The trick: Headline Over Filing

OpenAI says 16,000 requests tried to copy its models' reasoning and names Moonshot AI.

Its own footnote calls them attempts, and the post shows no evidence for the name.

Issue 322 October 202611 receipts3 min

OpenAI says it disrupted a distillation campaign, with 16,000 extraction requests from over 4,000 users on July 24 and 25, and attributes a core cluster to people associated with Moonshot AI.

Before you read on. Your call?

OpenAI's footnote says the figures are attempted, not necessarily successful, extractions; it cannot say all operators were one actor; CyberScoop notes no technical evidence was cited.

The twist

The hole was in how providers passed encrypted reasoning, and The Register notes OpenAI built its models on scraped web content amid copyright fights.

16,000requests on July 24 and 25 that OpenAI's own footnote calls attempted

4,000users behind those requests

0pieces of technical evidence for the Moonshot attribution in the post

There’s more to this story.

Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.

Start your free month →

First membership: 30 days free, then A$89 a year. One introductory trial per customer. Card required; renews annually until cancelled. Cancel before the trial ends to avoid the first charge. Already a member? Sign in

The trick has a name

We call it Headline Over Filing: the document underneath says something else. You'll see it again. Learn to spot it →

Say this in tomorrow's meeting“OpenAI's 16,000 distillation requests were attempts by its own footnote, and it named Moonshot without showing evidence.”

Receipts

Supports web.archive.org: we observed high-volume spikes on July 24 and 25 consisting of 16,000 requests
Supports web.archive.org: we attribute a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.
Context web.archive.org: These figures describe attempted, not necessarily successful, extractions.
Context web.archive.org: It is unclear whether all operators we observed during the relevant time period originated from a single actor.
Context web.archive.org: This manipulation is not a vulnerability unique to OpenAI’s models
Refutes cyberscoop.com: OpenAI’s blog post does not cite any technical evidence or reasoning for its attribution.
Context cyberscoop.com: OpenAI told CyberScoop that it was not sharing any additional information “for security reasons.”
Context thehackernews.com: Last month, rival Anthropic accused Moonshot AI of stealthily relaying customer requests to Claude as opposed to processing them using Kimi
Context unite.ai: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider’s ecosystem.
Context theregister.com: OpenAI, which hoovered up vast amounts of internet content amid copyright fights, has accused individuals associated with China’s Moonshot AI
Context theregister.com: The Register reached out to Moonshot AI for comment and did not receive an immediate response.

Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.