---

OpenAI Says Chinese Rival Tried to Steal Its AI's Reasoning

OpenAI says it identified and shut down a coordinated campaign in which attackers tried to extract the hidden "reasoning" behind its AI models—the internal working-out a model does before giving a final answer. In a security update published on 30 September 2026, OpenAI said the activity began in low volumes on 1 July, spiked to roughly 16,000 suspicious requests from over 4,000 accounts on 24–25 July, and grew to a cluster of more than 15,000 accounts before being fully disrupted on 28 July.

The method itself was unusual: rather than breaching a database or breaking encryption, the attackers copied a model's encrypted reasoning from one conversation and asked a different conversation session to decrypt and transcribe it—effectively tricking the system into revealing to themselves what it was designed to keep hidden. OpenAI says it has not proven who was behind every account, but attributes a "core cluster" of the activity to individuals associated with Moonshot AI, a China-based AI company. OpenAI has closed the specific replay pathway involved, tightened account sign-up and monitoring controls, and shared technical details with other AI developers through the Frontier Model Forum so the wider industry can check for similar activity.

Why This Matters for Your Business

1. This wasn't a traditional hack. No encryption was broken and no database was breached. The attackers simply found a clever way to misuse normal product features at scale—a reminder that "the system wasn't hacked" doesn't mean a business wasn't exposed.
2. AI platforms are now a serious target. Whatever AI tools your business uses—chatbots, coding assistants, internal copilots—sit on infrastructure that is actively and persistently targeted by sophisticated, well-resourced operators.
3. Scale happened fast and quietly. A campaign went from a handful of test requests to 16,000 in under a month, and ran for weeks before being caught. Attacks against AI systems can escalate faster than traditional monitoring is built to catch.
4. Vendor transparency varies. OpenAI chose to publish details of this incident. Not every AI vendor your business relies on will be as forthcoming if something similar happens on their platform, which makes your own due diligence and monitoring more important, not less.

What Every Business Should Do Now

• Know which AI tools your business actually uses. Shadow IT extends to AI now—staff signing up for AI tools without oversight creates the same blind spots as any unmanaged software.
• Ask vendors about their security posture. Before adopting or renewing an AI tool, ask how the vendor monitors for abuse, how quickly they detect anomalies, and what they commit to disclosing if something goes wrong.
• Apply the same access discipline to AI accounts as any other system. Strong authentication, restricted permissions, and account monitoring apply to AI logins exactly as they do to email or cloud storage.
• Keep an eye on unusual usage patterns. A sudden spike in API calls or prompt volume from a single account or integration is worth investigating, whether it's targeting your systems or one you rely on.

How a Managed Service Provider (MSP) Helps

• Security & SOC monitoring. Continuous monitoring can flag the kind of abnormal access patterns and volume spikes that signalled this campaign, long before they become a bigger problem.
• Compliance Management. An MSP helps map which AI tools are in use across the business and ensures their use aligns with your data-handling and regulatory obligations.
• Consulting. Independent advice on vetting AI vendors and tools, before they're switched on, rather than after something goes wrong.
• AI adoption support. Getting the benefits of AI without the exposure—governance, access controls and usage policies built in from day one, not bolted on afterwards.
• Managed Services. Day-to-day oversight of the accounts, integrations and endpoints connecting your business to AI platforms, so nothing is left unmanaged.
• Backups & disaster recovery. If an AI vendor or integration is compromised, having your own data independently backed up limits how much any single incident can cost you.

This incident is a useful reminder that AI platforms are now serious infrastructure, targeted by serious operators—and that "no encryption was broken" is a low bar for calling something secure. Businesses adopting AI tools need the same rigour they'd apply to any other critical system.