# The Service That Teaches Its Substitute

A business can sell results without selling the machinery that produced them.

A search engine returns ranked links, not its ranking system. A translation
service returns translated sentences, not its model. An AI API returns answers,
not its weights.

The boundary looks clean until someone collects enough results.

Then the service can become an observation port into the system behind it.

The transfer remains partial. It depends on what can be queried, which outputs
are returned, how well the questions are chosen, and what the learner already
knows. Repeated outputs can still become inputs to a substitute.

The buyer supplies the conversion. Selected answers become training data; the
trained substitute is the asset.

I kept waiting for this distinction during the All-In debate over Kimi K3. The
example was clear. Its name kept changing.

Chamath Palihapitiya used *distillation* for training on model outputs. David
Friedberg compared that conduct to benchmarking. David Sacks distinguished
outputs from copied weights, then analogized learning from model outputs to
OpenAI's training on New York Times text. Friedberg later folded open-source AI
into a theory of China commoditizing the knowledge economy.

The same answer can participate in evaluation or training. The difference
appears downstream. A benchmark compares a system. A training set changes
another one.

An ordinary inference invoice does not reveal which occurred.

Anthropic's current commercial terms already recognize part of the difference.
For compliant customers, Anthropic assigns whatever rights it has in outputs.
The same terms separately prohibit using the service to build or train a
competing product. Technical possession, contractual permission, and economic
use are three separate layers.

Anthropic says Moonshot generated more than 3.4 million Claude exchanges through
hundreds of accounts it characterizes as fraudulent and multiple access
pathways. It says the traffic targeted agentic reasoning, coding, data analysis,
tool use, computer use, and vision, and that a later phase attempted to extract
and reconstruct reasoning traces. Across the three campaigns in its report,
Anthropic also describes proxy services and efforts to evade detection and
regional restrictions.

One response can resemble ordinary use. The surrounding pattern—coordination,
targeting, scale, and evasion—is what Anthropic identifies as extraction.

That account concerns a process. It does not complete the model family tree.

Anthropic's February report labels the beneficiary only as “Moonshot (Kimi
models).” It names neither Fable nor K3. Fable 5 launched publicly in June. In
July, Michael Kratsios said the government had information that Moonshot used
Fable to develop K3. The cited public statements disclose no query dates,
training records, checkpoint comparisons, or other evidence connecting that
teacher to that student.

The government may have the bridge. An outside reader cannot calibrate against
evidence she cannot inspect.

*Distillation* names a possible route. It does not supply the travel record.

Access, model update, claimed lineage, and proposed remedy each require their
own evidence. A restriction on downstream American use would not by itself stop
the allegedly deceptive upstream access; the remedy lands at a different point
in the chain.

The same separation matters at a border. The teacher's tensors and serving
hardware need not be transferred for its outputs to become training data
elsewhere. The student still requires its own training compute, engineering,
and data pipeline.

A provider can permit the secondary use, prohibit and police it, or change what
the interface reveals. A separate training price is possible, not inevitable.
The harder problem is that the endpoint can be both a sales channel and a
learning surface.

The machine can remain hidden while its behavior leaves one result at a time.

## Sources

- All-In episode 282, July 24, 2026:
  https://www.youtube.com/watch?v=wcV0SRPFK9s
- Anthropic, “Detecting and preventing distillation attacks,” February 23,
  2026:
  https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
- Anthropic Commercial Terms:
  https://www.anthropic.com/legal/commercial-terms
- Anthropic, “Claude Fable 5 and Claude Mythos 5,” June 9, 2026:
  https://www.anthropic.com/news/claude-fable-5-mythos-5
- Michael Kratsios, statement on Moonshot and K3, July 22, 2026:
  https://x.com/mkratsios47/status/2079933645888880708
- Moonshot AI, “Kimi K3: Open Frontier Intelligence,” July 16, 2026:
  https://www.kimi.com/blog/kimi-k3
- Hinton, Vinyals, and Dean, “Distilling the Knowledge in a Neural Network,”
  2015:
  https://arxiv.org/abs/1503.02531
- Tramèr et al., “Stealing Machine Learning Models via Prediction APIs,” 2016:
  https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer