Theo on Kimi K3, Distillation and the Open-Weight AI Debate

Kimi K3 is a very capable model, and the reaction to it has been remarkable. I see serious questions about security and the economics of open-weight AI, alongside claims about distillation and political responses that deserve much more scrutiny. Some of the motives I discuss later are explicitly speculation.

Treasury Secretary Scott Bessent said the US supports open-source AI but raised the possibility of sanctions or entity-list designations for covert industrial-scale distillation that crosses into intellectual-property theft. That is a warning about possible action, not proof that any particular company committed theft.

I contrast that with Anthropic's $1.5 billion copyright settlement involving books used in training. The two situations raise different legal questions: a settlement is not a court finding that all model training was unlawful, and an allegation about a competitor is not an adjudicated violation. My point is about the apparent asymmetry in how the cases are discussed.

US official Michael Kratsios alleges that Moonshot distilled Anthropic's Fable and obtained access to restricted NVIDIA GB300 hardware, including in Thailand. The video does not establish the underlying evidence. Export controls make advanced chips difficult to obtain, but allegations about a particular lab's actions should remain allegations until independently established.

China is also investing in its own chips and infrastructure. I worry that restrictions meant to protect US companies can push customers and research toward alternatives outside their ecosystem. Whether that tradeoff is justified depends on more than a headline accusing a model maker of theft.

To explain distillation, imagine a senior developer and a less experienced junior. The junior attempts a problem, sees the senior's successful answer and gradually learns to reproduce useful patterns. It is an analogy: actual model training uses data and optimization, not a person literally observing and understanding a colleague.

A stronger model can generate answers or demonstrations that help train a smaller or cheaper model to imitate some of its behaviors. The student may copy surface patterns without acquiring everything the teacher knows. Labs use variations of this approach to make expensive capabilities more accessible.

My example is Anthropic's model family: I think some orchestration behaviors of a more capable model have been transferred to a cheaper Sonnet model. This is my interpretation of the models' behavior, not a verified account of Anthropic's private training pipeline.

Cursor's Composer 2.5 provides another example of building on an existing model. Cursor described improving a Kimi-based model with more training, harder reinforcement-learning environments and new learning methods. Its published comparison also illustrates that results differ across benchmarks and configurations.

Cursor estimated that its additional post-training represented roughly 85% of the total compute in its accounting, with the original Kimi training representing the rest. The lesson I draw is that a starting model is important, but the later training data, environments and compute can also be substantial.

A company serving another lab's model can also learn from its own workflows and outputs. I argue that paying for a service and learning from its results can be reasonable, though whether particular uses are permitted is a separate question governed by contracts, law and the facts of the case.

Chinese users may lack authorized access to some frontier services, creating incentives for intermediaries and attempts to bypass restrictions. I describe reports of services that route requests indirectly and could collect inputs and outputs. These observations should not be taken as proof of a specific lab's conduct.

Outputs alone do not reveal every internal reasoning step. Returning to the developer analogy, reading finished code gives a junior less information about how a senior reached the answer than seeing the process as well. That limits what can be learned from response text, even though outputs can still be useful training data.

I compare learning from paid outputs to learning from a book, an employee or a contractor. The analogy expresses my view that learning should not automatically be treated as theft. It does not resolve disputes about unauthorized access, contractual restrictions or particular intellectual-property claims.

I then discuss an online report alleging that some complex requests sent to DeepSeek were routed to another model and that the outputs were collected. The report describes apparent similarities and changing behavior, but those observations do not independently prove routing, collection or distillation. The report concerns DeepSeek and is not proof of the separate allegation about Moonshot.

My summary is that distillation is a common technique, while who is accessing a model, what data is collected and what agreements apply are separate questions. Claims of improper access need evidence; the existence of distillation alone does not establish wrongdoing.

Some critics point to the short interval between Fable's public release and K3's launch and question the accusation that one simply trained the other. A timeline is relevant, but by itself neither proves nor disproves any particular post-training or access claim. I also mention a public dataset of model traces as part of the wider data-provenance debate.

Vercel CEO Guillermo Rauch reports that internal security evaluations found K3 highly capable, while an OpenAI model performed better at higher cost and Fable refused the tested tasks. These are reported results from a particular private evaluation, not a universal ranking of models or a complete safety assessment.

OpenAI's Dean Ball also calls K3 a good model and says its performance cannot simply be explained away by distillation. He considers it competitive in agentic coding and questions both its token use and the infrastructure needed to run it. I agree that its capabilities deserve credit, though I assess token efficiency differently.

A powerful open-weight model creates a difficult security tradeoff. A defender may run it to find weaknesses and harden systems, while an attacker can potentially use the same capabilities. I mention a reported Redis vulnerability discovery; the claim is an example raised in the video, not an independently verified measurement here.

I also describe a reported security investigation in which an open-weight model was useful when other services refused requests. The broader point is that restrictions can block legitimate defensive work as well as malicious use. That benefit does not erase the risks of making capabilities widely available.

Ball offers hypotheses about why Chinese organizations release weights, including infrastructure constraints and export strategy. I add another possibility: overseas customers may be more willing to use a Chinese-developed model when they can host it on infrastructure they control. These are explanations and incentives, not established proof of government intent.

Ball argues that open weights can reduce incentives for capital investment at frontier labs, and initially calls them inherently decelerationist. His argument is about a possible economic mechanism, not a demonstrated law that openness slows all progress. I can see why the wording upset people.

He also speculates about a future in which AI becomes publicly funded infrastructure, a scenario he strongly dislikes. I leave room for people to disagree with that prediction and his characterization of open-weight advocates. Open models can be used under many different commercial and public arrangements.

Ball predicts that government agencies could create regulatory uncertainty around Chinese open-weight models without imposing a formal ban. I would dislike a world where closed models win primarily because the government makes alternatives too risky to use. This is a forecast discussed in the video, not evidence that the particular hypothetical guidance was issued.

I read much of Ball's post as an attempt to describe incentives and possible outcomes, although it mixes analysis with strong opinions. He also discusses increasing security risks as models improve. I think that concern is worth considering, while some of his language goes too far.

K3's performance cannot simply be dismissed as copying, and I think it does particularly well in some 3D tasks. At the same time, I expect frontier labs to retain advantages for some time. Research moves in both directions: American labs have also benefited from work published by Chinese teams.

Ball later clarified that he had been imprecise. He said he meant open weights could reduce capital spending at the margin, not that they slow progress in every respect; he acknowledged that they can accelerate progress in other ways. I welcome the clarification, while the economic claim itself remains debatable.

On security, Ball says he does not think today's models justify a drastic policy shift, while warning that future capabilities could change the calculation and governments may have less tolerance for risk. I appreciate the distinction between a current assessment and a prediction about the future.

A lower price per token does not automatically mean a lower cost per completed task. If K3 uses twice as many tokens as another model, a half-price token can yield a similar total cost. Speed matters too: my illustration of twice the tokens at half the speed implies four times the generation time, assuming comparable conditions.

I expect price and performance to change, but at the time of recording I do not consider K3 the best value for every workload against OpenAI's offerings. Its appeal includes open-weight deployment and particular capabilities, subject to the actual release and hardware requirements. A phrase resembling another model's output is not proof of copying or distillation.

I point to rankings in which Kimi and GLM perform strongly alongside models from Google and Meta. Such rankings measure specific tasks and can change, but the wider point is that competition from open-weight teams can push established labs to improve. I would use different models for different coding tasks.

Now for an explicitly unsupported theory: I speculate that Anthropic's decisions about Fable subscription access and the timing of Opus 5 could reflect concern about K3's benchmarks and serving costs. I have no inside information, and this is not evidence of the company's motives or an actual delay caused by K3.

My expectation is that K3 will intensify competition over model prices and capabilities and influence the policy debate. I remain enthusiastic about open weights because I do not want all our work to depend on one or two companies, while recognizing that increasingly powerful models also raise real security concerns.