DeepSeek and Moonshot Copied GPT-6 Astra. You Pay For It.

DeepSeek and Moonshot Got Caught Copying GPT-6 Astra. Your AI Bill Is Why.

Two labs. Two model releases. One company on the other end of the pipe that did the actual work.

On 28 October, The Information reported that Moonshot AI used OpenAI’s GPT-6 Astra as a training source while developing Kimi K3.1 Pro, and that DeepSeek drew on the same model while building its V4.1-Flash 1017 version. Moonshot’s release came last week. DeepSeek’s shipped on the 17th. Both models are already in the wild, on price lists, on comparison charts, and inside the tool stacks of people who will never read this paragraph.

That last detail is the one that matters. By the time the accusation surfaced, the products were finished. This is not a story about a leak being plugged. It is a story about a bill arriving after the goods left the warehouse.

Let me be precise about what is being alleged, because the word “copying” does a lot of lazy work here.

What a Distillation Attack Actually Is

Distillation is not hacking. Nobody breaks a firewall or steals a checkpoint. The method described is duller and far more effective: proxy services, tens of thousands of fake accounts, and a script that asks the same questions over and over, harvesting the answers.

Ask a model several million carefully chosen questions and you get something more valuable than its source code. You get its behaviour. You get how it reasons through a proof, how it structures an explanation, where it hedges, how it handles a badly worded prompt. Train a smaller model on those answers and it learns to think in the shape of the model that produced them, without ever touching a weight.

OpenAI and Anthropic both use distillation internally. Every cheap, fast “mini” tier you buy is a distilled version of something bigger and slower. That is legitimate. It is done inside one company, with one set of books, one engineering team, and one set of permission slips.

The contentious part is the outside version. Neither OpenAI nor Anthropic sells model access inside China. So the accounts doing the querying are not customers. They are instruments, and the traffic is a proxy for a competitor’s R&D line item.

The Reason the Target Moved From Claude to OpenAI

Here is where the story stops being a series of isolated incidents and becomes a pattern with a mechanism.

Until recently, the most aggressive distillation traffic pointed at Anthropic’s Claude. Then Anthropic hardened its defences. In September it published details of what it called coordinated distillation campaigns and named Alibaba, Moonshot AI and DeepSeek. Earlier this month it said the new restrictions on access to Claude’s reasoning process had cut extraction attempts sharply, and that the volume of reasoning data pulled by distillation attempts had fallen to between one-tenth and one-hundredth of previous levels.

Read that comparison again. Not a ten percent improvement. One-tenth to one-hundredth. Anthropic did not make distillation illegal. It made distillation expensive, and expensive is the only word that matters in this market.

So the traffic moved. According to the reporting, the labs turned to OpenAI, described as relatively easier to probe. That is not a compliment to OpenAI’s engineering and it is not a moral failing either. It is the arithmetic of an attacker deciding where the effort-to-yield ratio is best.

Anthropic, for its part, says it made it harder for attackers to use its systems for distillation. Note the phrasing a vendor chooses in a fight like this: hard. Not impossible. Hard.

That last row is the one nobody talks about, and it is the most expensive thing in the table. A distilled model inherits the behaviour of its teacher and none of the understanding. When the teacher changes, the student has no fallback. It cannot debug itself, because it never knew why it worked.

The Two Models in Question, and What They Cost to Make

Kimi K3.1 Pro arrived last week. DeepSeek’s V4.1-Flash 1017 landed on the 17th. Both are positioned as capable models at prices that make Western labs uncomfortable. Both are now under a cloud that will not lift quickly, because the reporting is specific enough to be checkable and vague enough that no one will ever produce a clean receipt.

The cost comparison that keeps surfacing in this fight is worth stating plainly, because it explains the motive better than any moral argument. DeepSeek said last year that training its initial model cost roughly $6 million. OpenAI’s GPT-4 is estimated to have cost about $100 million to develop. Even allowing for the usual creative accounting in both numbers, that is a gap of an order of magnitude, and no honest business reader needs a lecture about why a shortcut looks attractive across a gap that wide.

Now put yourself on the buyer’s side of that gap. You are not DeepSeek. You are a 12-person business paying $40 a month per seat for a tool. The model inside that tool was assembled by a chain of suppliers, and one link in the chain may have been harvested rather than built. You cannot audit that chain. You can only read the terms of service and hope the vendor above you did the same.

Jensen Huang Called It Competition. Washington Called It Theft.

The split inside the industry is worth understanding because it tells you what the next twelve months of policy will look like.

Nvidia chief executive Jensen Huang, appearing on CNBC, was asked whether distillation amounts to robbery. He replied that it is called competition, and added that anyone should be able to test somebody else’s product as comprehensively as they want. His argument, stripped down: Nvidia’s own products get reverse-engineered to the bone by rivals, that is the price of being the leader, and competition is what forces the next improvement.

The other side is not subtle. The Cybersecurity and Infrastructure Security Agency described an industrial-scale distillation campaign in violation of US companies’ terms of service. Treasury Secretary Scott Bessent called the practice theft in July and threatened sanctions against foreign companies that extract capabilities from US-built models. And the administration moved to ban DeepSeek products from federal government systems, which turns a technical complaint into a procurement rule.

Both positions are internally consistent, which is why neither will win outright. Huang is describing how hardware markets have always worked, where a rival can buy your product and take it apart. Bessent is describing a service market, where taking the product apart is not the same as buying it. A graphics card can be bought once and studied. A model can be queried a million times without a single purchase.

What This Means If You Are Buying AI Tools, Not Building Models

You are not going to be named in a distillation report. You are, however, going to inherit the consequences, and they arrive in three forms.

The first is pricing instability. If the competitive advantage of a supplier was extracted rather than engineered, its cost base is a rental, not an asset. When the source hardens, the rental stops. Prices at the cheap end of the market move fast in both directions, and the business that built its workflow on the cheapest option discovers that its floor moved.

The second is reliability drift. A model that learned behaviour without the reasoning behind it degrades in exactly the situations you need reliability most: a long multi-step task, an unusual edge case, a prompt phrased badly by a tired employee. It answers confidently and wrongly. You cannot see the seam, which is precisely the problem.

The third, and the one with real legal teeth, is your own contract exposure. If you run a service that resells or wraps model output, and your supplier’s model turns out to have been trained on extracted data, your indemnity position depends entirely on what the supplier warranted to you. Most small-business AI contracts warrant very little. Read the one you signed.

Those four questions are not paranoia. They are the difference between renting capability and owning a workflow. If a supplier cannot answer them, you have found your concentration risk, and you have found it before it cost you a quarter.

The Honest Counterargument

There is a version of this story where nothing bad happens to you at all, and it deserves an airing.

Distillation produces genuinely good small models. Some of the cheapest, fastest tools on the market exist because distillation works, and they let a five-person business do work that used to require a team of nine. If the technique is banned outright and enforced hard, the first casualties are the cheap tiers that small businesses depend on. That is not a hypothetical. It is the direct consequence of making extraction expensive, and Anthropic’s own numbers show that hardening a model cuts the extracted volume by ninety to ninety-nine percent.

The reasonable position is not “distillation is evil”. It is “distillation without permission is a breach of contract with a measurable victim, and the buyer should know which side of that line their supplier sits on.” That is a narrower claim than Washington’s and a more useful one than Huang’s.

What I Would Do This Week

Three things, none of which require you to understand a single line of the research.

Name your models. Go into every AI tool you pay for and write down the underlying model and version. If the vendor will not tell you, that is a data point. Tools that hide the model are usually reselling somebody else’s capability with a margin on top, and resellers carry the most exposure when a supplier changes terms.

Pin your versions. If a tool silently updates its model behind your workflow, you have no reproducibility and no way to explain a quality drop to a client. Version pinning is boring, and boring is what protects a quarter.

Diversify the critical path. Not every tool needs a backup. The two or three tools your revenue actually runs through do. If one of them depends on a model under an unresolved legal cloud, that is your risk register, and it belongs at the top of it.

The labs will fight this out in courtrooms and procurement offices for years. You will not be in the room. But the price you pay and the reliability you get are decided by how that fight resolves, which makes it your story whether you asked for it or not.

Frequently Asked Questions

Did DeepSeek and Moonshot actually steal OpenAI’s model?

They are accused of distillation, not theft of source code. The allegation is that they used proxy services and large numbers of accounts to query GPT-6 Astra repeatedly and trained their own models on the answers. OpenAI’s terms prohibit that. Whether it constitutes theft is a legal question that has not been settled in court.

What is model distillation in plain English?

Training a smaller model on the outputs of a bigger one so it learns to imitate the bigger model’s behaviour more cheaply than building that capability from scratch. Every major lab does it internally. Doing it to somebody else’s model without permission is what the dispute is about.

Why did the target shift from Claude to GPT-6 Astra?

Because Anthropic hardened Claude. Anthropic says new restrictions on access to Claude’s reasoning process cut extracted data volume to between one-tenth and one-hundredth of previous levels. Attackers then moved to the model that was relatively easier to probe.

Does this affect the AI tools I already pay for?

Possibly, through price and reliability rather than through any direct legal exposure. If a cheap tool depends on a model whose training is under dispute, that tool’s cost base and quality are less stable than its marketing implies. Ask your vendors which model and version they run.

Is distillation always illegitimate?

No. Internal distillation is standard engineering and it is why cheap, fast model tiers exist. The problem is permission and terms of service, not the technique. The line is whether the model owner agreed.

What should a small business do about it right now?

Name the models behind your tools, pin the versions you rely on, and add a backup for the two or three tools your revenue runs through. That is a week of admin, and it is the only part of this story you can actually control.