The target shift
Chinese artificial intelligence labs have reportedly shifted their sights from Anthropic's models to what The Decoder, citing The Information, identifies as OpenAI's most powerful model, GPT-6 Astra. According to the account, DeepSeek and Moonshot AI made extensive use of Astra's outputs to train their latest models. Among these, Kimi K3.1 Pro and V4.1-Flash 1017 are mentioned. The news is significant because it signals a change in the strategies of those seeking to catch up on advanced capabilities by exploiting others' work, and because it shifts attention to OpenAI after a phase in which Claude was considered the preferred target.
The information comes from people familiar with the matter and is reported by the source: it is therefore not an official confirmation from the companies involved. Moonshot declined to comment, and DeepSeek did not respond to a request for comment. OpenAI, for its part, said it takes the problem very seriously.
Why distillation requires hidden reasoning
The mechanism described is distillation: to work, it requires labs to be able to obtain from the reference model the reasoning steps that normally remain hidden. Both OpenAI and Anthropic prohibit this type of access. This is where the target shift comes in: Anthropic reportedly strengthened its defenses, and according to the company, the new methods would reduce by 90–99% the amount of data attackers can extract. A figure stated by the company, not independently verified by the source.
This dynamic explains why the phenomenon does not end with a single case. If a provider's defenses make extraction more difficult, those seeking to distill can turn to another model. However, the comparison between the two providers is based on statements and anonymous sources, not on a public comparative measurement.
OpenAI's alarm and the limits of the account
At the end of September, OpenAI had reported a coordinated distillation campaign that, according to the company, involved people linked to Moonshot. An OpenAI spokesperson added that so far attackers have changed their tactics every time a new defense was introduced. It is a statement that indicates a structural difficulty: countermeasures can be circumvented, and the problem tends to move rather than be resolved.
Several elements remain to be verified. The source does not specify how access to the reasoning steps would have occurred, nor does it quantify the extent of the use of Astra's outputs. It is not indicated whether OpenAI has initiated formal actions beyond reporting the September campaign, nor whether the models cited have already been distributed. The account is based on anonymous sources and on one outlet citing another, without primary documentation. The scale of the phenomenon and its relevance to model security therefore remain to be established, while the picture that emerges is one of a competition in which technical defenses and access strategies chase one another.
