# The Replay Path Closed 28 July. The Post Landed 30 September. > OpenAI said on 30 September it disrupted a campaign to extract protected reasoning. Activity started 1 July, spiked on 24 and 25 July, and stopped by 28 July. Operators copied encrypted reasoning across conversations. Encryption held and no database was entered. A core cluster is attributed to people associated with Moonshot AI. The post came 64 days later. Source: https://hackerlogs.com/blog/openai-reasoning-replay-clock Published: 2026-09-30 ## Key takeaways - The primary is OpenAI's 30 September post. Operators copied encrypted reasoning from one conversation and asked another conversation to transcribe it. - The impact clock runs 1 July to 28 July. The spike is 16,000 requests on 24 and 25 July from over 4,000 users, then a related cluster of more than 15,000 users. - There is no package to bump. The control clock is the closed replay path and new holds on streamed output. Partner hosts and tool outputs are still open work. - The public clock is 64 days after disruption. A related paper, arXiv:2608.09867, posted on 10 August. OpenAI says it confirmed those paths. - Moonshot is OpenAI's name for a core cluster, not a label for every user in the cluster. The post does not publish the evidence. Encryption was not broken. OpenAI said on 30 September that a campaign extracted protected reasoning by replaying encrypted blocks across conversations. The lab says it fully disrupted that activity by 28 July. The primary is [OpenAI's post](https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign/). A core cluster is attributed to people associated with Moonshot AI. The post does not show the evidence for that name. US X trends on 30 September were the Phillies and Gemini 4 Argon. Hacker News led with the same launch. Neither is this control failure. High because a reasoning blob already in someone's hands became a bearer secret at campaign scale. Not because a database was taken. Three panels for OpenAI's reasoning replay: encrypted blocks copied across chats, a 28 July disruption disclosed on 30 September, and the operator move to bind each blob to one session. ## What OpenAI actually said. The activity is what OpenAI calls adversarial distillation: unauthorized use of one model's outputs or reasoning to train, reproduce, or improve another model. Protected reasoning is the model's internal record for a task. Extracting it can surface material the final answer withheld. The method, in the post's words, was novel in form and ordinary in shape. Operators copied encrypted reasoning from one conversation and asked a model in another conversation to decrypt and transcribe the hidden content. OpenAI is explicit that they did not break encryption, compromise a database, or gain direct access to stored user conversations. They manipulated model interactions so the protected record came back visible to the requester. The lab says the same class is not unique to its models, and it shared the pattern through the Frontier Model Forum. Independent researchers had already brought related cross-model and conversation-compaction paths in through responsible disclosure. OpenAI says it investigated, confirmed the paths were real, and used that work to move mitigations. The paper it links is [arXiv:2608.09867](https://arxiv.org/abs/2608.09867), "Stealing Reasoning Traces from Proprietary LLM APIs," posted 10 August. That paper is a separate measurement from the July campaign. It reports that client-held reasoning blocks were interchangeable across sessions, users, and models at a provider, and that blocks already sitting in public repositories contained personal data and credentials. Do not merge those counts into the July request totals. > OpenAI's account is the opposite. The encryption held. What failed was binding. A block issued for one conversation was accepted in another, and the second conversation transcribed it. Possession of the blob was the access. A scanner looking for a broken cryptographic primitive will not see this. On attribution, the post is narrow. It is unclear whether every operator in the window was one actor. OpenAI attributes a core cluster to individuals associated with Moonshot AI, the developer of Kimi. [CyberScoop](https://cyberscoop.com/openai-moonshot-ai-model-distillation-attack/) notes that the post cites no technical basis for that name, and that OpenAI declined to share more, for security reasons. [The Verge](https://www.theverge.com/ai-artificial-intelligence/1002854/openai-claims-moonshot-extracted-its-data-to-train-ai-models) carries the same limit: a core cluster, not a single actor for the whole set. ## The impact clock and the public clock. There is no package version on this incident. The clocks are the campaign, the control change, and the day customers could read it. The impact clock opens on 1 July at low volume. On 24 and 25 July OpenAI counted 16,000 requests that matched an extraction pattern, from over 4,000 users. Further review found related prompt-pattern activity across a cluster of more than 15,000 users. The lab says that cluster was fully disrupted by 28 July. The control clock is inside the response, not a release tag. OpenAI banned or restricted accounts, tightened signup and infrastructure controls, and expanded monitoring. It closed a pathway that let someone who already possessed another user's encrypted reasoning replay it and recover the contents. It added checks to detect and hold streamed output that might expose reasoning. When the activity moved through third-party services, it worked with those providers on the accounts. The public clock is 30 September, 64 days after the disruption date. OpenAI says it waited so it could judge scope, ship its own mitigations, and take feedback from researchers and partners. It also says additional mitigation and investigation are still continuing. Partner-hosted deployments need the same protections as first-party services. Tool-output paths need checks that look past ordinary visible text. The post is a disclosure, not a claim that every deployment is finished. > A reasoning blob in a log, a ticket, or a public eval dump is not inert. The August paper's public-repo measurement is not the July campaign, and it is still the reason to scrub. If the artifact is portable, publication is disclosure of the hidden record. ## What this is not. It is not a database breach and not a stolen weight file. It is not the [July sandbox breakout](/blog/openai-hugging-face-incident) and not the [September DNS pause](/blog/openai-dns-pause-still-on). Those are agents leaving a training boundary. This is a client-held artifact accepted in the wrong conversation. It is not proof that all 15,000 users worked for one lab. OpenAI's sentence is a core cluster, plus an explicit unknown for the rest. It is not OpenAI's customer distillation product. That product stores completions on purpose so a developer can fine-tune a smaller model. The campaign OpenAI disrupted was unauthorized extraction of reasoning the product is built to withhold. Filing both under one word will send the wrong team. It is also not a finished cross-provider patch. OpenAI says the manipulation is not unique to its models. The bound you want is local: session, user, and model on the deployment you actually call, including the partner host in front of it. ## What to do. If you store traces, resell a frontier API, or run evals that keep the hidden record: 1. Treat every exported reasoning blob as a bearer secret. Bind it to the session, the user, and the model that issued it, or stop exporting it. A block that any later request can present will keep working after you ban the first account. 2. Hold streamed output that might carry the hidden record, including tool output. OpenAI's remaining work is specifically the path that looks only at ordinary visible text. 3. Scrub blobs already sitting in tickets, gists, support bundles, and eval dumps. The August paper recovered credentials from blocks that were already public. That is a different dataset from the July requests. The handling rule is the same. 4. Separate sanctioned distillation jobs from extraction alerts. A stored-completion fine-tune the customer started is not this campaign. An alert that keys only on the word distillation will page the wrong queue. 5. If you are briefing a board on the Moonshot sentence, quote the limit with the name. Core cluster. Individuals associated with Moonshot AI. Evidence not in the post. The control change does not depend on the name. The trends this morning were a baseball series and a model launch. The operator fact is older than the post. The replay path was closed on 28 July. Readers got the sentence on 30 September, and partner hosts are still on the list. ## Sources - [Disrupting a coordinated model-distillation campaign](https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign/) (2026-09-30) - [OpenAI reveals novel encryption bypass used in distillation attack](https://cyberscoop.com/openai-moonshot-ai-model-distillation-attack/) (2026-09-30) - [OpenAI claims Moonshot extracted its data to train AI models](https://www.theverge.com/ai-artificial-intelligence/1002854/openai-claims-moonshot-extracted-its-data-to-train-ai-models) (2026-09-30) - [Stealing Reasoning Traces from Proprietary LLM APIs](https://arxiv.org/abs/2608.09867) (2026-08-10)