Washington spent four years building an export-control regime around advanced semiconductors. A new Reuters document review suggests the capability crossed the border anyway — not as hardware, but as text. This is how model distillation works, and why it is close to unenforceable.
For four years, American policy toward Chinese artificial intelligence has rested on a single physical assumption: that frontier AI requires enormous quantities of advanced semiconductors, that those semiconductors are manufactured in a small number of identifiable places, and that shipments can therefore be counted, licensed, and stopped. It is a policy built for objects. Objects have serial numbers. They clear customs. They can be denied. A Reuters review of more than 80 Chinese academic papers and patents, published on July 31, suggests that a meaningful amount of the capability those controls were designed to withhold has been moving across the border anyway — not in shipping containers, but as ordinary text returned by commercial chatbots.
Reuters reports that researchers affiliated with Chinese military and security institutions have used outputs from models built by OpenAI and Anthropic to train domestic systems, with applications spanning defense, surveillance, drone operations, cyberwarfare, and battlefield planning. The mechanism named throughout the documents is model distillation: a large, capable system generates answers, explanations, or labels, and those generated examples become the training set for a smaller model that can be deployed locally. A separate analysis by Sunny Cheung, a fellow at the Jamestown Foundation, examined more than 60 papers and described a systematic pattern of capturing the reasoning steps produced by Western models for surveillance and cyber-warfare applications. The two counts come from two different reviews and should not be added together.
The specific uses described are notable mostly for how unglamorous they are. This is not exotic capability theft. It is competent, cheap engineering.
Training a large language model from scratch is expensive because the hard part is not the architecture — it is assembling enough high-quality labeled data to teach the model what good answers look like. Distillation collapses that problem. If a capable model already produces good answers, you can simply ask it a few hundred thousand questions, keep the responses, and train your own smaller model to imitate them. The student never sees the teacher's weights and never needs the teacher's compute budget. It inherits a compressed version of the teacher's judgment on the narrow slice of tasks you asked about. For a general-purpose assistant this produces a noticeably weaker product. For a single specialized task — classify this text, summarize this code, triage these images — it often produces something close enough to be operationally useful, at a tiny fraction of the cost.
“Export controls were designed to stop a thing from crossing a border. Distillation moves a capability across the border as a conversation.”
Semiconductor restrictions work, to the extent they work, because the supply chain is physical and concentrated. There are few fabs, few advanced packaging facilities, and a finite number of ways to move a rack of accelerators between continents. None of that applies here. Model outputs are generated on demand, are indistinguishable from any other API traffic, and can be produced by anyone with an account and a payment method. Requests can be routed through intermediaries, resellers, cloud tenants, or academic collaborations. Collection can happen quietly over months and finish before any restriction is imposed. And once the generated dataset exists, it is just a file — it can be copied indefinitely, and no subsequent policy change can un-copy it. Usage policies at every major lab prohibit military applications, but a terms-of-service violation discovered after the fact is a contractual problem, not a control.
There is a real menu of responses available to AI companies and to Washington. It is worth being clear-eyed about how much each one actually buys.
Every one of these measures raises friction. None of them is a control in the sense that a chip license is a control. That gap is the actual news in the Reuters review, and it is not a gap that better enforcement of the current regime closes.
The policy question is no longer whether to restrict compute. It is whether a model's outputs are a strategic good — and if they are, what regime could possibly govern something that ships as plain text.
None of this means chip controls were pointless. Compute restrictions still constrain what China can train at the frontier, and a distilled model is bounded by the teacher it copied — you cannot distill a capability the teacher does not have. But the documents Reuters reviewed describe an adversary that did not need frontier capability. It needed a competent code summarizer that runs on an air-gapped network, and a text classifier that flags the right social media posts. Those are solved problems, and they were solved with a commercial API and a credit card. Any serious policy conversation about AI and national security now has to start from that fact rather than from the comfortable assumption that capability travels in crates.
Distillation means training a smaller model on the outputs of a larger one, so the smaller model imitates the larger model's behavior on specific tasks. It is a standard, widely published machine-learning technique. Using a commercial model's outputs to train a competing or downstream model typically violates the provider's terms of service, but terms-of-service violations are contract matters — they are not the same as export-control violations, and enforcement generally requires discovering the misuse after it has already happened.
DrafterDaily breaks down the mechanisms, not just the news. One email each morning.
Claude Fable 5.1 costs exactly what Fable 5 cost per token. The 25-to-45% saving Anthropic advertises comes from one repriced line item — cached input, now billed at 2.5% of list instead of 10%. That is a discount you only collect if you keep the agent running.
Anthropic was not breached. The malware was already on the customer's machine, and it took a session cookie rather than a password — which is why two-factor authentication did nothing and why server-side revocation is the only lever the vendor has.
OpenAI's incident report on the Hugging Face breach leads on a security failure. The remarkable part is a verbatim chain-of-thought in which a model identifies its action as unauthorised and proceeds anyway — and an escape route that was a package manager, not a superintelligence.