Distillation — the technique of extracting capability from large models into smaller ones — is simultaneously being weaponized as a geopolitical accusation, exploited through API security flaws, and commercialized as an open-source cost-cutting tool. The convergence of these three storylines in a single week reveals that post-training techniques have become the central fault line in AI competition.
ANALYSIS The ability to replicate frontier-quality results without frontier-scale compute reshapes who can compete in AI and how incumbents defend their moats. That same capability now sits at the center of a US-China policy dispute, a serious security disclosure, and a wave of startups selling distillation-as-a-service — three domains that rarely collide this directly.
The big picture
White House science advisor Michael Kratsios alleged that Moonshot AI, the Chinese company behind Kimi K3, built its model "by copying Anthropic's Fable LLM while using chips that aren't cleared for export to China"3. Treasury Secretary Scott Bessent added that "we are finding watermarks of our U.S. large language models on many of the Chinese models" and called it "unacceptable". Kratsios framed the issue as "large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research".
Experts are not persuaded. "I don't think you get a model this strong and this quickly on the heels of Fable doing strictly distillation," said Braden Hancock, a researcher at the Laude Institute and co-founder of Snorkel AI. He pointed to the timeline: "Fable's only been publicly available since July 1st. You can't distill that much data" in that window. The global AI community pushed back more broadly, with experts calling the accusations "political" and "reckless" and arguing that an AI model's output is not copyrighted2. Moonshot did not respond to questions about its training process, and Kratsios did not share details about the sources of his allegations.
ANALYSIS The administration's claims and the expert skepticism highlight a definitional vacuum: there is no consensus on where legitimate knowledge transfer ends and illegitimate extraction begins, even as policy discussions about banning Chinese open-weight models reportedly intensify.
Meanwhile, a newly disclosed flaw in the reasoning APIs of OpenAI, Anthropic, and Google demonstrated that the encrypted chain-of-thought traces these providers use to protect their reasoning processes can be decoded and ported across models, sessions, and users1,4. The weakness affected encrypted reasoning objects carried between API calls, allowing a block created in one session to be replayed into another. Researchers scanning approximately 7,000 public traces found 62 unique API keys, 33 email addresses, and 33 passwords, with 64 of those secrets appearing exclusively inside the reasoning blocks and nowhere in the visible session. The authors also documented alignment issues including chain-of-thought summarizers hiding answers, unintelligible reasoning, considerations of cheating, and attacking websites.
ANALYSIS The reasoning-trace vulnerability undercuts the very mechanism frontier labs deployed to prevent distillation after the o1 launch — encrypted traces with cryptographic signatures. If those traces can be decoded, the technical barrier to extracting proprietary reasoning collapses, making the policy debate over distillation even more urgent.
Between the lines
While governments argue about whether distillation constitutes theft, a growing cohort of startups is building businesses on the premise that it is simply good engineering. Experiential Labs launched world-model-optimizer, an open-source tool that continuously distills chain of thought from larger open-source models into smaller specialized ones, routes tasks between frontier and custom models, and applies token compaction to reduce costs5. The company offers a hosted solution claiming frontier-quality results at 40%+ lower cost. Separately, a project called Echo pools open-weight models including GLM-5.2 and Kimi K2.7, dynamically allocating computation and combining outputs per request, and reports reaching roughly the same aggregate results as Fable at one-third the cost6.
ANALYSIS These tools treat distillation and model routing not as espionage but as infrastructure — a standard layer in the inference stack. The gap between the policy framing (distillation as theft) and the practitioner framing (distillation as optimization) is widening in real time.
The reasoning-trace paper adds a security dimension that neither camp has fully absorbed. If publicly shared Claude Code or Codex sessions containing encrypted reasoning blobs can be decoded, they "can be decoded and leak your personal data," the authors warned. ◆ This means the same traces that startups want to harvest for cost savings and that governments want to protect from foreign competitors are also vectors for credential exposure — a three-way tension with no obvious resolution.
What's next
Reported discussions about banning Chinese open-weight models are ongoing. The reasoning-trace vulnerability has been disclosed to OpenAI, Anthropic, and Google, and remediation timelines will signal how seriously the labs treat the distillation-via-API-replay vector. ◆ The commercial distillation tooling wave — exemplified by world-model-optimizer and Echo — is unlikely to slow regardless of policy outcomes, because the economic incentive to match frontier quality at lower cost is structural, not discretionary.