It is one of the most divisive topics in the AI sphere right now, with far-reaching geopolitical implications as a grave add-on: did Moonshot distill its Kimi K3 model from Anthropic's model? Most detractors point to the ~2 week window between the public rollout of Fable and Kimi K3 to suggest that an expansive distillation is virtually impossible here. But, a newly discovered API vulnerability might just be the smoking gun US-based AI labs have been looking for.
Moonshot's Kimi K3 demonstrated an unusually high statistical probability of predicting and continuing Claude's text versus other open-weight models like DeepSeek-V4-Flash
AI models "think" internally before answering, but AI labs typically lock this chain-of-thought inside an encrypted text block so users only see the final response. These encrypted text blobs are then sent back and forth to your browser to save server memory.
A new research paper , however, has found a major vulnerability in this framework. Apparently, AI model providers - OpenAI, Anthropic, and Google - used global encryption keys across their entire ecosystem.
What's more, while smarter models (like Claude Opus) are trained to refuse requests to reveal their secret thoughts, you can copy Opus' encrypted thought block and feed it to a weaker, cheaper sibling model (like Claude Haiku). The weaker model lacks strict guardrails, decycles the block, and prints out the smart model's exact thoughts.
This is dangerous due to three reasons:
- Data and Credential Leaks: Developers routinely post session logs online, unaware that sensitive data is trapped inside encrypted blocks. Researchers decoded public logs and uncovered 367 pieces of personal information and 182 secret credentials (including API keys and passwords).
- Safety Bypasses: Even if an AI refuses to give a dangerous final answer, its decrypted thought process often reveals the harmful steps it pondered internally.
- Hidden Injections: Attackers can hide malicious commands directly inside these invisible encrypted blocks to hijack AI workflows.
Moreover, study authors find that "distilling reasoning traces may have been possible for a long time without ever breaking the cryptography."
As an interesting exercise, the study authors then fed just a 1 percent fragment of Claude Opus 4.8's decoded reasoning into Kimi K3. Surprisingly, the Kimi K3's subsequent thinking and final answer shifted dramatically to match Claude's style and wording.
In fact, "specific Claude and GPT reasoning spans are up to ~6 orders of magnitude easier to extract from Kimi-K3 than from the next-closest model."
According to the study authors, Kimi K3 demonstrated an unusually high statistical probability of predicting and continuing Claude's text compared to other open models like DeepSeek-V4-Flash, which suggests strong behavioral compatibility with the reasoning patterns of Claude Opus.
Of course, we likely won't be able to definitively prove distillation unless Moonshot's CEO himself suddenly starts shouting from the rooftops (fingers crossed). Short of that very unlikely outcome, this might be as good as it gets to put the lingering doubts about the Kimi K3's distillation status to rest.
As we explained recently, Moonshot has jumped right into the ongoing multi-dimensional struggle between China and the US, with Anthropic and some members of the Trump administration accusing the AI lab of distilling its Kimi K3 model from Anthropic's models.
The US has long suspected that Chinese engineers often take their model-laden hard drives to US-friendly countries to imbue their models with frontier-level capabilities by using reinforcement learning techniques on cutting-edge NVIDIA GPUs.
Apparently, as per the allegations leveled by a Trump administration official recently, Moonshot not only furtively owns some NVIDIA GB300 servers, but was also able to access additional GB300s via Thailand.
Follow Wccftech on Google to get more of our news coverage in your feeds.