent supporting research: encrypted reasoning can become a reusable object, and reusable objects can cross boundaries their designers did not intend. The second is an attribution story: OpenAI says people associated with a Chinese rival ran part of the campaign. OpenAI has not published the account-level evidence that would let outsiders independently inspect that conclusion. OpenAI says the earliest activity it linked to the campaign appeared on July 1. The heaviest burst came on July 24 and 25, when the company observed about 16,000 attempted extraction requests using a particular pattern from more than 4,000 users. It later connected related prompt patterns across a cluster of more than 15,000 users and says it had fully disrupted that cluster by July 28. Those numbers need careful nouns. They count attempted extraction requests and accounts or users linked by observed patterns. They do not establish 16,000 successful thefts. They do not establish that every account belonged to Moonshot. OpenAI says a core cluster was associated with Moonshot personnel, not that one organization necessarily controlled every operator in the broader set. The company is also explicit about what did not happen. It says attackers did not break its encryption, compromise a database or directly access stored user conversations. Instead, they manipulated normal model interactions to make protected reasoning reappear in plaintext. The attack treated one part of the system as a decoding service for another part. Here is the plain version. Some model APIs return an encrypted block that represents hidden reasoning. A later request can send that block back so the model can continue work without exposing the original reasoning to the user. That continuity can be useful. It can also create a portable token of meaning. If the same artifact is accepted across sessions, users or models, an attacker can experiment until a less protected path translates it. The padlock still works. The problem is that the building contains a machine willing to open the locked box under conditions the designer did not narrow enough. An independent paper helps establish that the attack class is real. In August, researchers published Stealing Reasoning Traces from Proprietary LLM APIs. They reported that encrypted reasoning blocks from Anthropic, OpenAI and Google could be moved across sessions, users or models inside a provider ecosystem. In one pattern, an attacker takes a block produced by a stronger model, injects it into a weaker or less safeguarded model and prompts that system to reproduce the underlying reasoning. The researchers say they decoded 315,320 reasoning blocks collected from public repositories. Within the recovered material, they identified 367 pieces of personally identifying information and 182 credentials. Public code is not the whole internet, and the counts depend on the team's collection and classification methods. Still, the result shows why this is more than a model-maker quarrel. Hidden reasoning can carry sensitive fragments that developers did not realize they were publishing. The paper also describes other ways a protected trace can become dangerous. A malicious block might preserve hazardous instructions that are invisible to the person moving it. It might carry a prompt injection into another session. It might reveal information from one context after the artifact crosses into a different account or model. Encryption protects the bytes from casual reading. It does not guarantee that every system receiving the bytes will enforce the same purpose, identity and policy. OpenAI cites this research while describing its own investigation. That is useful corroboration for the mechanism, not for the company attribution. The paper shows that cross-context reasoning extraction is possible across several providers. It does not identify Moonshot as the operator in OpenAI's incident. Attribution is where the story gets politically hot and evidentially cold. OpenAI says its investigation connected a core group to individuals associated with Moonshot AI. It says the campaign appeared designed to reconstruct protected reasoning and support model-distillation work. But the public post does not provide the account records, payment links, network indicators, employment evidence or analytic confidence levels behind that conclusion. Moonshot had not published a detailed response to this specific disclosure when this article was verified. That absence does not validate OpenAI's claim, and it does not disprove it. It means readers should carry the attribution with the correct label: a named allegation from the affected provider, supported by evidence the provider says it examined but has not made public. There is another limit worth stating plainly. OpenAI's post does not establish that a released Kimi model was trained on material recovered in this campaign. It describes attempted extraction behavior and an attributed cluster. Training provenance would require a different body of evidence, including model-development records, data lineage or technical analysis connecting recovered material to a particular model. Model distillation itself is not automatically misconduct. It is a broad family of techniques in which one system's outputs help train or shape another. Laboratories use distillation to make smaller models cheaper, transfer behaviors and create specialized tools. The legal and contractual questions depend on authorization, terms of service, what is copied, how access was obtained and which jurisdictions apply. Security teams have a narrower concern: coordinated attempts to recover a provider's protected internal reasoning are adversarial behavior whether or not a court has resolved the ownership theory. That narrower framing is also more useful for defenders. If a system accepts encrypted reasoning, the artifact should be bound cryptographically to the intended account, organization, session, model family and permitted continuation purpose. A block created for one customer should not become a bearer instrument that works for whoever holds it. A block created by one model should not be accepted by another merely because the wrapper looks familiar. Bindings need freshness too. Short expiration, one-time use where practical and server-side revocation reduce the value of a copied artifact. Version identifiers can prevent a block from crossing into a model whose safeguards differ. Purpose tags can distinguish a legitimate continuation from an attempt to ask a separate model to translate the hidden state. The receiving system should distrust the artifact even when its cryptographic signature is valid. A signed package proves where the package came from. It does not prove the content is harmless in the new context. Providers can screen for unexpected model transitions, unusual requests to paraphrase internal reasoning, high-volume replay, account farms and clusters that share infrastructure or prompt templates. OpenAI says it banned or restricted accounts, tightened signup and infrastructure controls, added protections across users, workspaces, organizations and models, closed the replay path and improved detection of streamed output associated with extraction. It also says it coordinated with partners and shared information through the Frontier Model Forum and government channels. Those are sensible incident-response categories. The disclosure does not provide enough measurement to tell outsiders the false-positive rate, how much material was recovered before disruption or whether every variant is closed. Developers have work to do even if they never receive a hidden reasoning block directly. A reasoning artifact in a repository, bug report, telemetry export or shared notebook should be treated like a credential-shaped unknown. Do not publish it casually. Do not replay a block copied from another person. Remove obsolete artifacts from examples. Scan source repositories for provider-specific reasoning containers. Rotate any adjacent credentials exposed in the same logs. Organizations using model APIs should inventory whether encrypted reasoning is stored, where it travels and who can move it. The audit should include application logs, observability platforms, support tickets, analytics systems, browser storage, code examples and vendor debugging tools. Retention rules should distinguish the visible answer from a hidden-state artifact. If the application can continue without keeping the block, deletion may be the cleanest control. Incident responders need a model-specific playbook. Preserve the artifact without replaying it in production. Record the account, model, session, timestamps and interfaces involved. Notify the provider through its security channel. Check for unusual continuation calls and account creation around the same period. If public code contains reasoning blocks, remove them from the current tree and history where feasible, then assess whether the decoded material could include secrets or personal data. The provider side needs an evidence trail stronger than a dramatic attribution paragraph. Public disclosure can protect detection methods, personal information and an active investigation while still explaining standards. Providers can publish the kinds of signals used, confidence bands, alternative explanations considered, the boundary between directly observed facts and inference, and whether an independent party reviewed the conclusion. That standard matters because frontier-model security is now entangled with competition between American and Chinese companies. A correct attribution can warn the ecosystem and support proportionate defenses. A weakly explained attribution can become a geopolitical shortcut, allowing a technical control failure to be narrated only as foreign villainy. Both can be true at once: a rival-linked campaign may have exploited a design flaw, and the provider still owns the design flaw. The incident should not be reduced to a spy-movie tale about one Chinese laboratory. The independent research found related weaknesses across multiple American model providers. The underlying lesson is architectural. Hidden reasoning became an object that products needed to transport. Once transported, it gained identity, lifetime, compatibility and reuse properties. Every one of those properties is a security decision. The best fix is layered. Bind artifacts to the narrowest context. Reject incompatible models and identities. Expire and revoke aggressively. Detect account graphs rather than evaluating each prompt alone. Limit the amount of sensitive information a trace can preserve. Test cross-user and cross-model boundaries with independent red teams. Give researchers a safe disclosure path. Publish incident evidence at a level that allows meaningful outside scrutiny. There is a final product lesson hiding under the security work. Companies often talk about hidden reasoning as though invisibility were equivalent to protection. It is not. A thing can be invisible in the interface and still be portable in the system. A thing can be encrypted at rest and still be recoverable through an authorized component used in an unauthorized sequence. The plain signal is that OpenAI appears to have stopped a large coordinated effort to probe protected reasoning, and its attribution to Moonshot deserves attention with a visible label attached. The independently demonstrated vulnerability class is the firmer part of the record. The response should be equally firm: make reasoning artifacts nonportable by default, preserve enough evidence to reconstruct abuse and require more than a company's accusation before turning a security incident into geopolitical fact.