The Information reported that DeepSeek and Moonshot AI relied heavily on OpenAI’s GPT-6 Astra outputs to train new models. The claim, relayed by Reuters, is based on people with direct knowledge of the matter; the companies did not immediately comment, according to secondary coverage. It has not been independently established.
1
3
The report names DeepSeek’s V4.1-Flash 1017 and Moonshot’s Kimi K3.1 Pro. The central issue is not access to OpenAI’s model weights, but whether one model’s outputs were used to teach another—and whether that use was authorized.
3
8
What model distillation is
Distillation is a way to train a smaller or less expensive model using outputs from a more capable model. The student model learns from the teacher’s responses; it does not need access to the teacher’s weights. OpenAI itself offers a distillation platform for fine-tuning cost-efficient models with outputs from a larger model.
34
The technique is not inherently illicit. The dispute is about how the training data is obtained and used. In OpenAI’s description, adversarial distillation involves systematically and without authorization using a model’s outputs or reasoning to train, reproduce or improve another model.
36
If a developer can reproduce some capabilities this way, it may reduce the time or expense required to build them independently. Critics argue that unauthorized extraction can reward copying and weaken the competitive advantage earned through model research and training.
6
35
What OpenAI said about a separate extraction campaign
The reported GPT-6 Astra training claim should not be treated as proof that the named models were trained using material from the separate campaign OpenAI described in September. OpenAI’s September 30 account concerned attempts to extract protected reasoning from its models; it does not, on its own, establish how the models in The Information’s report were trained.
1
36
OpenAI said the campaign’s earliest observed activity was in the first week of July. Secondary coverage reported a spike of about 16,000 requests from more than 4,000 users on July 24–25, and said OpenAI had disrupted the activity by July 28. Those figures describe requests and users, not confirmed successful extractions.
21
27
56
Coverage also described an approach involving copying encrypted reasoning from one conversation and asking a model in another conversation to render it as text. OpenAI said the operators did not break its encryption, compromise a database or directly access stored conversations.
26
36
OpenAI attributed a core cluster of activity to people associated with Moonshot AI, while saying it could not determine whether all operators belonged to one actor. CyberScoop reported that OpenAI did not provide public technical evidence for the Moonshot attribution, so that part of the account cannot be independently verified from the disclosed evidence.
18
32
Anthropic’s safeguards and claims
In an October announcement, Anthropic said its safeguards had reduced the amount of data harvested by distillers by about 90%–99%. It separately reported that extracted reasoning tokens were 10 to 100 times lower after a classifier was introduced; these are two different measures.
33
Anthropic also said Zhipu had distilled cyber capabilities from leading U.S. models while developing GLM-5.3. That statement is Anthropic’s allegation; the available information does not establish that this specific claim was about Claude.
33
Why the dispute matters—and what it does not prove
The concern for model developers is that a competitor could gain useful capabilities without making a comparable investment in training and research. The safety concern is that capability copying may not carry over the original developer’s safeguards. Anthropic has framed illicit distillation as a way to copy frontier capabilities without creating proportionately robust protections.
35
37
Those are risks raised by the companies and in reporting—not proof that DeepSeek’s or Moonshot’s reported models are equivalent to GPT-6 Astra, that a specific contract was breached, or that a particular harm occurred. The key distinction is between distillation as a training technique and the contested practices used to obtain or reuse another model’s outputs.