White House’s Response to China Lacks Confidence in America
Are you more confident in America or fearful of China?
Hey, Alberto here! 👋 Each week, I publish long-form AI analysis covering culture, philosophy, and business. Paid subscribers get Monday how-to guides and Friday news commentary. If you’d like to become a paid subscriber, here’s a button for that:
My take on the current situation between America and China on AI.
Some news on Moonshot’s K3: the White House has concluded that Moonshot AI, the company that’s achieved notoriety after the release of Kimi K3, used a sophisticated attack to exploit the superior performance of Anthropic’s Fable.
This is a serious offense that could prompt measures to restrict Chinese AI in some way. Here’s the announcement, published on X by Michael Kratsios, Office of Science and Technology Policy director, presented without any evidence whatsoever:
We have information that Moonshot AI distilled Anthropic’s Fable for the development of its K3 model.
To do this they developed a sophisticated internal platform to conduct large scale distillation against U.S. models, allowing them to quickly switch between multiple methods of access to avoid detection. Moonshot AI has also acquired GB300-equipped servers and has accessed GB300s in Thailand, likely to train its AI models.
The United States strongly supports the free and fair development of AI, including a thriving competitive ecosystem that spans frontier models, specialized systems, open-source frameworks, and open-weight models. Legitimate AI distillation used to create smaller, more efficient models plays a vital role in this open innovation ecosystem. However, large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable.
And here’s Treasury Secretary Scott Bessent:
We support open-source AI and the innovation it unlocks. But open source is not open season on American IP. When PRC firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table.
If the accusation of distillation and IP theft are true, this means that Moonshot needed American models to exist in the first place to achieve such impressive performance with K3. In other words, China can ride on America’s slipstream but perhaps not make its own.1
Many people dismissed the possibility of a distillation attack right after learning about Kimi K3’s benchmark scores. It was superior to Fable in a few of them, which indicates genuine prowess. After all, you can’t distill a teacher model into a better student model. I saw merit in this view, but I was careful to take a more nuanced stance: maybe distillation did take place, and, on top of that, Moonshot is a company of great talent and hard-working people.
Those two things aren’t in conflict.
The one who’s in conflict (of interest) is Anthropic.
It has all the reasons to accuse Chinese AI efforts of being strictly derivative of their IP. Anthropic’s ties with the US government ensure a channel for lobbying against open-source AI, whether Chinese or national. After all, Anthropic’s revenue is threatened by any kind of open initiative—you can’t sell subscriptions if there’s a free, open, cheaper option waiting one click away. The difference is that domestic open-source initiatives have been choked under the increased closeness of the biggest AI labs and the negligence of regulators. So China is what’s left.
Both the Chinese government and the Chinese industry have stated in clear terms that open-sourcing AI will remain a central goal. The trade-off between openness and closeness exists for them as well, but it is different from the one facing an American model company like Anthropic or OpenAI. China can accept lower direct revenue from model access if open models spread Chinese technical standards, strengthen domestic industry, and become the default option in countries where American systems are expensive, restricted, or unavailable.
Open source can support a viable business. DeepSeek’s approach, for instance, is to give away the weights while charging for efficient hosted inference through its API. Moonshot does the same thing. And so does Zhipu. China is genuinely committed to open-source AI. Most companies do not want to buy servers, optimize kernels, manage capacity, and maintain their own deployment. If these startups can run the same model more cheaply than customers or rival hosts, it can earn a reasonable infrastructure margin—even if not the kind that a software monopoly would enjoy, which is what OpenAI and Anthropic are aiming for—while still allowing broad adoption. The geopolitical benefit and the company’s financial return are separate, but they reinforce each other. The world using Chinese AI because American AI is expensive, or close, or capped, or lobotomized, or safeguarded, or not allowed overseas is a total civilizational victory.
There’s another reason not to fully believe Anthropic or the US government on this: Fable was not available during most of K3’s training and post-training.
The dates just don’t match. Fable was released to users—API and subscription—on June 9. It was taken down three days later at the request of the US government due to alleged cybersecurity risks and didn’t come back online until June 30. Kimi K3 was released on July 16. Two weeks is a negligible amount of time in AI training timescales. K3 certainly finished training much earlier than Fable was even made available. There’s a possibility that Kimi K3 did some quick post-training on it on top of their own post-training, but I doubt it was enough time to extract much data from it.2
There are some alternative explanations, with some gaps each.
First, Fable is a version of Mythos “made safe for general use.” Anthropic announced Mythos on April 7 (never released publicly) and made it available to a bunch of national partners through Project Glasswing, including the US government and technology companies. This was presumably made with the greatest care given the alleged threat level that Mythos embodied, were it to ever fall into foreign hands. Could Moonshot have hacked onto Mythos through one of the partners? Maybe. That would be really bad. But also unlikely, given 1) nothing terrible has happened to essential American infrastructure that we know of which might have happened had China gotten access to Mythos, 2) the White House has explicitly said “Fable” was distilled, not “Mythos.”3
Another possibility is that Moonshot was actually distilled from Opus-class models—I think this is much more likely to have happened—and the story got accidentally tangled. This would mean distillation did take place and thus the accusations have some basis. But it would not explain why K3 is so good, which is actually the bigger problem for Anthropic—just one against which they have no claim. What if Moonshot did some distillation on less powerful models and then found ways to make K3 as good as Fable? That would be especially bad news for Anthropic—and its investors—because it would mean Chinese companies can close the performance gap by distilling from the second-best models, without needing access to Anthropic’s frontier model at all.
Whatever the case, I feel there are two key readings on this whole situation. I’m much less concerned about whether Moonshot did or did not distill Fable than about how Anthropic reacted.
First, if Anthropic can’t defend itself from a smaller, weaker AI lab using Fable, how do they expect us to believe AGI is near? If Anthropic can’t protect its lead because distillation is impossible to stop, then how can they argue in favor of keeping the models closed in the name of general interest? If China will always steal the gains and release them into the world, then Anthropic should do it first. It’s not just that open-source is the best strategy for America, but perhaps the only one.
And second, how does Anthropic dare make accusations of “IP theft”?
In June 2025, a federal judge ruled that Anthropic had violated authors’ copyrights by downloading and storing more than seven million pirated books, although its use of books to train its AI was deemed fair use. In July 2026, another judge approved a $1.5 billion settlement to compensate affected authors and publishers.
If we translate this to the Moonshot story, it means that using Anthropic’s IP “to train its AI” should be “deemed fair use,” unless it was being stored somewhere. Why is it reasonable to deem the practice of taking the entire web—that humans collectively create—as data to sell it back to us, compressed in app form, but giving back that compressed data to us is suddenly an “industrial distillation” attack? As I see it, Moonshot AI is the industry’s Robin Hood: it steals from the rich—who previously stole from us—and gives to the poor.
But I want to be measured and charitable with Anthropic, as I was with Moonshot before: maybe a heist of the entire internet did take place and, on top of that, Anthropic is a company of great talent and hard-working people.
Those two things, I say again, aren’t in conflict.
Unfortunately for Anthropic, it doesn’t have the last say on this topic.
Wired reports that the “Trump admin is divided on whether to restrict Chinese AI models,” citing familiar sources. The White House doesn’t want distillation at large scale to happen, “[b]ut an executive order to ban Chinese labs from accessing US models is not currently on the table. Meanwhile, Commerce instead wants to find ways to incentivize US companies to develop open models to counter China.” Politico reports that the tech industry is also doubtful that a ban on open-source Chinese AI is a good idea: “Nearly 200 Silicon Valley companies, including Proton and Y-Combinator, are urging the Trump administration not to cut off access to Chinese open-weight AI models or risk crippling the next generation of U.S. startups.” Here’s a chart on the divide:
To Anthropic’s surprise, not everyone seems to have Anthropic’s best interests at heart.
But even if the entire government and the entire tech industry were to side with Anthropic—which would be a terrible strategic mistake for America given the potential tipping effect of Chinese AI spreading through the world—the outcome will ultimately be decided by what people actually do. The primary force in this affair is no Bessent or Amodei, but whether enterprises and individual consumers are okay with using Kimi K3 and DeepSeek V4 and GLM 5.2, MiniMax-M3, etc.
If data is to be trusted, they certainly are:
Here’s what Bloomberg says:
Chinese models have already gained traction in the US, making restrictions harder to impose without disrupting American users and businesses. On the AI marketplace OpenRouter, they account for nearly 60% of token usage by US companies. Silicon Valley startups and researchers rely on customizable Chinese models, while DoorDash Inc. and Airbnb Inc. have adopted them as low-cost alternatives or complements to American offerings from OpenAI and Anthropic PBC.
Bloomberg reports that, in the face of these haunting numbers, Bessent “suggested pressure could be placed on companies using Chinese AI.” That is… a way to approach this situation. His position amounts to an admission: “China is winning, so our only option is to punish those who rationally side with the winner.” Not quite the best look for the world’s foremost “defender” of free markets.
Another approach would be this: “let’s outcompete China by pushing open-source initiatives.” That is the alternative Commerce supports, the one I think has the best odds, and the one Anthropic cannot afford to see succeed. Indeed, the only people unlikely to see it as eminently sensible are, first, those more fearful of China than confident in America, and second, those who stand to lose regardless of whether the open-source AI that prevails is Chinese or American—because, despite their repeated geopolitical framing, their real objection is economic.
That is, Anthropic and OpenAI.
OpenAI is part of the broader push against open-source AI. Sam Altman’s team has taken a few tentative steps in the open direction, as the SemiAnalysis chart below shows, but its underlying position is pretty clear. Anthropic may be more overtly hawkish on China, but Altman has previously written he prefers the future to be shaped by democratic institutions rather than authoritarian ones. Neither company wants China to lead.
The obvious question is why are they so afraid of seeing China win when the leading American models remain far more capable?
Consider a recent cybersecurity test. An undisclosed OpenAI model—rumored to be GPT-6—bypassed the safeguards built into the evaluation and hacked Hugging Face, an American open-source AI company, simply to complete a task (it was just following instructions, albeit rather unorthodoxly). How is that not already AGI, right? Hugging Face detected the intrusion and traced it back to an American lab, which turned out to be OpenAI. Everyone involved was quite spooked about the incident. But the episode ended in a partnership between the two companies rather than, say, public recrimination, a degree of tolerance that a Chinese startup would be unlikely to receive.
When Hugging Face tried to find out what had happened, its available OpenAI and Anthropic systems—Fable and GPT-5.6 Sol—were so heavily restricted that they refused to assist. The American company had to turn to a Chinese model after the attack of an American one. It’s not often that reality hands us the correct answer so straightforwardly.
What I find most surprising about all this is that people are genuinely afraid that a model might break out of its sandbox environment—because that would demonstrate its misalignment or something—rather than fearing the real problem: if America doesn’t change the way it does things, it will be handing China that bright AI future on a silver platter.
Distillation is suddenly an “attack” to be defended from, but not long ago it was a development technique that, insofar as it provided Anthropic with revenue, was fair. Double standard depending on whether it benefits Anthropic or not.
If they were conducting a successful distillation attack at industrial scale during those two weeks, why not just wait another two—or two months, for that matter—and release the model a bit later to get the most out of Fable? It just makes no sense for them to push themselves to act super quickly due to an unforced deadline when there’s free lunch available.
To be clear, I’m not sure China would have actually used Mythos to destabilize America or something. Maybe Moonshot did hack into one of the Glasswing partners, and the only thing they did was actually distill Mythos to build K3. This is an assumption that won’t be taken seriously because in the West, China is nothing short of a monster.
Nice. One quibble. Hugging Face did not turn to GLM-5.2 to defend itself but to just run his forensics on the rogue attack. Both US models read the request to do forensics as interest in offensive cyber ops and refused to assist. GLM helped process reams of incident logs to assist Hugging Face in determining what had happened...important distinction..
Strong argument. The US should investigate genuine IP theft, but accusations without public evidence cannot replace a competitive strategy. If Chinese open models are winning users through cost, access, and flexibility, restrictions may only make American AI look defensive. The better response is to build stronger open models at home. Confidence should be demonstrated through innovation, not blocking competition.