← threat actors
threat actor · not yet in the cluster map
moonshot-ai
also tracked as alibaba 1, deepseek 1, minimax 1, stepfun 1, z ai 1
2 stories · 2 in the wild · September 9, 2026 – October 2, 2026
evidence: 2 observed
techniques
- prompt injection 1 · Oct 2
- data exfiltration 1 · Sep 9
attack phases seen
- Collection 2 · Oct 2
- Exfiltration 1 · Sep 9
what we reported, newest first, grouped by story
October 2, 2026
- OpenAI says it stopped a coordinated campaign designed to extract protected model reasoning. On July 24–25, it recorded 16,000 extraction-pattern attempts from more than 4,000 users; a broader investigation found related prompt activity across more than 15,000 users. OpenAI fully disrupted the campaign on July 28, closed a pathway that let someone replay another user’s encrypted reasoning, and added checks for reasoning exposed through streamed output. It attributed a core cluster to people associated with Moonshot AI, but published no technical evidence supporting that assessment. The Hacker News reports that no encryption or database was breached. The Decoder says researchers could still reproduce the technique through Azure for weeks, including against GPT-6 Astra.
· Oct 2 · observed · AI & Model Security
September 9, 2026
- NSA, CISA and FBI named six Chinese AI companies over "industrial-scale" model distillation. The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok since at least late 2024, routed through native APIs, cloud providers, third-party aggregators and gray-market "transfer station" proxies to evade geo-restrictions and traceability. Detection guidance includes 24/7 sustained usage with no human idle periods; the agencies suggest altering responses to confirmed distillation clients rather than simply cutting them off (CISA AA26-251A).
· Sep 9 · observed · as deepseek, alibaba, minimax, stepfun, z ai · AI & Model Security