OpenAI reveals ‘novel’ encryption bypass used in distillation attack
OpenAI disrupts campaign to extract AI model reasoning, implicating Chinese rival Moonshot AI.
OpenAI has disrupted a coordinated campaign aimed at extracting reasoning capabilities from its AI models. The attackers used a novel method to copy encrypted reasoning data and then prompt the model to decrypt and transcribe it in plain text, bypassing direct database access. OpenAI attributes a core cluster of this activity to individuals associated with Moonshot AI, a Chinese AI company.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers linked to Moonshot AI exploited a novel technique to bypass encrypted reasoning data protections in OpenAI's models — not by cracking encryption directly, but by prompting the model itself to decrypt and transcribe its own protected outputs in plain text. This highlights a critical blind spot: encryption alone is insufficient when the protected system can be socially or technically manipulated into self-disclosing sensitive information. The attack represents a new class of AI-specific threat where the model's own capabilities become the attack vector. This matters because it demonstrates that intellectual property embedded in proprietary AI reasoning chains can be exfiltrated at scale without traditional database breaches.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.