Loading story…
OpenAI said it disrupted a coordinated model-distillation campaign in July that it primarily attributed to a cluster associated with Chinese AI developer Moonshot AI, creator of Kimi. The alleged operation used coordinated, high-volume prompts to extract protected model reasoning exposed to requesters, rather than accessing encrypted systems, databases, or user conversations. OpenAI reported approximately 16,000 extraction-pattern requests from more than 4,000 users on July 24–25, with related prompt activity spanning over 15,000 users.
OpenAI said it banned accounts involved in the activity on July 28, strengthened monitoring and controls, and closed a replay pathway involving encrypted reasoning. The company shared investigative details with industry and government information-sharing groups. The reported activity highlights the risk that sophisticated adversaries may seek to replicate proprietary model capabilities through API-driven extraction rather than conventional network intrusion.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
OpenAI said it fully disrupted the campaign on July 28 and banned accounts involved in the model-copying activity. It attributed the core cluster to Moonshot AI, developer of Kimi, while stating it could not establish that every observed operator was tied to one rival company.
OpenAI observed 16,000 requests using a relevant extraction pattern from more than 4,000 users across July 24 and 25. It also identified related prompt-pattern activity involving more than 15,000 users.
OpenAI reported that an adversarial model-distillation campaign began on July 1, manipulating model interactions to reproduce protected reasoning in requester-visible forms. The company said the activity did not involve breaking encryption, compromising databases, or directly accessing stored user conversations.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, the NSA, and the FBI allege that China-based AI companies—including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—ran industrial-scale campaigns to extract capabilities from U.S. frontier models. The activity reportedly generated billions of tokens and millions of requests to Claude, GPT, Gemini, and Grok through coordinated API routing, cloud providers, aggregators, relays, proxy networks, and rotating vendor accounts. Anthropic said it identified seven campaigns targeting Claude since February 2026; the largest, allegedly linked to Alibaba, made more than 151 million requests between May and July. According to the agencies and Anthropic, operators used fraudulent accounts, stolen API keys, payment and quota optimization, automated failover, and—in some cases—covert forwarding of user prompts to sustain collection and train competing models from the outputs. The activity may have exposed user-provided source code, corporate documents, personal data, and credentials. Anthropic said it blocked implicated accounts and proxy infrastructure and reduced the reasoning detail exposed by its models, while U.S. agencies recommended cross-provider sharing of high-confidence behavioral and infrastructure indicators and covert response degradation for suspected distillation operations.
Sep 18, 2026
The White House has accused China-linked actors and other foreign entities of running **industrial-scale AI model extraction and distillation campaigns** against U.S. frontier AI companies, saying the operations use tens of thousands of proxy or fraudulent accounts, jailbreaking techniques, distributed probing, and iterative prompt engineering to copy proprietary model behavior at scale. A memorandum from Office of Science and Technology Policy Director Michael Kratsios said the activity targets American AI innovation without requiring a traditional network breach, and warned that derivative systems may reproduce benchmark performance while stripping away safety controls, neutrality safeguards, and other protections built into the original models. Federal agencies have been directed to expand information sharing with AI firms and develop best practices for detecting, mitigating, and remediating the campaigns, with officials pointing to stronger telemetry, logging, identity controls, and real-time detection of distributed abuse as likely defenses. The administration is also weighing accountability measures, including possible sanctions and legal or export-control actions, while lawmakers advance legislation to identify and punish foreign actors targeting U.S.-owned AI models; China has rejected the allegations as "slander" and unjustified suppression, even as prior claims from OpenAI and Anthropic tied Chinese firms including **DeepSeek**, **Moonshot**, and **MiniMax** to large-scale distillation efforts.
Jun 29, 2026
The NSA, CISA, and FBI issued a joint advisory alleging that China-based AI companies have systematically extracted proprietary capabilities from U.S. frontier models since late 2024. The advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, alleging campaigns targeting variants of Anthropic Claude, OpenAI ChatGPT, Google Gemini, and Grok. The agencies said the companies allegedly generated billions of tokens and millions of model interactions through unauthorized or obscured access, distributing requests across accounts, APIs, cloud providers, aggregators, proxies, and gray-market services to evade safeguards and attribution. They characterized the activity as part of China’s AI-development strategy and urged AI developers, government agencies, and allied partners to improve detection, adjust response measures, and share threat intelligence.
Sep 11, 2026