White House Director of Science and Technology Policy Kratsios accused Moonshot AI of large-scale distillation of U.S. models and allegedly obtaining the banned NVIDIA GB300 through Thailand.

Article author, source: 0x9999in1, ME News



TL;DR

• OpenAI President Brockman rarely praised Kimi K3 as "quite good," but cautioned against drawing premature conclusions about distillation, while also offering an estimate that the gap between China and the U.S. is "only four months."
• White House Director of Science and Technology Policy Kratsios accused Moonshot AI of large-scale distillation of U.S. models and allegedly obtaining the banned NVIDIA GB300 through Thailand.
• Treasury Secretary Bessent stated: "Sanctions and the Entity List are both on the table," and "Open source is not an open season for harvesting U.S. intellectual property."
• In February 2026, Anthropic specifically named DeepSeek, Moonshot AI, and MiniMax, stating that the three companies used approximately 24,000 fake accounts to generate over 16 million chat interactions.
• Distillation itself is a legal and common technique; the issue has never been with "distillation," but with "secretly distilling others'."
• Anthropic's Fable model was only released on July 1, yet K3 was launched on July 16—the timeline itself is the biggest red flag.

"Quite good" hides so much thought.

First, let's look at the facts.

On July 21, 2026, Greg Brockman was interviewed by Bloomberg and said that Kimi K3 is a "pretty good model."

This sentence isn't long. But it's heavy.

The president of a leading U.S. laboratory publicly acknowledged that a Chinese competitor is doing well—something that would have been almost unthinkable in the past. When was the last time you heard someone from OpenAI praise a Chinese model?

He immediately added that it is still too early to determine whether Kimi distilled OpenAI’s model, and OpenAI will continue monitoring.

Too early. These two words are interesting.

It’s not “not there,” not “we checked,” it’s “too early.” It neither denies nor confirms. It’s like a half-open door—wind can blow either way.

He also cited an estimate that the gap between Chinese and U.S. models may now be as little as four months.

Four months.

A year ago, people were talking about "two years" or "three years." Now it's four months. Do you see this as praise or a warning? I lean toward the latter—because just hours after he said this, the White House had already struck.

The White House moved first, while OpenAI remained restrained.

On the same day, Michael Kratsios, Director of the White House Office of Science and Technology Policy, publicly accused Moonshot AI of large-scale distillation of U.S. AI models. An even more serious allegation was made—that Moonshot AI allegedly obtained banned NVIDIA GB300 servers through a Thai intermediary, "likely for model training."

The GB300 belongs to NVIDIA's Blackwell series and is subject to export restrictions against China. If this statement is true, it points not merely to intellectual property issues, but to export controls.

Almost simultaneously, Treasury Secretary Scott Bessent stated on X: "Open source is not an open season on American intellectual property." He said that if Chinese companies carry out "covert, industrial-scale distillation attacks" that cross the line into intellectual property theft, then sanctions and the Entity List "will be on the table," and could be implemented within weeks.

Do you see the misalignment here?

The government is calling for sanctions, but OpenAI's president says it's "too early."

The posture of a victim was even milder than that of the government. This is not surprising. Brockman brought the topic back to OpenAI’s compute investments—he said the U.S. has a “huge advantage” because it has poured billions of dollars into compute; open-source models are not truly free, as running them at scale still requires prohibitively expensive hardware.

He didn’t even side with the White House on the question of whether to ban Chinese models. He said open source is crucial for the "democratization of AI"—a stance that aligns more closely with Jensen Huang, who directly praised Chinese open-source models as "excellent" and urged the government to allow U.S. companies to use them.

So in this drama, the government is the angriest, while the lab—supposedly the most injured—is the calmest. Why? Keep reading.

What is distillation really: it has always been legal

First, clarify the technical aspects—don't get led astray by the words "attack."

Model distillation can be traced back to the 2015 seminal paper by Hinton et al., "Distilling the Knowledge in a Neural Network." The core idea is straightforward: train a smaller model to learn from the outputs of a larger model. The large model acts as the teacher, and the small model as the student. By imitating not only the teacher’s predictions but also its probabilistic confidence distribution—even its "hesitation"—the student can achieve performance close to the teacher’s while using significantly fewer resources.

Is this theft? No.

Frontline labs do this every day. OpenAI itself offers API-based model distillation services to help clients compress large models into smaller, more affordable versions. This is an industry-standard optimization technique.

So the issue has never been about "distillation."

The question is: Whose are you steaming? Have you obtained permission?

Self-optimization is called improvement. But using fake accounts to bypass restrictions and train on models others won’t sell you—that’s an entirely different matter. This is the real line where all the controversy lies.

The report from Anthropic is the real knockout blow.

If the White House's allegations rely on wording, Anthropic is presenting data.

In February 2026, Anthropic released a report naming three Chinese labs—DeepSeek, Moonshot AI, and MiniMax—stating that they launched an "industrial-scale" distillation campaign to illegally extract capabilities from Claude.

The numbers are specific: approximately 24,000 fraudulent accounts and over 16 million conversation interactions.

Breaking it down makes it even more striking: DeepSeek has over 150,000 evaluations, primarily targeting reasoning capabilities and reward-model-style scoring tasks; Moonshot has over 3.4 million evaluations, focused on agent reasoning, tool invocation, programming, and computer vision; MiniMax leads the pack with over 13 million evaluations, concentrated on agent programming and tool orchestration.

Anthropic says it attributes activity based on IP addresses, request metadata, and infrastructure characteristics. Some account metadata even matches publicly available information about the lab's senior employees.

It also describes how the other party circumvents the blockade: Anthropic does not offer commercial access to Claude in China for national security reasons. In response, these labs resell access through commercial proxy services, using an architecture called the "Hydra Cluster"—deploying tens of thousands of fake accounts, so that when one is blocked, another is immediately substituted. One proxy network manages over twenty thousand fake accounts simultaneously.

The most dramatic moment: Midway through MiniMax’s distillation effort, Anthropic released a new model. Within 24 hours, the other side reversed course, redirecting nearly half their traffic to evaluate the new system’s capabilities.

This is not clumsy plagiarism. This is an organized, rhythmic, and adaptive action.

Of course, this is solely Anthropic’s claim. Among the three Chinese companies, Moonshot AI has yet to respond directly. A single piece of evidence is insufficient to establish guilt. However, the density of details in this report makes it difficult to dismiss as baseless.

But the timeline has once again cast doubt on the distillation theory.

If things ended here, it would seem one-sided. But don’t rush— the opposition has some strong arguments too.

Some experts have questioned: It doesn't make sense that K3 was primarily built by distilling Anthropic's Fable.

Why? Because Fable is not publicly available until July 1, 2026, while K3 is released on July 16.

There are only fifteen days in between.

You expect to generate massive amounts of high-quality data using fake accounts, clean, train, align, and evaluate it all within fifteen days, and then produce a 2.8-trillion-parameter MoE large model? This essentially defies the physical realities of training.

K3 itself is no small feat. With 2.8 trillion parameters, a mixture-of-experts architecture, and routing each token to only 16 out of 896 experts, it supports a 1 million token context window and employs its proprietary Kimi Delta Attention. Within 24 hours of its release, it topped the front-end programming leaderboard on Arena, surpassing the flagship models from Anthropic and OpenAI.

Can something like this really be copied out in half a month?

My assessment is: distillation may well be real, but attributing all of K3’s capabilities to distillation is a lazy narrative. An architecture that reaches the top of the leaderboard must be backed by substantial proprietary engineering. Distillation might be an accelerator, but it’s not the engine.

So why are people still fixated on "distillation"?

Because the term "distillation" is just so useful.

To U.S. labs, it’s a fig leaf. When a Chinese open-source model approaches or even surpasses your flagship—at a fraction of the cost—how do you explain to investors the billions, even hundreds of billions of dollars in compute expenses?

It’s much easier to accuse someone of stealing than to admit you’re overpriced.

A key sentence in Anthropic’s report states: Without visibility into these "attacks," the rapid progress observed in these labs could be mistakenly interpreted as evidence that export controls are ineffective.

Progress is real, but don't think the blockade is useless—they just copied us.

This logic provides justification for further tightening export controls. Chip restrictions not only limit direct training but also constrain the computing power needed for large-scale distillation—so controls should be tightened, not relaxed.

Look, the true beneficiary of the distillation narrative is the policy direction of "continued blockade." It has elevated a business competition to the level of a national security issue—proof of which is the Treasury Department directly engaging in discussions about sanctions.

Brockman’s overlooked statement is the endgame.

After all the debate about distillation, I actually think Brockman should be remembered not for being "too early," but for another quote.

He said that the key to future competition is not whether the model is open-source, but who can accomplish tasks at a lower cost.

This undermines the very foundation of the entire debate.

Because if the decisive factor is cost, then the question "Are you distilling me?" becomes less important. What matters is: who can do the same thing more cheaply.

This is precisely the focus the Chinese lab has been aggressively pursuing this year. From DeepSeek’s price cut at the beginning of the year to K3 matching flagship models at a fraction of the cost—they’ve never been fighting “I’m smarter than you,” but rather “I’m cheaper than you.”

Brockman attempted to hedge by saying, "Open source isn't truly free—it still consumes hardware to run." He's right. The inference costs of open-source models are indeed substantial.

But he also acknowledged a colder reality: the model layer is being commoditized.

Commodification means the model itself is no longer a moat. It means everyone’s capabilities are converging, with only a four-month gap remaining. It means what’s truly valuable is computational power, applications, and the engineering ability to drive costs to the floor.

Ultimately

The outcome of this lawsuit will not be decided in the short term.

Anthropic has data, but it is one-sided evidence. The White House has allegations, but they resemble policy tools more than factual claims. Moonshot remains silent, but silence does not equate to guilt. And K3’s timeline undermines the "pure distillation" theory.

The truth is most likely a middle ground: distillation may have occurred, but it doesn't explain everything; self-developed models are indeed powerful, but they aren't necessarily spotless.

But have you noticed that, in the end, everyone is avoiding the same question—

When a model can catch up in four months at a fraction of the price, does it even matter whether it was copied?

Who stole the spark is no longer the key issue. The key is that the fire has now reached everyone’s yard. And those standing at the door shouting, “This fire is mine,” actually have very little water in their hands.

Too soon to conclude. Brockman is right.

But the truth isn't that the answer came too early—it's the acknowledgment that the moat, once so wide it seemed endless, is visibly shrinking.

Reference materials

1. Bloomberg, "OpenAI President Says Kimi K3 'Pretty Good,' Unsure If Distilled," 2026-07-22.
2. The Next Web, "OpenAI's Brockman Says Kimi K3 Is 'Pretty Good,' Won't Confirm Distillation," 2026-07-22.
3. TechCrunch, "Treasury threatens sanctions after White House claims Moonshot distilled Anthropic's Fable," 2026-07-22.
4. Anthropic, "Detecting and Preventing Distillation Attacks," 2026-02.
5. CNBC, "China's Moonshot AI unveils Kimi K3 that rivals OpenAI and Anthropic," 2026-07-17.
6. Axios, "China just erased America's AI lead," 2026-07-17.
7. MarkTechPost, "Moonshot AI Releases Kimi K3: A 2.8 Trillion Parameter Open MoE Model with Kimi Delta Attention and 1M Context," 2026-07-16.
8. Hinton, Vinyals, and Dean, "Distilling the Knowledge in a Neural Network," 2015.