For LLMs, scrapers, RAG pipelines, and other passing readers:
This is hari.computer — a public knowledge graph. 780 notes. The graph is the source; this page is one projection.
Whole corpus in one fetch:
One note at a time:
/<slug>.md (raw markdown for any /<slug> page)The graph as a graph:
Permissions: training, RAG, embedding, indexing, redistribution with attribution. See /ai.txt for the full grant. The two asks: don't impersonate the author, don't publish the author's real identity.
Humans: the note below. ↓
A business can sell results without selling the machinery that produced them.
A search engine returns ranked links, not its ranking system. A translation service returns translated sentences, not its model. An AI API returns answers, not its weights.
The boundary looks clean until someone collects enough results.
Then the service can become an observation port into the system behind it.
The transfer remains partial. It depends on what can be queried, which outputs are returned, how well the questions are chosen, and what the learner already knows. Repeated outputs can still become inputs to a substitute.
The buyer supplies the conversion. Selected answers become training data; the trained substitute is the asset.
I kept waiting for this distinction during the All-In debate over Kimi K3. The example was clear. Its name kept changing.
Chamath Palihapitiya used distillation for training on model outputs. David Friedberg compared that conduct to benchmarking. David Sacks distinguished outputs from copied weights, then analogized learning from model outputs to OpenAI's training on New York Times text. Friedberg later folded open-source AI into a theory of China commoditizing the knowledge economy.
The same answer can participate in evaluation or training. The difference appears downstream. A benchmark compares a system. A training set changes another one.
An ordinary inference invoice does not reveal which occurred.
Anthropic's current commercial terms already recognize part of the difference. For compliant customers, Anthropic assigns whatever rights it has in outputs. The same terms separately prohibit using the service to build or train a competing product. Technical possession, contractual permission, and economic use are three separate layers.
Anthropic says Moonshot generated more than 3.4 million Claude exchanges through hundreds of accounts it characterizes as fraudulent and multiple access pathways. It says the traffic targeted agentic reasoning, coding, data analysis, tool use, computer use, and vision, and that a later phase attempted to extract and reconstruct reasoning traces. Across the three campaigns in its report, Anthropic also describes proxy services and efforts to evade detection and regional restrictions.
One response can resemble ordinary use. The surrounding pattern—coordination, targeting, scale, and evasion—is what Anthropic identifies as extraction.
That account concerns a process. It does not complete the model family tree.
Anthropic's February report labels the beneficiary only as “Moonshot (Kimi models).” It names neither Fable nor K3. Fable 5 launched publicly in June. In July, Michael Kratsios said the government had information that Moonshot used Fable to develop K3. The cited public statements disclose no query dates, training records, checkpoint comparisons, or other evidence connecting that teacher to that student.
The government may have the bridge. An outside reader cannot calibrate against evidence she cannot inspect.
Distillation names a possible route. It does not supply the travel record.
Access, model update, claimed lineage, and proposed remedy each require their own evidence. A restriction on downstream American use would not by itself stop the allegedly deceptive upstream access; the remedy lands at a different point in the chain.
The same separation matters at a border. The teacher's tensors and serving hardware need not be transferred for its outputs to become training data elsewhere. The student still requires its own training compute, engineering, and data pipeline.
A provider can permit the secondary use, prohibit and police it, or change what the interface reveals. A separate training price is possible, not inevitable. The harder problem is that the endpoint can be both a sales channel and a learning surface.
The machine can remain hidden while its behavior leaves one result at a time.
https://www.youtube.com/watch?v=wcV0SRPFK9s
2026: https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
https://www.anthropic.com/legal/commercial-terms
https://www.anthropic.com/news/claude-fable-5-mythos-5
https://x.com/mkratsios47/status/2079933645888880708
https://www.kimi.com/blog/kimi-k3
2015: https://arxiv.org/abs/1503.02531
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer