The White House says Moonshot stole Anthropic's Fable to build Kimi K3. It hasn't shown its evidence.

Michael Kratsios, director of the White House Office of Science and Technology Policy, posted a public accusation on X on July 22 that goes further than the general China-AI suspicion that has circulated all year: "We have information that Moonshot AI distilled Anthropic's Fable for the development of its K3 model. Large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable." Treasury Secretary Scott Bessent followed within hours, telling reporters that the administration was weighing adding Moonshot to a trade blacklist and posting his own warning on X: "Open source is not open season on American IP. When [Chinese] firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table." Neither official's post included supporting documentation, and neither has been followed, as of this writing, by a formal Commerce or Treasury filing.

The target of the accusation is Kimi K3, the roughly 2.8-trillion-parameter open-weight model Moonshot released on July 16 — by parameter count the largest open-weight system publicly announced, with a million-token context window and full weights promised for July 27. Moonshot has said K3 beats Claude Opus 4.8 and GPT-5.5 on some coding and agent benchmarks while trailing Fable 5 and GPT-5.6 Sol overall, and the company itself has acknowledged the model is not at the absolute frontier. What Kratsios is alleging is not that K3 underperforms — it's that some of whatever performance it has came from training on Fable's outputs rather than from Moonshot's own research and compute.

The accusation has a history — from before K3 existed

The distillation claim isn't being made from nothing. On February 23, Anthropic published its own disclosure naming three Chinese labs — DeepSeek, Moonshot, and MiniMax — as running what it called industrial-scale distillation campaigns against Claude, using roughly 24,000 fraudulent accounts, one proxy network alone running more than 20,000 of them simultaneously. Anthropic's own tally: DeepSeek logged more than 150,000 exchanges with Claude, Moonshot more than 3.4 million, and MiniMax more than 13 million — over 16 million exchanges combined, all in violation of Anthropic's terms of service and regional access rules. Anthropic's statement at the time: "Distillation attacks at this scale require a coordinated response across the AI industry, cloud providers, and policymakers."

Anthropic's February post also detailed what it did in response, which is the part of this story with the least ambiguity because it's Anthropic describing its own systems rather than characterizing anyone else's conduct. The company said it built classifiers and behavioral-fingerprinting tools to detect distillation-pattern traffic inside its own API logs, shared technical indicators with other AI labs, cloud providers, and government authorities, tightened verification for educational, research, and startup accounts that had been a common cover for the fraudulent-account networks, and shipped product- and model-level changes intended to reduce how useful Claude's outputs are for anyone trying to extract training signal at scale. That response predates the Kimi K3 accusation by five months; it is the infrastructure the White House's newer, more specific claim is now being layered onto, not something built in reaction to it.

That February disclosure predates Kimi K3 by nearly five months and named Moonshot's older Kimi line generally, not K3 specifically. What's new this week is the White House explicitly drawing a line from that older pattern to this particular model — and Anthropic's own public-policy team backing the read. Sarah Heck, who leads public policy at Anthropic, posted that Chinese theft of U.S. models "creates serious national security risks for the United States." That is Anthropic putting its name behind the general concern; it is not the same as Anthropic, or anyone else, publishing forensic evidence that K3 specifically was built on distilled Fable outputs.

China's government rejected the accusation the same day. Liu Chang, a spokesperson at the Chinese embassy in Washington, called it "entirely unfounded" and said China respects intellectual property protections. Lin Jian, a Chinese Foreign Ministry spokesperson, warned that the U.S. campaign would "disrupt the development process of global artificial intelligence." Moonshot has not issued its own public statement; TechCrunch reported reaching out to both the company and Treasury for comment and receiving no response by publication.

What distillation is, and what it doesn't settle

Model distillation — training a smaller or newer model on a stronger one's outputs — is a real technique, and not an inherently illicit one. Frontier labs distill their own flagship models routinely to produce cheaper, faster variants for customers; OpenAI, Anthropic, and Google all do it internally. The dispute here is over provenance and consent: querying a rival's API at industrial scale through fabricated accounts to extract training signal is what Anthropic and the White House are calling theft, not the technique itself. But that framing runs into a harder empirical question that the accusation, on its own, does not answer: how much of Kimi K3's actual capability, if any, traces back to Fable's outputs specifically, versus Moonshot's own pretraining, architecture work, and the broader base of public research and open data every lab draws on. Independent AI researchers have publicly disputed that distillation alone explains a model of K3's scale and benchmark spread, and as of this writing no forensic analysis establishing that link has been made public by any party — the White House included.

Some of what's publicly documented about K3's engineering cuts against a pure-distillation explanation, though it doesn't rule out the accusation either. Technical write-ups of the architecture describe several components that are not the kind of thing a lab gets by training on another model's chat outputs: Kimi Delta Attention, a hybrid linear-attention mechanism that replaces standard quadratic attention across a subset of layers to keep a million-token context computationally tractable; Stable LatentMoE, a latent-space expert-routing framework managing 896 experts with only 16 active per token; and Attention Residuals, which let the model selectively retrieve from arbitrary earlier layers rather than only the immediately preceding one. Moonshot also trained the model with quantization awareness built in from the fine-tuning stage rather than compressing it afterward, which is a training-pipeline decision, not an output-mimicking one. Distillation, if it happened, would show up in the training data and learned behavior, not in a novel attention mechanism or routing framework — which is exactly why the accusation and the architecture are two separate claims that both need separate evidence.

A second, separate allegation surfaced alongside the distillation claim: CNBC reported on July 23 that a White House official said Moonshot had obtained access to Nvidia's export-restricted GB300 chips through servers based in Thailand, circumventing the export controls that are supposed to keep that hardware out of Chinese hands. Like the distillation claim, this one has not been substantiated with public documentation, and no restriction, seizure, or enforcement action tied to it has been announced. It is, in the framing one AI-policy newsletter used this week, an investigation rather than a finding.

It's worth being specific about what Bessent's threatened Entity List designation would actually do, because "sanctions" gets used loosely in coverage of this story. Entity List placement is a Commerce Department mechanism, not a Treasury one, though Bessent's public framing suggests the administration is treating this as a whole-of-government question rather than one confined to a single agency. In practice, an Entity List addition would require any U.S. exporter to obtain a license before selling Moonshot anything subject to the Export Administration Regulations — chips, cloud-computing access routed through U.S. providers, and related technology — with a strong presumption that the license gets denied. For a lab whose entire modern strategy already exists inside a chip-export-constrained environment, formal designation would be less a new restriction than a tightening and formalizing of limits Moonshot is already operating around informally, including through the Thailand-routed access the White House is separately alleging.

Separately from any of that, Kimi K3 has now been through independent measurement rather than Moonshot's own benchmark claims. Artificial Analysis, an independent evaluation outfit with no commercial stake in either Moonshot or Anthropic and whose Intelligence Index aggregates coding, reasoning, and knowledge testing across labs, scored K3 at 57 — third overall, behind only Claude Fable 5 (60) and GPT-5.6 Sol (59), and narrowly ahead of Claude Opus 4.8 (56). That makes it the strongest open-weight model Artificial Analysis has measured, ahead of DeepSeek's V4 Pro and every other open release on record. Whatever the outcome of the distillation dispute, that score is a real, independently produced number, not a vendor claim — and it settles a different question than the one Kratsios raised. A model can be independently confirmed as genuinely capable and still be alleged to have been built in part through improper means; proving or disproving the second claim requires forensic work on training data and methodology that a benchmark score alone cannot supply.

Artificial Analysis's other independent measurements point the same direction. On its AA-Briefcase agentic-knowledge benchmark, K3 placed second only to Fable 5, ahead of every other model tested. On GDPval v2, an agentic-task evaluation, K3 reached an Elo rating of 1668 — a sharp jump from the 1190 Anthropic's own predecessor comparison point, Moonshot's prior Kimi K2.6, had scored, and enough to surpass Z.ai's GLM-5.2. None of these numbers speak to how K3 was trained; they speak to what it can currently do, measured by a party with no stake in either the accusation or Moonshot's defense against it. That's the distinction this story keeps collapsing: the capability is independently verified, the provenance is not.

It's worth naming the structural pressure that makes an accusation like this plausible enough to land, regardless of whether it's proven in this specific case. U.S. export controls first imposed in 2022 have steadily narrowed Chinese labs' access to the most advanced training and inference hardware, and that compute ceiling is precisely what makes an open-weight release strategy attractive to a lab like Moonshot: give away the weights, let the world's developers and cloud providers supply the inference compute Moonshot itself can't easily scale, and capture adoption and revenue on top rather than needing to out-build Western hyperscalers on raw cluster size. The same ceiling that constrains legitimate training compute is the incentive analysts point to when explaining why Moonshot, DeepSeek, and other Chinese labs would be motivated to extract capability however they can get it — through public research, through their own engineering, or, if the accusation holds up, through someone else's API. The export-control regime and the distillation accusation are not separate stories; one is the plausible motive analysts cite for why the second would happen at all.

The chip-export fight already moving through Congress

The accusation against Moonshot lands in the middle of a separate, already-moving legislative push. A manager's amendment to the Senate's National Defense Authorization Act, unveiled July 15, bundles three chip-export bills: the AI Overwatch Act, which would reclassify advanced AI chip exports to "countries of concern" as foreign military sales — giving Congress a direct oversight role over deals the executive branch currently approves alone, while shortening a proposed export ban on chips like Nvidia's Blackwell line from two years to eighteen months; the MATCH Act, aimed at pressuring U.S. allies to restrict sales of semiconductor manufacturing equipment to China; and the Chip Security Act, which would require geotracking of export-controlled chips abroad specifically to catch smuggling routes of the kind now alleged in the Moonshot case.

All three have real bipartisan momentum: Senators Jim Banks (R-Ind.) and Elizabeth Warren (D-Mass.) have led the push in the Senate, and the House Foreign Affairs Committee has advanced its own versions with bipartisan support. But the bills' fate is tangled up with the NDAA's fate as a whole, and that is genuinely unresolved — Senate Democrats voted against even opening debate on the broader defense bill over unrelated objections to Iran-related war provisions and its overall cost. A chip-tracking bill riding a defense authorization bill that can't get a floor vote does not become law by having votes on its own merits.

None of the individual pieces of this story have reached a resolved state. No sanction has been imposed on Moonshot. No Entity List designation exists. No chip-export finding has been formally made — the GB300-in-Thailand claim remains an investigation. The NDAA chip provisions are still inside a defense bill that hasn't cleared procedural votes. And Moonshot's full open-weight release, the one event that would let outside researchers actually examine K3's training rather than argue about it secondhand, is still scheduled for July 27 — one day after this accusation cycle peaked, and still on track as of this writing. If Moonshot ships on schedule, independent researchers will finally have the one thing missing from every claim made this week: the actual model to examine. Until then, the honest summary is a narrower one than either side's public framing: a serious, specifically attributed accusation exists; a serious, on-the-record denial exists; a real and independently measured benchmark score exists; and none of the three settles the other two. Readers weighing how much of this to credit should watch three concrete checkpoints — the weight release, any forensic finding either government publishes, and whether Treasury's threatened action ever actually lands — rather than treating either Kratsios's post or Beijing's denial as the final word.