Did China Steal Anthropic's Fable to Build Kimi K3?

The accusation that started it all

In late July, Washington dropped an accusation with few precedents. Michael Kratsios, the White House's top science and technology adviser, took to X and publicly accused China's Moonshot AI of conducting "large-scale, covert industrial distillation" against American AI models — specifically, of secretly extracting the capabilities of Anthropic's Fable model to build its own Kimi K3.

The charge was blunt. "Large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable," Kratsios wrote. Treasury Secretary Scott Bessent followed within hours: "Open source is not open season on American IP," he posted, warning that "when [Chinese] firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table." Under Secretary of State Jacob Helberg went further still, characterizing the alleged conduct as "a heist of invaluable American Intellectual Property."

Kratsios layered on a second allegation: that Moonshot had obtained Nvidia GB300-equipped servers — part of the Blackwell generation, banned from export to Chinese firms under U.S. export controls — and accessed them through infrastructure in Thailand. That turned an intellectual-property fight into a potential export-control violation too.

Two months later, no sanctions have landed. Moonshot has not been added to the Entity List. And the question that exploded within hours of Kratsios's post — could Kimi K3 really have been built that way? — has never been settled. Instead, the dispute has grown stranger, better documented, and more important to understand.

Shanghai's Pudong skyline at night. Moonshot AI, the Chinese lab behind the Kimi family of models, is headquartered in China — and its open-weight Kimi K3 model has become the centerpiece of Washington's distillation allegations. Photo: DvTor8303, CC0 via Wikimedia Commons (file photo).

Update, Sept. 30: the $314B market verdict.

The market has already rendered a verdict on the scandal. IG market analyst Tony Sycamore estimated that Kimi K3's release triggered a roughly $314 billion reduction in the combined pre-IPO valuations of Anthropic and OpenAI on private secondary markets — Anthropic's implied capitalization falling about 7% to $1.56 trillion and OpenAI's slipping 6% to $1.24 trillion. Meanwhile the paper trail keeps growing: Anthropic had already accused Moonshot, DeepSeek and MiniMax of violating its terms of service with thousands of fraudulent accounts back in February 2026, making September's report an escalation of a longer war. The September operation's tradecraft is unusually well documented — 5,380 accounts routed through proxy servers in Singapore and Japan, more than 23 million exchanges aimed mostly at Claude Opus, with chain-of-thought extraction the apparent target. And the political framing has shifted: China's regulator opening probes into DeepSeek and Moonshot was reported as a cooperative signal with Washington ahead of the Sept. 24 Trump–Xi meeting. In the US, the House Homeland Security Committee has been pressing DoorDash and Cursor-maker Anysphere since April over their use of Kimi models — the distillation fight now touches American companies' own engineering stacks.

What Kimi K3 is — and why it rattled Washington

To understand why the White House named a specific lab over a specific model, you have to appreciate what Kimi K3 did to the industry when it appeared in mid-July. Moonshot released it as an open-weight, 2.8-trillion-parameter mixture-of-experts model with a 1-million-token context window. TechCrunch reported that its benchmarks placed it ahead of every major model except Anthropic's Fable and OpenAI's GPT-5.6 — meaning anyone, anywhere, could download a model nearly as capable as the best American systems and run it for free.

That is precisely what made it politically explosive. If near-frontier AI capability can be obtained at a fraction of the cost — and distributed as a free download — it raises an uncomfortable question for the U.S. strategy of outspending everyone on frontier compute: what exactly is the moat protecting billions of dollars of American AI investment?

K3's commercial footprint has only grown since. Bloomberg reported in September that Moonshot is targeting $2 billion in annualized revenue by year's end — double its August run rate — and OpenRouter data showed as many as 300 billion tokens being generated daily by K3 models. Microsoft, Amazon, and Google have reportedly explored revenue-sharing deals to host the model on their clouds. A model that good, that cheap, and that open was always going to become a geopolitical object.

The timeline problem the experts won't let go

The core of the expert pushback is brutally simple: the calendar.

Anthropic's Fable 5 was announced in early June with built-in safeguards that downgraded suspected distillation traffic to an older model, Claude Opus 4.8. According to the South China Morning Post, the company then took Fable 5 offline at Washington's direction and re-released it on July 1. Moonshot launched Kimi K3 in mid-July. That left, at most, roughly two weeks between Fable becoming publicly available and K3 appearing.

"I don't think you get a model this strong and this quickly on the heels of Fable doing strictly distillation," Braden Hancock, a researcher at the Laude Institute and co-founder of Snorkel AI, told TechCrunch. "There's just not even frankly time, right? Fable's only been publicly available since July 1st. You can't distill that much data, train a model, and release it in two weeks."

AI researcher Nathan Lambert reached a similar conclusion: distillation from Claude is "clearly part of the story" but "clearly nothing close to the whole story," he said, noting K3 still trails the closed-model frontier by several months despite its benchmark showing.

A Moonshot employee, Randy Xian, captured the technical objection with deliberate sarcasm on X: "Yes, Fable went public on July 1 and K3 launched on July 15. We trained a brand new frontier model in JUST 15 DAYS. Guinness World Record stuff."

Global AI researchers went further, calling the accusations "political" and "reckless" and pointing out an uncomfortable legal fact: an AI model's outputs are generally not protected by copyright, which makes the word "theft" legally contested from the start. The South China Morning Post reported that experts argued distilling a model's outputs is a standard, industry-wide practice — not something Moonshot invented.

What "distillation" actually means — and why "theft" is contested

This is where the debate gets genuinely technical, and where readers deserve more than the press-release version. Distillation is one of the oldest tricks in machine learning: you take a large, powerful "teacher" model, feed it millions of prompts, and use its answers to train a smaller or cheaper "student." It is how the industry builds efficient models, and nearly every major lab does it openly.

What Anthropic calls illicit distillation is something narrower and uglier: an "industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization" — enabled by fraudulent accounts, stolen credentials, and, in the most serious cases, secretly routing one company's customers' requests to a competitor's model and presenting the answers as your own.

That distinction matters. The White House's accusation treated distillation as self-evidently illegitimate. The expert response has been that this misrepresents how modern AI gets built everywhere — including in the United States. As the deep-learning newsletter The Batch put it: "You can't distill your way to a frontier model." The labs Anthropic has accused, it noted, have achieved significant technical breakthroughs — many published openly — that were critical to their competitive models. The claims that Chinese labs' strength "stems solely from distillation" create, in its words, "a mistaken impression."

Illustration of a neural network. Distillation — training a new model on the outputs of an existing one — is a standard industry technique; what turns it into "IP theft" is one of the most fiercely contested questions in AI policy right now. Illustration: mikemacmarketing, CC BY 2.0 via Wikimedia Commons.

The new evidence: what September added to the file

If the July accusations were long on rhetoric and short on proof — Kratsios, notably, published no technical evidence alongside his claims — September brought a much thicker evidentiary record. It just wasn't the record the White House's version of the story needed.

On September 9, the NSA, CISA, and FBI issued a joint cybersecurity advisory accusing six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of extracting "billions of tokens across millions of exchanges" from American frontier models since 2024, using proxy services and multiple accounts to evade detection. The agencies specifically said Moonshot extracted "significant" data from Claude's Fable to train Kimi K3, and that Kimi K2 used GPT-4o data.

A day later, Anthropic published a 154-page threat intelligence report with numbers: close to 200 million instances of what it called malicious access. Alibaba, it said, made 151 million exchanges between May and July; Moonshot made 23 million. Most strikingly, Anthropic alleged that Moonshot had silently forwarded customer requests — nearly 300,000 of them over about ten days through 5,380 fraudulent accounts — to Claude instead of processing them with Kimi, displaying Claude's answers as though they came from its own model. "The user had no way of knowing that their use of Kimi was being forwarded to Claude," the report stated.

Anthropic also said the redirected traffic included genuinely sensitive material — surveillance data from cameras in Chengdu, police case-management data, even internal company credentials — data that, per the report, flowed to a U.S. AI system without the users' knowledge.

The twist: Beijing noticed. The Information reported that China's Cyberspace Administration summoned the named Chinese labs and then opened probes into DeepSeek and Moonshot specifically, examining whether sensitive Chinese police, military, and state-linked data had been transferred to U.S. AI models through the routing. In other words, Anthropic's report created a domestic Chinese enforcement problem at the same moment it fed Washington's national-security case.

Why it still matters to American readers

Strip away the diplomatic theater and the stakes for the United States are real — and unresolved in every direction.

The sanctions question is still open. Bessent has never withdrawn the threat, and officials have reportedly considered Entity List designations for months. But American companies have pushed back, warning that harsh crackdowns on Chinese model developers could hurt U.S. businesses that rely on them — a real concern now that K3-class models process hundreds of billions of tokens a day on American infrastructure.

The open-weights question is the deeper one. Former White House AI adviser Dean Ball, now leading strategic futures at OpenAI, has argued for restricting or banning Chinese open-weight models to preserve the U.S. technology lead. Nvidia CEO Jensen Huang and the U.S. open-source lab Arcee have argued the opposite: that openness serves American interests better than containment. The Trump administration, publicly at least, appears to be leaning toward the restrictive side.

And the evidentiary question refuses to die. None of the September evidence proves what Kratsios claimed in July — that Kimi K3 was built by distilling Fable in a matter of weeks. Anthropic's own report describes distillation campaigns against "generally available Claude models," attributing its largest campaigns to Alibaba and describing Moonshot's Fable-related activity as significant but not quantified the way the Opus campaigns were. The specific claim — Fable distilled into K3 — remains, to this day, an official assertion without published technical evidence.

What is not in dispute is the underlying shift: a Chinese open-weight model now sits near the top of the capability charts, costs a fraction of American models to use, and is being downloaded freely by developers worldwide — including American ones. Washington's response, from the sanctions threat to the advisory to the still-pending legislative effort to let U.S. labs coordinate anti-distillation defenses without antitrust worry, is really about that shift. The distillation allegation is the frame. The open-weights problem is the picture.

For the record, the scrutiny of Moonshot's models has not been limited to training-data questions — the Kimi family has also faced a separate round of safety scrutiny over jailbreaks that researchers said could bypass its safeguards. The distillation fight and the safety fight are different battles. Moonshot is now fighting both at once.

Sources

Reporting for this article drew on TechCrunch (July 22, 2026 sanctions report; July 23, 2026 experts piece; September 11, 2026 revenue report), the Wall Street Journal, Engadget (NSA/CISA/FBI advisory), the South China Morning Post, CoinDesk, The Information (via aiweekly.co and NDTV Profit), Bloomberg, The Batch (deeplearning.ai), and Tech Times. Direct quotes are from published interviews and official posts; disputed claims are identified as such in the text. One note on timing: the White House accusation and Treasury sanctions threat date to July 22, 2026, not recent days — this article is a status check on a live dispute, and the TechCrunch pieces referenced are the July 22 and July 23, 2026 editions.