Did China’s Newest AI Models Learn From GPT-6 Astra? What the Distillation Report Shows, and What It Doesn’t

By Thorsten Meyer | October 29, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

On Wednesday evening, The Information reported that two of China’s leading AI labs, DeepSeek and Moonshot AI, relied heavily on outputs from OpenAI’s GPT-6 Astra to train the models they released this month. Reuters picked up the story within hours. The models named are ones many teams are testing right now: Moonshot’s Kimi K3.1 Pro and DeepSeek’s V4.1 Flash update from October 17.

It is a serious accusation with a thin public record: unnamed sources, a paywall, and no confirmation or denial from any of the three companies. Here is what was reported, what distillation is, where a normal technique becomes a breach of the rules, and what it means for companies and users.

Key takeaways

• The report: The Information (October 28) says DeepSeek and Moonshot AI relied heavily on GPT-6 Astra outputs for their latest models, citing people with direct knowledge. Per Reuters, the models are Kimi K3.1 Pro and DeepSeek-V4.1-Flash-1017. Treat it as reported, single source: OpenAI, DeepSeek and Moonshot did not respond to Reuters.
• The backdrop is documented, by one side: In September, OpenAI tied a “core cluster” of a July campaign to extract its models’ hidden reasoning to individuals associated with Moonshot AI, and U.S. security agencies named both labs in an advisory. China’s commerce ministry calls the accusations baseless.
• Distillation itself is normal. Labs train small models on their own big models’ answers all the time. The fight is about doing it to a rival’s model, at industrial scale, through fake or resold accounts.
• Illegal or against the rules? OpenAI’s terms forbid using its outputs to build competing models. So this is mainly a contract question, plus possible fraud in how access was obtained. My reading, not legal advice.
• Why it matters: Astra costs $10 / $50 per million input / output tokens. Kimi K3.1 Pro costs $2 / $10, DeepSeek’s model $0.30 / $1.20 at peak hours. On the same independent index they score 57, 46 and 32. Cheaper, not equal.
• For companies: add provenance to model due diligence, keep a fallback and test on your own tasks. For users: nothing changes in the apps today, but stay away from cheap, unofficial API resellers.

Products Worth Considering

Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor

AmazonView Latest Price

LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor

AmazonView Latest Price

LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What was reported, and what wasn’t

The original story is The Information’s “OpenAI’s Astra Model Becomes Top Distillation Target for China’s AI Labs” by Jing Yang, Juro Osawa and Qianer Liu, published October 28 at 6 p.m. Pacific time. Its public opening says Astra, “the most powerful model the company has released,” has met strong demand since its release in early September, and that “one growing customer base” is Chinese AI labs that want to extract its capabilities. The rest is paywalled.

Reuters summarized the core claim: DeepSeek and Moonshot “relied heavily on outputs from OpenAI’s powerful GPT-6 Astra model to train their latest models.” Kimi K3.1 Pro, released October 23, and DeepSeek-V4.1-Flash-1017, launched October 17, “benefitted from distilling Astra,” The Information said. OpenAI, DeepSeek and Moonshot did not immediately respond to Reuters.

Two more details come via the Korean broadcaster SBS, which summarized the report on October 29. According to SBS, the sources said Chinese labs had mainly copied Anthropic’s Claude until recently and moved to OpenAI after Anthropic tightened its defenses. SBS also quotes an OpenAI spokesperson as saying the company takes the issue very seriously and keeps working on it. I could not check either detail against the original.

What is missing matters as much: no numbers, no method, no account of how the outputs were obtained. Moonshot’s launch post credits K3.1 Pro’s gains to “substantially larger post-training compute” and large-scale reinforcement learning. DeepSeek’s update note says nothing about training data. I reviewed both models when they shipped: Kimi K3.1 Pro and DeepSeek V4.1 Flash 1017.

Distillation in plain words

Picture a top tutor who works through thousands of exam problems on paper. A student who gets copies of those worked solutions, not just the answers, learns the moves fast without ever sitting in the class. That is distillation. A large “teacher” model answers a huge number of prompts, and a smaller “student” model is trained to imitate the answers and, ideally, the reasoning behind them.

The technique is ordinary. Labs use it to build small, cheap versions of their own models. Even the U.S. government’s advisory on the subject calls distillation “a legitimate and useful technique in AI research.” The dispute starts when the teacher belongs to someone else, the copying runs at industrial scale, and access comes through fake or resold accounts against the provider’s terms.

The reasoning is the prize. Models such as Astra think step by step before they answer, and providers hide or summarize that reasoning partly for this reason. Anthropic tested the effect on its own models: a model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on the SWE-bench Verified coding test, but only 71.8% when trained on summarized transcripts. It is Anthropic’s own experiment, but it shows why distillers want the hidden notes. How people tried to pry them loose is in Attackers Now Go After Your AI Tools.

The record so far

This report did not come out of nowhere. I covered the earlier evidence in the Railway breach piece, so here is the short version:

• February 23, 2026, Anthropic: DeepSeek, Moonshot and MiniMax generated “over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts” (Anthropic).
• April 23, 2026, White House science office: memorandum NSTM-4 says distilled models “do not replicate the full performance of the original” but “appear to perform comparably on select benchmarks at a fraction of the cost,” and promises “measures to hold foreign actors accountable.”
• September 8, 2026, NSA, CISA and FBI: a joint advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI and says they extracted “billions of tokens” from U.S. models, partly through grey-market proxies called “transfer stations.”
• September 9, 2026, China’s Ministry of Commerce: calls the accusation “baseless and without legal basis,” a “normal technical and commercial issue,” says U.S. companies distill Chinese models too, calls U.S. regional restrictions “unfair terms” and threatens “resolute countermeasures” (translation, China IP Law Update).
• September 30, 2026, OpenAI: says it disrupted a campaign to extract protected reasoning that began July 1, peaking at 16,000 requests from more than 4,000 users on July 24 and 25, with related activity across more than 15,000 users. OpenAI attributes “a core cluster” to “individuals associated with Moonshot AI” and notes the figures are attempts, “not necessarily successful.”
• October 12, 2026, Anthropic: says new defenses cut the data harvested by distillers by “around 90 to 99%.”

Two things stand out. OpenAI’s September attribution covers July, three months before K3.1 Pro shipped, and names Moonshot-linked individuals, not DeepSeek; the new report extends the claim to both labs and to specific models. And almost every accusation comes from one side of the dispute. It may well be right, but no court or independent auditor has tested it.

Illegal, or just against the rules?

This is where headlines blur. My reading, not legal advice:

• It breaks the contract. OpenAI’s Terms of Use forbid “using Output to develop models that compete with OpenAI” and “automatically or programmatically extracting data or Output.” Its business agreement adds bans on buying, selling or transferring API keys and on getting around rate limits. If the report is true, that is a breach by whoever signed up.
• Copyright is a weak weapon. OpenAI’s own terms assign ownership of outputs to the user. And the U.S. Copyright Office concluded in January 2025 that “copyright does not extend to purely AI-generated material.” So “they copied our text” is hard to argue the way a publisher would.
• The access is where crimes may sit. Fake identities, stolen payment cards and stolen API keys, which Anthropic and the U.S. agencies describe, are illegal on their own. OpenAI’s list of supported API countries does not include China, so reaching Astra from there means going around its regional limits.
• Enforcement is slow. A contract claim across borders takes years. So the response so far is technical (blocking, hiding reasoning) and political (advisories, promised “measures”).

Beijing frames it differently: distillation is a neutral method, and the regional restrictions are the unfair part. For the wider U.S. policy fight, see my piece on federal versus state AI rules.

Why it matters: prices, open weights and the race

Price is the first reason. GPT-6 Astra costs $10 per million input tokens and $50 per million output tokens (OpenAI). Kimi K3.1 Pro costs $2 and $10 (Moonshot). DeepSeek’s V4.1 Flash 1017 costs $0.30 and $1.20 at peak hours and half that off-peak (DeepSeek). On the independent testers’ full benchmark suite, one task costs about $6.24 with Astra at maximum effort, $3.68 with Kimi K3.1 Pro and $0.60 with DeepSeek’s model (Artificial Analysis, retrieved October 29).

But cheaper is not equal. On the same Artificial Analysis Intelligence Index (version 5), Astra at maximum effort scores 57, Kimi K3.1 Pro 46 and DeepSeek’s model 32. I explained how that index works in today’s Gemini 4 Carbon piece. The gap fits the White House line that distilled models do not match the original.

There is a twist. On Terminal-Bench 4.0, a test of AI agents working in a command line, Kimi K3.1 Pro scored 67% in Artificial Analysis’s run, above Astra’s 59%. A student who only copies rarely beats the teacher at the teacher’s own game. Moonshot credits reinforcement learning. From the outside, nobody can say how much came from where.

Open weights are the second reason. DeepSeek’s model is downloadable under the MIT license, and Moonshot promises K3.1 Pro’s weights by November 4. Once weights are out, they cannot be recalled. If they carry copied capabilities without the original’s safeguards, as Anthropic and the White House warn, that risk travels with every copy. Governments are already acting on Chinese models for other reasons: on October 20, the U.S. Department of Homeland Security ordered federal civilian agencies to remove DeepSeek products, including third-party products built on DeepSeek technology, citing data concerns (TechCrunch).

The race is the third. If rivals can close part of a multi-billion-dollar gap for the price of API calls, frontier labs hide more and trust less, and honest customers pay too. Anthropic says its classifiers wrongly block benign requests in “fewer than 0.1% of cases” and now charges for blocked requests in this area. The U.S. advisory even recommends that providers “subtly alter responses” to suspected distillers, without telling them.

What this means for companies

• Add provenance to model due diligence. Ask vendors for statements on training data and licensing, and record which model versions run where. Allegations are not findings, but they can turn into restrictions, as the DHS order shows.
• Keep a fallback. If you use Kimi K3.1 Pro or DeepSeek V4.1 Flash, make sure you can switch models behind an abstraction layer within days, not months.
• Ask counsel before you scale. A terms-of-service breach, if it happened, binds the party that signed, not you. But procurement rules and customer contracts can still reach downstream users, especially in the public sector.
• Test on your own tasks. The warning about models that look good “on select benchmarks” applies to every model. Run 20 to 50 of your real tasks before you switch for price.
• Run your own safety tests. If a model’s safeguards are thinner than the teacher’s, you inherit that. Self-hosting also means controlling where data goes; see Cohere’s Qwen egress finding.
• Expect friction on frontier APIs. Stricter identity checks and the occasional blocked request are the cost of the crackdown.

What this means for users

• Nothing changes in the apps today. Kimi and DeepSeek work as before. The report is about how models were trained, not about your account.
• Stay away from cheap, unofficial API resellers. Anthropic’s September threat report says some proxy services save users’ conversations without their knowledge and sell them to labs. A bargain key can cost you your data.
• Don’t ask a model to dump its hidden reasoning. Providers treat that as a distillation signal and may block the request or limit your account.
• Watch prices, not headlines. Cheap Chinese models have pushed prices down for everyone, as I noted in the AI price war piece. If governments restrict them, that pressure eases.

Honest limits

• One outlet, unnamed sources, a paywall. I read the public opening, the Reuters report and SBS’s summary, not the full article.
• No confirmation or denial from OpenAI, DeepSeek or Moonshot at the time of writing.
• “Relied heavily” is not a number. Nobody outside the labs can say how much of K3.1 Pro or V4.1 Flash 1017 came from Astra outputs, or how they were obtained.
• Most of the background evidence comes from parties to the dispute: OpenAI, Anthropic and the U.S. government on one side, China’s government on the other.
• Full disclosure: I researched this with help from Anthropic’s Claude. Anthropic has made its own distillation accusations against both labs, so I quote its numbers as claims.

The bottom line

Distillation is a normal technique that has become a strategic weapon. If the report holds, two of China’s most-used model families learned from OpenAI’s best model within weeks of its release. For companies, the practical answer is unglamorous: know where your models come from, keep a second option and test on your own work. For everyone else, the cheap models are real. So are the strings that may come with them.

Sources

• The Information, “OpenAI’s Astra Model Becomes Top Distillation Target for China’s AI Labs”, October 28, 2026 (paywalled; public opening only)
• Reuters via The Edge Malaysia, “DeepSeek, Moonshot used OpenAI’s GPT-6 Astra to train latest models, The Information reports”, October 28, 2026
• SBS News, summary of The Information’s report, October 29, 2026
• OpenAI, “Disrupting a coordinated model-distillation campaign”, September 30, 2026
• NSA, CISA and FBI, Joint Cybersecurity Advisory AA26-251A, September 8, 2026
• White House OSTP, NSTM-4 “Adversarial Distillation of American AI Models”, April 23, 2026
• China IP Law Update, translation of China’s Ministry of Commerce response, September 10, 2026 and ECNS, September 10, 2026
• Anthropic, “Detecting and preventing distillation attacks”, February 23, 2026; Threat Intelligence Report, September 2026; “Strengthening our defenses against distillation attacks”, October 12, 2026
• OpenAI Terms of Use, Services Agreement, API pricing and supported countries, retrieved October 29, 2026
• U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability, January 29, 2025
• Moonshot AI, Kimi K3.1 Pro launch post, October 23, 2026 and Kimi API pricing
• DeepSeek, update notes, API pricing and model card
• Artificial Analysis model pages for GPT-6 Astra, Kimi K3.1 Pro and DeepSeek V4.1 Flash 1017, retrieved October 29, 2026; Kimi K3.1 Pro launch analysis, October 23, 2026
• TechCrunch, “US orders federal agencies to remove China’s DeepSeek AI from their systems”, October 20, 2026

Related on ThorstenMeyerAI.com: Kimi K3.1 Pro: an open-weight giant three points from the frontier · DeepSeek V4.1 Flash 1017 · Gemini 4 Carbon is the new #1, by one point · Attackers now go after your AI tools · The Railway breach and the black market for AI keys · Federal vs. state AI rules

This article reflects the sources available on October 29, 2026. The companies may respond; check the linked sources for updates.

Researched and drafted with AI assistance, including Anthropic’s Claude.