Chinese AI developers DeepSeek and Moonshot AI relied heavily on outputs from OpenAI's GPT-6 Astra model to train their latest systems, according to a report from The Information published Wednesday and carried by Reuters. The report cites people with direct knowledge of the matter, and stresses that the alleged use of Astra outputs has not been independently established.
If accurate, the claims would place OpenAI at the center of the same distillation dispute that has already ensnared its chief rival. For readers tracking AI news on model competition and training practices, the story lands just three months after Anthropic publicly accused the same two Chinese labs — along with Alibaba — of distilling its Claude models.
Which models are implicated?
The Information's reporting names two specific systems. Moonshot AI's Kimi K3.1 Pro, released last week, and DeepSeek's upgraded V4.1-Flash 1017, launched on October 17, are said to have benefited from distillation using OpenAI's frontier model. Neither DeepSeek nor Moonshot has confirmed the practice, and the report itself cautions that the use of Astra outputs has not been independently established.
Distillation, in the industry's usage, means training one model on the outputs of a more capable one so the student learns to reproduce the teacher's responses. Instead of paying for every capability through an independent training run, a lab can query a leading system and use its answers as high-quality training signal — cheaper, faster, and increasingly central to how competitive models get built.
A pattern of accusations — and new defenses
The report arrives amid a year of escalating claims over model extraction. In September, the U.S. government said there was a large-scale distillation campaign by Chinese companies against American AI companies — a statement The Information notes is separate from its new reporting on GPT-6 Astra specifically. Anthropic's August accusation that Alibaba, DeepSeek, and Moonshot had distilled Claude models set the template for the current fight.
Defenses are hardening too. Earlier this month, Anthropic said new measures designed to prevent rivals from copying Claude's capabilities had reduced data harvested through so-called distillation attacks by roughly 90 to 99 percent. The figure suggests that monitoring query patterns, restricting access, and rate-limiting suspicious activity can measurably raise the cost of extraction — though safeguards only work until attackers adapt.
OpenAI has not said whether it detected similar patterns against GPT-6 Astra or whether it plans policy changes in response to the report. The company's terms of service, like those of its rivals, restrict using outputs to train competing models.
What distillation can and cannot do
The technical reality is more nuanced than the headlines suggest. Outputs can provide useful training signals, but they do not transfer a model's architecture, its training data, its internal parameters, or every one of its capabilities. The effectiveness of distillation depends on the quality and diversity of the harvested examples and on the training process that incorporates them. A distilled model may match a teacher on benchmarks that resemble the harvested data while remaining weaker elsewhere.
That nuance cuts both ways. It means a reported distillation campaign does not reveal how much of a rival model's performance actually derives from extraction, whether terms of service were violated, or whether the resulting capabilities would have emerged anyway. But it also means that large-scale harvesting can hand a competitor a faster route to specific capabilities — particularly coding and reasoning, where the gap between frontier and fast-follower models has narrowed all year.
A difficult balance for the industry
Neither side of this dispute sees the practice as simple. Distillation itself is not inherently improper — AI developers routinely use techniques that transfer knowledge between their own models — and broad access to leading systems is what allows startups, researchers, and businesses to build products at all. The tension arises at scale: unrestricted access makes it far easier for a third party to collect large datasets of outputs for purposes the provider never authorized.
The safeguards that providers deploy in response carry their own costs. Monitoring unusual query patterns, restricting access to certain capabilities, imposing usage limits, and investigating bulk collection all raise the price of extraction — but they also create operational friction for legitimate developers and enterprises that depend on steady API access. The industry is, in effect, negotiating where legitimate model development ends and unauthorized extraction begins, one policy change at a time.
The economics behind the fight
The reason labs care is arithmetic. Training a frontier model costs billions of dollars in compute and research. If a competitor can reproduce important capabilities by systematically querying an existing model at API prices, the financial advantage of building the frontier system shrinks — and the incentive to keep building it shrinks with it. That logic explains why American labs have spent 2026 hardening their defenses, and why each new accusation lands less as gossip than as a data point in a pending economic war.
For Chinese developers, the calculus is different. Access to the most advanced chips is restricted, and distillation offers a path to competitive performance without matching compute budgets. The Information's report suggests that path ran through OpenAI's own flagship — the same accusation, aimed at a different target.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
