US Says China's Moonshot Distilled Anthropic's Fable to Build K3

What happened

The Trump administration has formally accused a major Chinese AI company of stealing from one of America's most advanced AI systems. Michael Kratsios, the White House's top science and technology official, said on July 22 that the US government has information that Moonshot AI "distilled Anthropic's Fable for the development of its K3 model," and that Moonshot built an internal platform capable of switching between access methods specifically to avoid detection 161018. Kratsios added that Moonshot had acquired servers equipped with Nvidia's restricted GB300 Blackwell chips and had accessed such hardware in Thailand, "likely to train its AI models" 1018. Treasury Secretary Scott Bessent said separately he was weighing whether to add Moonshot to a trade blacklist and impose sanctions 1812.

The allegations followed Moonshot's release of Kimi K3 on July 16, a 2.8-trillion-parameter open-weight model the company bills as the largest of its kind 14151618. K3 posted strong results across coding, agentic and reasoning benchmarks — 93.5% on GPQA Diamond, 91.2% on BrowseComp, 88.3% on Terminal-Bench 2.1, and a GDPval-AA v2 Elo score in the high 1,600s depending on which version of the table is cited 141517. Moonshot itself acknowledges the model trails Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol on most overall measures, even as it leads on select individual tests 1517. Coverage of K3's debut generally described it as narrowing the gap between Chinese open-weight systems and the leading US proprietary models 1118.

China rejected the accusation outright. Chinese embassy spokesperson Liu Chang called the claims "entirely unfounded" and said Beijing takes intellectual-property protection seriously, urging US officials to "stop smearing" China's AI progress 1218. Anthropic's public-policy executive Sarah Heck took the opposite position, saying Chinese theft of US models poses serious national-security risks 18.

The February precedent

The July accusation did not emerge from nothing. In February, Anthropic disclosed that it had detected industrial-scale "distillation attacks" by three Chinese labs — DeepSeek, Moonshot and MiniMax — which together generated more than 16 million exchanges with Claude using roughly 24,000 fraudulent accounts 17181920. Anthropic attributed more than 3.4 million of those exchanges specifically to Moonshot, saying the campaign targeted agentic reasoning, coding, computer-use agent development and computer vision, and that a later phase attempted to reconstruct Claude's reasoning traces 1320. Anthropic said it identified the perpetrators with high confidence through IP correlation, request metadata, infrastructure indicators and, in some cases, corroboration from other companies observing the same behavior 19.

That disclosure is real and detailed, but it describes a different thing than the July claim. February's campaign was about general Claude access; Fable 5 did not launch publicly until June 9, months later 1213. Evidence of a prior extraction campaign does not by itself establish that Fable 5's outputs specifically trained K3.

Why the timeline is the crux of the dispute

Fable 5 was released on June 9, briefly suspended around June 12 amid a separate national-security-driven export action, and restored globally around July 1 1213. K3 launched just over two weeks later, on July 16 1318. That compressed window is central to why AI researchers are divided. Nathan Lambert, an AI researcher who writes the Interconnects newsletter, said he was skeptical that Fable 5 was distilled directly into K3, partly because Fable carries some of the industry's tightest usage restrictions 12. Ben Hayum of the Center for a New American Security offered a more permissive read, noting Chinese labs often ship models quickly after training concludes, which could leave enough time for targeted use of Fable outputs even within a short window 12.

The distinction researchers draw is between wholesale replication — building K3's base model largely from Fable's outputs, which the timeline makes very difficult to credit — and targeted post-training, where an already-substantially-built K3 could have incorporated some teacher-generated data from Fable during a later fine-tuning stage 1213. Moonshot has pointed to its own architectural work, including Kimi Delta Attention and an Attention Residuals technique described in a March technical paper that predates Fable's release, as evidence the model's gains come from original engineering rather than copying 1213. A Moonshot executive, Huang Zhenxin, told a Chinese outlet on July 21 that K3's performance leap reflects foundational architecture, not distillation of an existing model 1213.

Where the reporting agrees

Across Reuters, the BBC, the South China Morning Post, Yahoo's aggregation of Reuters copy, and independent AI-focused outlets, the base facts are consistent: Kratsios made the distillation allegation on X on July 22; he tied it explicitly to K3 and Fable; he separately alleged Moonshot obtained and used restricted Nvidia GB300 chips in Thailand; and no outlet reports that Kratsios or Anthropic has published logs, datasets or forensic evidence directly linking Fable outputs to K3's training 161011121318. Every outlet that addresses it also agrees distillation itself is a legitimate, widely used industry technique, and that the objection is to covert, unauthorized extraction rather than the method in general 12181920. There is also consistent agreement that Anthropic's February disclosure of a 3.4-million-exchange Moonshot campaign is real, detailed and separate from the still-unproven Fable-to-K3 claim 121317181920. And multiple outlets note China's flat denial through embassy spokesperson Liu Chang, using nearly identical language about the accusation being "entirely unfounded" 1218.

Where it doesn't

The clearest divergence is in framing and emphasis rather than contradicted facts. Reuters presents the story primarily as a geopolitical escalation, foregrounding Bessent's blacklist threat and the broader US-China tech rivalry, treating Kratsios's claim largely as reported fact within that frame 118. The South China Morning Post gives substantially more space to the evidentiary gap, stating explicitly that Kratsios did not present evidence that Fable outputs were incorporated into K3, and it is the only outlet in this set to quote a named skeptical researcher (Lambert) alongside a named source offering a countervailing technical argument (Hayum) 12. The technical explainer coverage goes further still, building a scenario table that assigns explicit confidence levels to competing explanations — from full base-model distillation (rated highly unlikely given the timeline) to convergent benchmark optimization producing coincidental similarity (rated moderately plausible) 13. That level of hedging and scenario-building doesn't appear in the wire coverage, which reports the allegation more directly as the story itself.

There's also a numbers discrepancy worth flagging: benchmark tables for K3 differ slightly depending on the outlet's source — GDPval-AA v2 Elo is variously reported as 1,668 and 1,686 for K3 across different technical write-ups, and Terminal-Bench and other scores carry footnotes about differing agent harnesses and whether Fable's results reflect fallback to Claude Opus 4.8 14151617. These aren't reporting errors so much as a reminder that vendor-published benchmarks aren't standardized enough for clean cross-model comparison, a caveat several of the technical outlets flag explicitly but the wire and political coverage largely omits.

One detail appears in only a single source: the claim, made only in wire reporting citing a February comment from a senior Trump administration official, that DeepSeek's most advanced model was separately trained on Nvidia's most advanced chip in a possible export-control violation 18. That claim is adjacent to but distinct from the Moonshot allegation and isn't corroborated elsewhere in this set.

The verdict the evidence supports

Weighing the sources together, the honest reading is that Washington has made a serious, specific accusation it has not yet substantiated publicly, built atop a genuine and well-documented prior finding by Anthropic that doesn't quite prove the new claim. The February campaign is corroborated with real methodological detail — IP correlation, metadata, cross-industry confirmation — and stands on its own as evidence of past behavior 1920. The July claim about Fable specifically feeding K3 is qualitatively different: an official assertion, credible given the source, but unaccompanied by anything resembling the forensic detail Anthropic offered five months earlier. The timeline math makes wholesale replication implausible, while targeted post-training remains plausible but unproven. Until Moonshot's promised open weights are released and independently examined — and even then, weights alone likely can't settle questions of training-data provenance — this remains an allegation under investigation rather than an established fact, and the coverage that treats it that way, rather than as settled history, has the better of the argument.