Introduction: The Intelligence Did Not Cross the Border in a Shipping Container
For years, the most vivid image of the U.S.–China artificial-intelligence competition was physical, and deliberately so. It was a semiconductor hidden inside a mislabeled shipment, a server rerouted through an intermediary country, an advanced accelerator acquired through a distributor with a conveniently vague customer list, or a datacenter quietly assembled from chips that Washington had spent years trying to keep out of Chinese hands. The strategic assumption underlying that imagery was straightforward, and for a long time it was largely correct: frontier artificial intelligence depended upon frontier computation, frontier computation depended upon advanced accelerators, and therefore controlling access to those accelerators could meaningfully slow an adversary’s progress toward the technological frontier.
That logic was powerful enough to create an entire geopolitical architecture around silicon. Nvidia accelerators became objects of national-security policy in a way that no commercial semiconductor product had ever been before. The U.S. Commerce Department developed increasingly elaborate restrictions on advanced computing products and on the infrastructure used to train advanced models. Governments began paying much closer attention to cloud access agreements, semiconductor intermediaries, overseas datacenter construction, and the possibility that restricted chips could be redirected toward prohibited users through chains of shell companies and gray-market resellers. In that earlier era of the AI competition, the central policy question could almost be reduced to a customs problem: Where are the chips going? Congressional hearings in early 2026 were still dominated by exactly this framing, with lawmakers describing smuggled Blackwell processors and Huawei’s stockpiles of components acquired through intermediaries as the principal channels through which American AI advantage was leaking abroad [25].
Then, during the summer of 2026, a very different kind of transfer allegedly occurred—one that no customs inspector could have intercepted, because nothing physical ever moved.
On September 10, 2026, Anthropic published its fourth and most detailed threat-intelligence report, Detecting and Countering Misuse of AI: September 2026, a 154-page document covering malicious activity the company says it identified and disrupted between December 2025 and August 2026 across seven harm areas, including a category it now treats as a first-order national-security problem in its own right: illicit distillation [1] [27]. According to the report, operators that Anthropic attributed to Alibaba conducted what the company described as the largest unauthorized model-distillation campaign it had ever measured. Anthropic said it observed more than 151 million exchanges between May and July 2026, at times approaching three million exchanges per day, flowing through a network of more than 3,500 accounts that the company characterized as fraudulent—accounts opened with disposable email addresses and virtual payment cards, engineered to obscure the true origin of access [2] [3]. What allowed Anthropic to attribute thousands of superficially unrelated accounts to a single coordinated operation was a telling forensic detail: the accounts shared a single fixed prompt, engineered specifically to force Claude to expose its chain-of-thought reasoning, converting every interaction into a structured unit of training data [3]. Anthropic alleged that the campaign targeted the reasoning traces and capabilities of its Claude Opus models—agentic work, software engineering, kernel development, and long-horizon tasks—and that the resulting material was used in development work connected to Alibaba’s Qwen family of models and its reinforcement-learning infrastructure [1] [3].
Alibaba was not the only company named. Anthropic also alleged that Moonshot AI, developer of the Kimi family of models, routed large quantities of its own users’ requests onward to Claude and retained at least some of the resulting exchanges for model development; over one ten-day period, Anthropic says roughly 300,000 requests reached Claude through a network of approximately 5,000 accounts, and at least one request it assessed as likely originating from a military-linked user [3]. The company separately attributed more than 12 million exchanges over a fourteen-day period in July to DeepSeek-related activity, and said that some traffic originally submitted by users to Chinese consumer services was silently relayed to Claude without those users necessarily understanding that their information was leaving the platform they believed they were using [1] [3]. Reuters and other outlets reported the allegations as part of a broader disclosure concerning unauthorized use of Anthropic systems by actors in China, Russia, and other unsupported jurisdictions [2]. The report itself is unambiguous about the trajectory:
Anthropic, Detecting and Countering Misuse of AI: September 2026 [3] > “Unauthorized labs have developed increasingly sophisticated methods to circumvent our defenses.”
Two days before Anthropic’s disclosure, the U.S. government made the same argument in its own voice. On September 8, 2026, the National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation issued a joint Cybersecurity Advisory—AA26-251A—with an unusually blunt title: “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies.” The advisory names six firms—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—and asserts that these companies have extracted billions of tokens across millions of exchanges from U.S. frontier models including Claude, GPT, Gemini, and Grok since 2024, likely with the awareness of the Chinese government [4] [26]. The agencies took care to note that distillation is a recognized and legitimate technique in AI research, before characterizing what they observed as something categorically different:
NSA, CISA, and FBI Joint Cybersecurity Advisory AA26-251A [4] > “Aggressive, malicious, and targeted distillation activities at an industrial scale.”
It must be stated clearly, here and throughout this paper, that these are allegations and technical attributions by Anthropic and by U.S. government agencies, rather than findings independently adjudicated by a court or regulator. Alibaba, DeepSeek, Moonshot, and the other named firms did not respond to requests for comment from major outlets [15], China’s Ministry of Commerce formally rejected the accusations on September 9 and warned of countermeasures if they were used to justify new restrictions [30], and a public advisory is an accusation, not a conviction. But the strategic significance of the episode is larger than the eventual adjudication of any individual number, and larger than the specific companies named.
Consider what did not happen. Nothing resembling an Nvidia GPU had to cross a border for the most important resource to move. No employee needed to walk out of a laboratory carrying a hard drive containing Claude’s proprietary model weights. No datacenter needed to be physically seized, no fab compromised, no shipment diverted through Singapore or the Gulf. Instead—if Anthropic’s allegations are substantially correct—economically valuable characteristics of a frontier system could be observed, at industrial scale, through the very interface by which that system served its legitimate customers. The commercial product itself had become a source of training material for its competitors.
That is the transition this paper calls Capability Harvesting.
Capability Harvesting describes the systematic acquisition, aggregation, and reuse of the observable behavior of a more capable artificial-intelligence system in order to accelerate the development of another system. It does not necessarily reproduce the original model. It does not imply that the student possesses an identical architecture, dataset, safety system, or collection of weights. Instead, it captures something strategically more important: the possibility that a rival can acquire part of the economic and functional value created by another laboratory’s enormous investment without duplicating every step required to create that value from the beginning.
That possibility changes the geopolitics of artificial intelligence, and it does so at a moment of maximal competitive sensitivity.
We previously examined Export Evasion as the problem of restricted physical technology finding alternative routes across national boundaries. Capability Harvesting is its conceptual successor, because the object being transferred changes. Export Evasion asks how a country obtains the scarce machine that produces intelligence. Capability Harvesting asks how a country can learn from intelligence that has already been produced elsewhere. The difference is fundamental. A semiconductor is rivalrous: if one organization owns an H100, a B200, a Rubin-class accelerator, or another controlled device, the physical hardware exists at a particular location, and governments can identify factories, shipments, distributors, cloud clusters, and datacenters. A model response behaves differently. Once frontier intelligence is offered through an API, a consumer application, a coding tool, a cloud marketplace, or an agentic service, fragments of its behavior can be observed from almost anywhere the service can be reached. The border has moved. The strategic frontier increasingly sits between the model and the user.
And that means the United States could eventually discover an uncomfortable truth: it may succeed at making frontier chips difficult to obtain while simultaneously making portions of frontier intelligence comparatively easy to query.
This is especially important because the underlying technique—model distillation—is not inherently malicious. Distillation is a legitimate and foundational part of modern machine learning, formalized in the academic literature more than a decade ago and industrialized by every major laboratory since. A larger “teacher” model produces examples, evaluations, or probability distributions that help train a smaller “student” model. OpenAI has itself offered developers an authorized distillation workflow designed to transfer useful capabilities from larger models into smaller, more economical systems, and Anthropic distinguishes legitimate model development from uses of Claude outputs that violate its contractual restrictions—particularly the training of competing general-purpose models without permission [6] [7]. The geopolitical problem therefore does not arise because someone invented a uniquely hostile technique. It arises because a perfectly normal industrial method for compressing intelligence also creates a mechanism through which the output of a frontier system can become an input into a competitor’s development process.
This matters at precisely the moment when American and Chinese model capabilities have been converging with startling speed. Stanford’s 2026 AI Index, released on April 13, 2026, concluded that the U.S.–China model-performance gap had effectively narrowed to the low single digits: as of March 2026, the leading U.S. model—Anthropic’s Claude Opus 4.6, at an Arena score of 1,503—held only a 2.7 percent advantage over the strongest Chinese model, ByteDance’s Dola-Seed-2.0 Preview, at 1,464 [8] [9]. In May 2023, comparable gaps across major benchmarks had ranged from 17.5 to 31.6 percentage points [8]. Stanford’s data also show that this convergence occurred while the United States outspent China on private AI investment by roughly twenty-three to one—$285.9 billion against $12.4 billion in 2025—a ratio that raises hard questions about whether capital intensity alone still buys durable advantage [8].
And progress has continued, on both sides of the Pacific, at industrial pace. On September 10, 2026—the same day Anthropic disclosed its allegations—DeepSeek announced V4.1-Flash, a 552-billion-parameter mixture-of-experts system built on a new Causal Encoder-Decoder architecture that activates only 8 billion parameters per token on input and 16 billion on output, carries a one-million-token context window, dramatically shrinks its memory cache footprint, and ships open weights under an MIT license at prices that undercut its own previous flagship [12]. DeepSeek presented the architecture as another attempt to extract greater intelligence from less expensive inference—which is to say, another attack on the very scarcity that American export controls were designed to enforce.
This juxtaposition provides the central question of this paper:
What if the decisive resource in the next phase of the U.S.–China AI competition is not merely computation, but access to the observable behavior of computation performed somewhere else?
If that is true, semiconductor export control remains important—but insufficient. The Five-Layer AI Economy must therefore be understood not merely as a vertical stack of Energy → Chips → Datacenters → Models → Applications and Agents. It is also a circulatory system through which capabilities can travel downward, upward, and sideways. Energy enables chips. Chips enable models. But once models begin generating enormous quantities of economically valuable reasoning, code, decisions, and agentic trajectories, Layer 4 itself begins producing a new strategic raw material. That raw material is intelligence in observable form. And harvesting it may prove much easier than rebuilding the entire industrial system that originally produced it.
Why I Chose the Title “Capability Harvesting”
I chose Capability Harvesting because the term describes a structural change in what can be collected from a frontier AI system, and because the existing vocabulary of technology security fails to describe it. Traditional cybersecurity language emphasizes stealing files, exfiltrating source code, copying weights, or compromising infrastructure—discrete acts against discrete artifacts. But frontier models expose another valuable resource every time they operate: observable capability. A sophisticated model continuously demonstrates how it codes, reasons, plans, decomposes problems, uses tools, evaluates alternatives, and responds to specialized tasks. Individual answers may appear disposable, and in isolation most of them are. But millions of carefully selected interactions constitute something much more valuable: a large, structured corpus describing how a frontier intelligence behaves across the distribution of tasks that matter economically. “Harvesting” captures this cumulative, patient, agricultural quality of the process. The strategic prize is not one stolen artifact. It is the repeated collection of useful behavioral signals until those signals can help another system become more capable. The forensic details of the alleged Alibaba campaign—a single fixed prompt, replicated across thousands of accounts, engineered to force chain-of-thought output—describe exactly this: not a burglary, but a combine moving methodically through a field [3] [9].
The title also deliberately moves beyond Export Evasion. Export Evasion described a world in which strategic advantage depended on getting controlled physical compute across a border, and in which the defender’s instruments—entity lists, license requirements, end-use checks—operated on objects that could be counted and located. Capability Harvesting describes a world in which some portion of the advantage embodied in that compute can cross borders digitally, through model interaction itself, in volumes measured not in units shipped but in tokens exchanged. That makes the phrase particularly appropriate for the Five-Layer AI Economy. The United States may dominate Layer 2 chips, Layer 3 hyperscale infrastructure, and important parts of Layer 4 frontier-model development, yet capability can still diffuse at Layers 4 and 5, through the interfaces those layers necessarily expose in order to earn revenue. The title therefore captures the paper’s central paradox: a country can restrict access to the machine while remaining exposed through the intelligence generated by the machine. America can protect the tractor, the seed inventory, and the field itself. But if the crop is continuously displayed at the edge of the field—because displaying it is precisely how the farm earns its living—then protecting the machinery alone cannot protect all of the economic knowledge embodied in the harvest.
Section 1: Chips Were Yesterday’s Chokepoint; Model Outputs Become Tomorrow’s Strategic Input
1.1 The First Geography of AI Power Was Physical
The early geopolitical architecture of advanced artificial intelligence emerged from scarcity, and the scarcity was tangible. Frontier AI required enormous quantities of advanced computation. Advanced computation depended on highly specialized accelerators. Those accelerators depended in turn upon a narrow semiconductor-manufacturing ecosystem involving Nvidia and a handful of other chip designers, advanced foundries such as TSMC, high-bandwidth memory manufacturers, advanced packaging capacity, extreme-ultraviolet lithography equipment produced by a single Dutch company, specialized networking silicon, and datacenters whose power requirements now rival those of mid-sized cities. Every link in that chain was concentrated in a small number of firms and jurisdictions, and concentration created chokepoints.
The United States and its allies therefore possessed tools that were familiar from previous generations of industrial policy: export licenses, entity lists, controls on manufacturing equipment, restrictions on advanced computing chips, and limitations on certain activities involving advanced training infrastructure. The Bureau of Industry and Security has explicitly treated access to advanced computing integrated circuits as potentially relevant to military-intelligence and weapons-of-mass-destruction end uses involving China and other restricted jurisdictions, and the evolving regulatory framework has itself come to differentiate among compute, training activity, model weights, and ordinary inference access—an implicit acknowledgment, written into the law’s own categories, that these are distinct strategic goods with distinct diffusion properties [20] [29].
This physical approach made strategic sense because the frontier was compute-intensive, and the economics of the frontier kept confirming it. Nvidia’s results for its second quarter of fiscal 2027, reported on August 26, 2026, showed revenue of $96.2 billion—up 106 percent from a year earlier—of which $89.0 billion came from the datacenter segment alone, with the company guiding to roughly $108 billion for the following quarter and its CEO describing accelerated computing as the substrate of a new industrial economy [13].
Jensen Huang, founder and CEO of NVIDIA [13] > “Now, compute is revenue.”
When a single supplier of AI accelerators generates nearly ninety billion dollars of datacenter revenue in thirteen weeks, the intuition that compute is the strategic commodity of the era seems self-evidently correct. And indeed it is correct—as far as it goes. The assumption, however, always contained an implicit second assumption riding silently on top of the first: that if one could limit the inputs required to build a frontier model, one could substantially limit the speed at which frontier capability itself diffused. Capability Harvesting complicates that second assumption without disturbing the first. The factory can be scarce while its products circulate.
1.2 The Model Is Both a Product and a Knowledge-Producing Machine
A traditional industrial product does not teach competitors how to manufacture itself every time it is used. A jet engine produces thrust; observing the thrust tells a rival little about single-crystal turbine-blade metallurgy. A semiconductor performs calculations; running those calculations reveals nothing about the lithography that produced the chip. A turbine generates electricity without disclosing its blade geometry to the grid.
A frontier model is different, because its commercial output consists partly of demonstrations of cognition. Ask an advanced coding model to solve a difficult programming problem, and it demonstrates a solution—not merely the answer, but frequently the decomposition, the intermediate reasoning, the error-checking, and the stylistic conventions of expert work. Ask an agent to decompose a complex workflow, and it demonstrates planning. Ask a reasoning system to evaluate alternative approaches, and it demonstrates decision structure. Ask a frontier model to critique weaker model outputs, and it generates preference information of exactly the kind used in reinforcement learning from AI feedback. Ask it to construct synthetic examples, and it generates data. This is what makes inference strategically unusual among all industrial outputs: it produces commercial value for the customer while potentially producing learning material for whoever records the interaction.
In ordinary usage, that dual character is enormously beneficial and entirely legitimate. Enterprises create datasets from model outputs. Developers build specialized systems on teacher-generated examples. Researchers evaluate models by studying their behavior. Smaller models are improved using authorized teacher outputs through documented, contractually sanctioned distillation workflows. But the same property means that the commercial interface of a frontier AI laboratory is also a partial observation window into the laboratory’s accumulated capability. The window is partial in important ways. The model does not normally reveal its complete weights. It does not reveal the original pretraining corpus, the failed experiments, the reinforcement-learning environments, the evaluation suites, the distributed-systems engineering, the safety research, or the tacit organizational knowledge that produced the system. Yet it reveals enough behavior to be economically useful to a sophisticated observer—and the September 2026 disclosures suggest that sophisticated observers have understood this for some time. That distinction is essential to everything that follows: Capability Harvesting is behavioral reconstruction, not literal duplication. The harvester does not obtain the teacher. It obtains a curriculum written by the teacher.
1.3 Intelligence Becomes a Derived Commodity
Within the Five-Layer AI Economy, the first three layers create the production environment for intelligence. Layer 1—Energy—powers the infrastructure, and has itself become a binding constraint, with global AI datacenter capacity reaching roughly 29.6 gigawatts according to Stanford’s 2026 accounting [8]. Layer 2—Chips—performs the computation. Layer 3—Datacenters—concentrates computation at industrial scale. Layer 4 transforms those resources into models, and Layer 5 commercializes those models through applications and increasingly autonomous agents.
Capability Harvesting introduces an additional circulation mechanism into this architecture. Once Layer 4 has converted gigawatts, GPUs, networking fabric, human talent, curated datasets, and billions of dollars of research spending into an advanced model, the outputs of that model can become inputs into another development cycle—potentially someone else’s development cycle. That means intelligence is no longer merely the final product of the stack. It becomes an intermediate good, in the classical economic sense: a produced input into further production. One laboratory spends the capital required to discover a capability. Another organization may be able to learn from observable manifestations of that capability at dramatically lower marginal cost. The industrial implication is profound. The AI economy may contain a persistent asymmetry between the cost of discovering intelligence and the cost of imitating portions of intelligence once discovered—an asymmetry that Section 2 examines in economic detail, and that no amount of border enforcement can fully close, because the asymmetry lives in the mathematics of learning rather than in the logistics of shipping.
1.4 From Export Evasion to Capability Diffusion
Export Evasion remains, at bottom, a physical logistics problem. A controlled chip may move through an intermediary jurisdiction. A cloud cluster might serve users whose ultimate identity is obscured. A restricted accelerator may reach a prohibited destination through unauthorized resale. These problems continue to matter enormously—congressional testimony in February 2026 described DeepSeek models trained on smuggled Blackwell processors and Huawei chip stockpiles built from components acquired through TSMC before detection [25]—because compute continues to matter.
Capability Harvesting adds another path that operates in parallel and requires none of that logistics. Instead of moving the accelerator toward the learner, the learner obtains outputs generated by an accelerator operating elsewhere. The underlying compute may remain inside an American datacenter. The GPUs may remain subject to American law. The model weights may remain secured inside a frontier laboratory’s most protected infrastructure. Yet the resulting behavior can leave through the application layer, one API response at a time, at a marginal cost to the harvester of fractions of a cent per exchange. This creates what might be called a remote capability-transfer problem: America’s chips do the computation, America’s datacenters consume the electricity, America’s laboratories incur the research cost—but useful demonstrations of the resulting intelligence can be observed from abroad, through channels indistinguishable at first glance from paying customers.
None of this eliminates the value of semiconductor controls. A competitor still requires significant local compute to train, adapt, evaluate, and deploy its own systems; harvested demonstrations are raw material, not finished models. What changes is the development path. The competitor may not need to independently discover every capability. It needs only enough compute to learn what has already been demonstrated—and, as the next section shows, learning from demonstrations is systematically cheaper than discovering without them.
1.5 The Chokepoint Moves Up the Stack
The strategic chokepoint therefore begins migrating, layer by layer, up the Five-Layer AI Economy. During the first phase of the AI competition, policymakers focused heavily on Layer 2: Who has the GPUs? During the datacenter boom, attention expanded to Layer 3: Who has the compute clusters and the power to run them? Capability Harvesting forces a Layer 4 question that the existing policy apparatus was never designed to answer: Who can interrogate the frontier model, under what identity, at what scale, and for what downstream purpose?
Eventually Layer 5 becomes strategically relevant as well, for a reason that deserves emphasis. Agents generate far richer behavioral traces than simple chat systems, because agents plan, call tools, execute code, revise their own mistakes, maintain state, and operate across long tasks. The more valuable the interaction, the more valuable its trajectory may become as potential training material. A system that only completes sentences provides limited strategic information about how expert work is performed. A system capable of independently executing a six-hour software-engineering project—decomposing the specification, writing the code, running the tests, diagnosing the failures, and iterating to completion—demonstrates an enormous amount about the structure of competent long-horizon work. This is precisely why Anthropic’s report emphasizes that the alleged campaigns targeted agentic capabilities, chain-of-thought reasoning, and long-horizon software engineering rather than casual question-answering [1] [3], and why the joint federal advisory describes chain-of-thought extraction as an advanced tactic within a structured adversary lifecycle [4].
The frontier therefore becomes paradoxically more exposed as the product becomes more capable. The rise of agentic AI creates not simply a capability revolution. It creates a capability-observability revolution—and observability, at scale, is the raw material of harvest.
Section 2: Distillation Economics Versus Training From Scratch
2.1 Distillation Is an Economic Technology
The word “distillation” sometimes enters geopolitical discussion as though it describes a specialized form of theft. Technically, that is misleading, and the misunderstanding matters because sound policy must distinguish the technique from its abuse. Model distillation is fundamentally an efficiency technique with a long and respectable academic pedigree. A capable teacher generates information that helps a smaller or less capable student learn. Depending on the training design, the student can learn from final answers, from full probability distributions over outputs, from rankings and preferences, from structured worked examples, from synthetic datasets, or from other teacher-generated signals. The method is attractive precisely because the teacher has already performed some of the expensive intellectual work: the student inherits structure it would otherwise have to find by search.
The economics of this inheritance have now been quantified with unusual rigor. Research by Dan Busbridge and colleagues at Apple, presented at ICML 2025, developed empirical distillation scaling laws—predictive formulas estimating distilled-model performance as a function of total compute budget and its allocation between teacher and student [10]. The findings carry direct geopolitical weight. When a capable teacher already exists, or when one teacher can serve many students, distillation outperforms ordinary supervised learning across a range of compute budgets that scales predictably with student size. Only when the teacher itself must first be created for the benefit of a single student do the economics generally favor training from scratch [10]. Translated out of the language of machine learning and into the language of strategy, the result reads as follows: the country that pays to create the teacher may also, unintentionally, create an economic shortcut for countries trying to build students. The teacher’s existence is itself a subsidy to every learner who can reach it.
2.2 Discovery Cost and Replication Cost Are Not the Same
Frontier-model development is extraordinarily expensive because it involves far more than one final training run. The laboratory must conduct architecture experiments, most of which fail. It must build and continuously repair data pipelines. It must recruit researchers from one of the scarcest talent pools in the global economy. It must design reinforcement-learning environments, construct evaluation suites, engineer distributed-computing systems that keep tens of thousands of accelerators synchronized for months, test safety properties, build inference infrastructure, and then repeat the entire cycle for each new generation.
The best public accounting of these costs comes from Epoch AI. Its detailed cost model, developed with Stanford’s AI Index team, found that the amortized hardware and energy cost of frontier final training runs has grown by a factor of roughly 2.4 times per year since 2016, that AI accelerator chips and research staff each constitute tens of millions of dollars for models of the GPT-4 and Gemini Ultra generation, and that hardware and energy together represent roughly half to two-thirds of estimated development cost, with research personnel absorbing much of the remainder. Projecting the trend forward, Epoch concluded that the largest frontier training runs would exceed one billion dollars by 2027 if historical scaling continued—a threshold that public statements by frontier-laboratory executives suggest is arriving on schedule or early [11].
But once a frontier laboratory has solved a difficult capability problem, teaching examples that demonstrate the solved capability are far cheaper to produce than the original research process was. Generating a worked demonstration costs an inference call; discovering how to produce such demonstrations in the first place cost a research program. That asymmetry creates what we might call the Discovery–Imitation Gap. The first mover pays to search an enormous space of architectures, data mixtures, and training recipes, absorbing every failed branch of the search tree. The follower pays only to learn from the successful branch, which the first mover’s product now helpfully exhibits on demand. Artificial intelligence has always contained versions of this dynamic—through publications, employee mobility, open-source code, and academic conferences—and the field’s rapid progress owes much to it. What frontier models do is industrialize the dynamic. They can generate millions of customized demonstrations, tailored to precisely the capabilities the follower wishes to acquire, at a marginal cost approaching the price of tokens.
| Cost category | First mover (discovery) | Follower (harvesting-assisted) |
| Architecture search | Hundreds of failed and partial experiments over years | Largely inherited via observed behavior and published hints |
| Training data | Corpus construction, cleaning, licensing at petabyte scale | Teacher-generated synthetic data targeted at desired capabilities |
| Post-training know-how | RL environments, preference data, evaluation loops built from zero | Reasoning traces reveal the targets successful post-training achieves |
| Final training compute | Approaching $1B per largest run by 2027 [11] | Still substantial, but applied to a de-risked recipe |
| Uncertainty | Maximal—capability may not exist | Minimal—capability is demonstrated daily by the teacher |
Table 1. The Discovery–Imitation Gap. The follower does not escape compute costs, but escapes much of the search cost and nearly all of the uncertainty.
2.3 Synthetic Data Changes the Production Function
For most of the deep-learning era, data was treated as one of AI’s primary bottlenecks. The open internet provided enormous quantities of natural language, code, images, and video, but high-quality specialized examples—expert mathematical reasoning, professional-grade software engineering, long-horizon planning—remained scarce, and the scarcity was expected to bind harder as models consumed the accessible supply. Frontier models change this because they can manufacture examples. A capable model can produce programming tasks and their solutions; generate critiques and alternative reasoning pathways; simulate conversations; classify difficult edge cases; and construct synthetic environments for reinforcement learning. Consequently, the value of accessing a frontier model is no longer limited to receiving answers to one’s own questions. The model can become a synthetic-data refinery, converting inference capacity into training corpora.
This is the deeper economic mechanism behind Capability Harvesting, and it explains why the observed campaigns were structured the way they allegedly were. A rival does not need every output from a frontier model to be novel or perfect. It needs enough useful outputs, of the right kind, to alter the economics of its own model-development pipeline. The federal advisory’s account is explicit on this point: the named companies allegedly used U.S. model outputs to build supervised fine-tuning corpora, improve reinforcement-learning pipelines, and develop chain-of-thought reasoning capabilities—that is, they treated the teacher as a source of industrial inputs rather than as a conversational service [4] [21]. The advisory even challenges DeepSeek’s famous $5.6 million training-cost figure on precisely these grounds, arguing that the number omits the true cost of the data allegedly obtained through extensive distillation—the discovery cost that someone else paid [21].
2.4 The Post-Training Battlefield
Pretraining once dominated public conversation about model capability, and in the pretraining era, output observation would have been strategically marginal: the decisive assets were the corpus and the compute, neither of which leaks through an API. That world is changing. Increasing amounts of frontier performance now come from post-training—reinforcement learning, tool use, reasoning optimization, synthetic-data generation, evaluation loops, agent environments, and targeted capability enhancement. This shift strengthens the strategic significance of outputs considerably. When capability depends heavily on behavioral refinement, observing the behavior of the strongest systems provides clues about what successful post-training has achieved, what forms of reasoning it produces, and what the target of one’s own post-training effort should be.
Again, outputs do not disclose the complete recipe. But they provide targets, and targets reduce uncertainty—which, in research economics, is often the most expensive commodity of all. A model-development team trying to discover whether a particular form of agentic reasoning is achievable faces an open-ended exploration problem with an unknown answer. Once a competitor demonstrates that capability reliably, in public, millions of times per day, the problem changes character entirely: it becomes replication, with a known destination and observable waypoints. Proof that a capability is possible has enormous value of its own, independent of any specific training example. This is a lesson as old as industrial history—the second atomic bomb program in every country proceeded faster than the first, partly because the hardest question had been publicly answered—and frontier AI now answers such questions continuously, through its ordinary commercial operation.
2.5 Capability Arbitrage
This produces what can be called Capability Arbitrage. Suppose Laboratory A spends billions of dollars discovering a frontier coding capability. Laboratory B obtains access to Laboratory A’s deployed system—within legitimate licensing rules in some cases, outside them in others—and uses some of the resulting behavioral information to improve its own system. Laboratory B has not recreated Laboratory A’s research program. It has exploited a price difference between two markets: the market for originating capability, where the price is a multi-billion-dollar research enterprise, and the market for observing capability, where the price is metered API access. That difference becomes strategically significant when the arbitrage is repeated at enormous scale.
Anthropic’s allegation of more than 151 million Alibaba-associated exchanges is therefore important not merely because 151 million is a large number, but because of what the number reveals about industrialization. One prompt is a conversation. One thousand prompts are an evaluation dataset. Millions of carefully selected exchanges can become a component of a development pipeline. Hundreds of millions—organized around a fixed extraction prompt, sustained for months, resilient to account bans, escalating twelvefold across the aggregate campaigns from earlier in the year—begin to resemble an alternative form of R&D infrastructure, with the frontier laboratory’s own inference fleet as its unwitting core [3] [9] [22]. Anthropic’s June 2026 letter to the Senate had described 28.8 million exchanges through roughly 25,000 fraudulent accounts as the largest campaign then known; the September report more than quintupled that figure within a single quarter [22]. Whatever the ultimate adjudication of these specific claims, the trajectory they describe—from thousands, to millions, to hundreds of millions of harvested exchanges within eighteen months—is the trajectory of a technique being industrialized.
2.6 But Harvesting Does Not Eliminate the Need for Compute
This paper should not commit the opposite error and declare chips irrelevant. They are not, and the point deserves a full paragraph rather than a caveat. A student model still requires training, and training a 552-billion-parameter mixture-of-experts system on tens of trillions of tokens—as DeepSeek reports doing for V4.1-Flash [12]—consumes vast accelerator resources regardless of where the training data came from. Inference at consumer scale requires additional fleets. Reinforcement learning requires clusters. Evaluation consumes computation. Serving hundreds of millions of users requires datacenters, power, and cooling, which is why Alibaba’s capital expenditure surged 75 percent year-over-year to roughly $10 billion in the June 2026 quarter even as its cloud revenue grew 45 percent on AI demand [14]. Capability Harvesting changes the productivity of compute; it does not eliminate compute.
This means export controls can still raise the follower’s marginal cost, and meaningfully so. If a country has fewer advanced chips, weaker networking, constrained high-bandwidth-memory supply, or less reliable datacenter capacity, it may struggle to convert harvested knowledge into a globally competitive, continuously updated product. But policymakers should internalize the new relationship between the two instruments: compute controls constrain the factory; capability controls influence what the factory has to discover for itself. Both matter. Neither substitutes for the other. And a strategy that operates only on the first while the second leaks freely is a strategy that taxes the adversary’s hardware while subsidizing its research.
Section 3: Alibaba/Qwen, DeepSeek, Moonshot, and the U.S. Frontier Laboratories
3.1 Alibaba and the Industrial Scale of the Allegation
The Alibaba case is important above all because of its alleged scale, and because of who Alibaba is. Anthropic says operators associated with Alibaba’s Qwen organization—tracked internally as GTG-16005—sought chain-of-thought reasoning from Claude Opus models and generated more than 151 million observed exchanges during May through July 2026, peaking near three million exchanges per day. The company alleges the activity targeted software engineering, agentic work, and longer-horizon tasks; that the resulting transcripts fed supervised fine-tuning data for successive Qwen releases; and that Claude was additionally used to advance Alibaba’s reinforcement-learning environments and architecture research [1] [3]. The operation allegedly began through nearly 5,000 fraudulent accounts opened with disposable email addresses and virtual payment cards; when Anthropic banned those accounts, the operators reportedly migrated to fresh ones, sustaining the campaign through successive waves of enforcement [27]. When the allegations became public, Alibaba’s U.S.-listed shares fell roughly 2.7 percent to a 52-week low—a market echo, coincidentally, of the very percentage by which Stanford measured the U.S. frontier lead [22].
Whether every element of that attribution ultimately withstands external scrutiny is less important to this paper than the strategic possibility the episode demonstrates. At hundreds of millions of interactions, model access stops looking like ordinary benchmarking and starts looking like infrastructure. And the target of the alleged harvest was not chosen at random: Alibaba’s own launch materials for Qwen3.7-Max benchmarked the model directly against Claude Opus on software-engineering evaluations, scoring within half a point on SWE-Verified [9]. Benchmarking against the market leader is standard industry practice and proves nothing about training data. But it does establish that the model Anthropic names as the extraction target was also the yardstick Alibaba publicly chose for itself—the capability it most wanted the world to know it had matched.
Qwen is especially significant because Alibaba is not an isolated startup experimenting at the edges of the Chinese economy. The company’s June 2026 quarter results—reported August 20, 2026—show what full-stack integration means in practice: total revenue of RMB 268.95 billion (about $39.6 billion); an AI Cloud and Compute Services segment growing 45 percent year-over-year to RMB 48.4 billion; AI-related product revenue in triple-digit growth for a twelfth consecutive quarter; a corporate reorganization that consolidated its model labs, the Qwen consumer application, and the QwenWork enterprise agent into a dedicated AI Labs and Applications segment; capital expenditure of roughly $10 billion in a single quarter; and 250 million users who have had their first AI-driven shopping experience through Qwen’s agentic features [14].
Eddie Wu, Chief Executive Officer of Alibaba Group [14] > “Driven by the improving commercialization of our full-stack AI capabilities.”
That is the sentence of a company describing an ecosystem, not a chatbot. And it is why any capability gained at the model layer—however gained—can propagate through a much larger economic system: cloud infrastructure, enormous domestic distribution, enterprise customers, consumer super-apps, and the ability to disseminate open-weight models globally. The issue raised by the allegations is therefore not one company’s training corpus. It is ecosystem-scale diffusion: the question of how quickly a capability observed at Layer 4 can be absorbed, productized at Layer 5, and redistributed to hundreds of millions of users and thousands of downstream developers.
3.2 DeepSeek and the Economics of Efficiency
DeepSeek occupies a different position in the story: it is the company that changed global expectations about how efficiently frontier-like capabilities could be produced, and the company around which the distillation dispute first crystallized. OpenAI told U.S. lawmakers in a February 12, 2026 memo to the House Select Committee on China that it had detected activities consistent with ongoing attempts by DeepSeek-associated actors to obtain outputs from U.S. models for adversarial distillation, describing an evolving ecosystem involving obfuscated third-party routers, synthetic-data pipelines, and access through intermediaries, while emphasizing that legitimate distillation remains a normal development method [6] [18] [23]. The memo’s most quoted phrase framed the stakes in explicitly competitive terms:
OpenAI, memo to the U.S. House Select Committee on China [6] > “Ongoing efforts to free-ride on the capabilities developed by OpenAI.”
The concern was not new. Within days of DeepSeek-R1’s release in January 2025—the launch that briefly erased $589 billion of Nvidia’s market value in a single session [31]—OpenAI said it was reviewing indications that DeepSeek might have inappropriately distilled its models, and the White House’s AI adviser put the matter more bluntly still:
David Sacks, White House AI and Crypto Czar [7] > “They distilled knowledge out of OpenAI models.”
Anthropic’s September report separately attributed more than 12 million exchanges during a fourteen-day July window to DeepSeek-related activity and alleged that some user requests submitted to DeepSeek-facing services were silently relayed to Claude [1] [3]. Yet at the very same moment, DeepSeek continued demonstrating why efficiency is its deepest strategic commitment. Its September 10 release of V4.1-Flash—announced the same day as Anthropic’s report—describes a 552-billion-parameter mixture-of-experts model on a new Causal Encoder-Decoder architecture that activates only 8 billion parameters per token on input and 16 billion on output, trained from scratch on 45 trillion tokens, carrying a one-million-token context window with native image understanding, and shrinking its per-token memory cache to roughly one quarter of its predecessor’s—a reduction DeepSeek explicitly credits for API prices as low as $0.15 per million uncached input tokens off-peak, with open weights released under the MIT license [12]. On DeepSeek’s own benchmarks, the inexpensive Flash model outscores the company’s larger V4-Pro flagship on coding and agentic tasks, and the flagship itself is being retired in Flash’s favor [12].
This illustrates why Capability Harvesting matters economically, and why it cannot be analyzed separately from efficiency innovation. A country constrained in the quantity of frontier accelerators available to it has a particularly strong incentive to improve the intelligence yield per accelerator. Distillation, architectural efficiency, sparse activation, aggressive quantization, cache compression, and stronger post-training all attack the same strategic problem from different directions: they make each unit of compute more productive. The relevant question for export policy is therefore not simply how many chips does China obtain? It is: how much capability can China produce from every chip it possesses?—and every successful harvest raises that ratio.
3.3 Moonshot and the Model-Routing Problem
The Moonshot allegations reveal a structurally different dimension of the problem—one that implicates the architecture of the modern AI application economy rather than any single company’s conduct. Anthropic alleges that Moonshot sometimes routed requests made to its Kimi services onward to Claude, returned Claude-derived answers to its own customers, and retained at least some interactions for model development; over one ten-day period, roughly 300,000 requests allegedly reached Claude through a network of about 5,000 accounts, primarily targeting Opus-class models. The report’s most unsettling detail concerns provenance: among the relayed traffic, Anthropic identified at least one request—asking Claude to assess closed-circuit surveillance footage for abnormal behavior—that it assessed as likely originating from a Chinese military-linked user, passed through Moonshot’s routing layer without Claude, or presumably the end user, understanding the true path of the request [3]. The federal advisory adds that Moonshot has used U.S. frontier models since at least mid-2025 to improve software engineering, mathematics, supervised fine-tuning, and reinforcement learning in its Kimi models [21].
That set of allegations raises a problem larger than distillation, because modern AI applications increasingly depend on routers by design. A user may believe she is communicating with Model A while an orchestration layer decides that her request should actually be processed by Model B. Enterprise platforms dynamically select among models based on price, latency, or quality. Agents invoke multiple models within a single task. Cloud marketplaces abstract away the identity of the underlying infrastructure. Third-party applications legitimately combine outputs from competing providers. These architectures make AI markedly more efficient—routing is one of the genuine engineering achievements of the application layer—but they also systematically weaken every simple assumption about identity on which access control depends. Who is actually consuming the frontier model? Who owns the original prompt? Where does the response go, and who retains it? Is the end customer aware that another provider processed the request? Can the ultimate use of the resulting output be determined by anyone in the chain? Anthropic’s report describes fraudulent AI reseller services that proxied traffic to other models while harvesting Anthropic account credentials along the way—routing abused as both extraction channel and supply-chain attack simultaneously [32]. The strategic problem therefore extends beyond Know Your Customer. It becomes something closer to Know Your Computation: understanding not merely who opened the account, but what economic and informational path each request and response actually travels.
3.4 U.S. Frontier Labs Become Strategic Infrastructure
Anthropic, OpenAI, Google, xAI, and the other frontier laboratories increasingly occupy a position historically associated with semiconductor manufacturers, cloud providers, and telecommunications carriers: private companies whose commercial operations constitute national strategic infrastructure. They are commercial corporations answerable to investors. But they operate technologies with direct national-security implications, and their APIs are channels through which extremely advanced capabilities reach global customers—and, allegedly, global harvesters. Their security teams consequently perform functions that now resemble a hybrid of fraud detection, cybersecurity, counterintelligence, and export-compliance monitoring. The U.S. government has begun treating them accordingly: by mid-2026, Washington had placed export controls on Anthropic’s most advanced Mythos-class and Fable-class models, and OpenAI had moved to restrict access to its GPT-5.6 series to a small group of companies approved by the administration [19]. The September 8 advisory formalized the relationship further, urging frontier companies to implement comprehensive detection of anomalous accounts and prompts, to alter responses served to suspected malicious activity, and to build industry-wide intelligence-sharing networks [4] [5].
Nick Andersen, Acting Director of CISA [5] > “We strongly urge AI companies to take immediate steps to safeguard their platforms.”
This creates a governance problem with no comfortable resolution, because the objectives in play do not align. The laboratories want maximum adoption; investors reward revenue growth; developers want simple, frictionless APIs; enterprises demand reliability and privacy; governments want strategic capabilities protected; safety teams want misuse detected and stopped. Every additional barrier to access reduces commercial growth. Every reduction in friction increases exposure. Capability Harvesting thus converts model distribution itself into a continuous strategic balancing act between diffusion and defense—conducted, uncomfortably, inside private companies whose quarterly incentives pull toward diffusion.
3.5 The U.S.–China Gap Is Too Small for Complacency
The strategic urgency of all this grows because China is no longer chasing from far behind; it is drafting inches off the leader’s wheel. Stanford’s 2026 AI Index found that U.S. and Chinese models had repeatedly exchanged positions near the frontier since early 2025, characterized the performance race as effectively closed, and measured the gap between the leading U.S. model and the strongest Chinese model at 2.7 percent as of March 2026 [8] [9]. The same report documents Chinese leadership in AI publication volume (23.2 percent of global output), citations, patent filings (69.7 percent of global filings), industrial-robot installations (roughly nine times the U.S. rate), and energy infrastructure buildout—while the United States retains its advantages in private investment, notable model production, and high-impact research [8] [28]. Perhaps most striking, Stanford found the number of AI researchers migrating into the United States had fallen 89 percent over seven years, with an 80 percent drop in the final year alone [8].
This convergence changes the strategic meaning of distillation entirely. If the technological gap were enormous, a competitor learning from model outputs might close some distance while remaining safely behind; the harvest would be a nuisance, not a threat. When the gap is 2.7 percent, marginal capability transfer matters enormously. An improvement that would be commercially modest in isolation could determine which ecosystem crosses the next agentic threshold first—which model first sustains reliable day-long autonomous engineering, or first automates a meaningful fraction of AI research itself. Competition at the frontier increasingly operates at the margin. Capability Harvesting is therefore not necessarily about copying an entire model. It matters if it compresses the remaining distance between two already-capable ecosystems—and 2.7 percent is not much distance to compress.
Section 4: API Identity, Rate Limits, Model-Output Controls, and Export Law
4.1 Identity Becomes Part of the AI Security Perimeter
The traditional cybersecurity perimeter protected machines: firewalls around networks, encryption around data, credentials around accounts. The emerging AI-security perimeter must also protect access patterns, which is a fundamentally harder problem because the individual units of access are each innocuous. A frontier laboratory needs to know not merely whether an account possesses valid payment credentials, but whether thousands of apparently unrelated accounts are acting as a single coordinated organization. The alleged campaigns illustrate the adversary’s playbook precisely: disposable email addresses, virtual payment cards, proxy infrastructure, automated failover between access pathways when one is blocked, and—in the Alibaba case—a population of accounts unified only by their shared extraction prompt, invisible as a network until analyzed at the level of behavior rather than identity [3] [4] [27].
This makes identity infrastructure strategically important in a way it has never been for a commercial software product. Model providers will increasingly need to distinguish among ordinary consumers, research users, authorized enterprise deployments, automated agents, intermediaries, resellers, and suspicious coordinated networks—categories that existing account systems were never designed to separate. In the same way financial institutions developed Know Your Customer regimes to understand transaction counterparties after decades of laundering scandals, frontier laboratories may need substantially stronger forms of Know Your Model Customer. But the calibration matters as much as the principle. Overly aggressive identity requirements would damage privacy, chill legitimate research, burden startups, and push international users toward less scrupulous providers—an outcome that would itself constitute strategic failure. The objective should not be universal surveillance of model users. It should be risk-based accountability concentrated at the highest-capability access tiers, where the strategic stakes justify the friction.
4.2 Rate Limits Evolve From Reliability Tools Into Security Controls
Historically, rate limits protected infrastructure from overload and enforced the boundaries between customer tiers; they were plumbing, not policy. Capability Harvesting gives them a second function. High-volume, highly repetitive, systematically structured request streams look different from ordinary human or even ordinary programmatic use, and that difference is now strategically meaningful. The analytical question shifts from how many tokens is this customer purchasing? to what economic activity could plausibly require this pattern of interaction?
The shift demands care, because volume alone can never constitute evidence of wrongdoing. A coding company may legitimately consume enormous output volume; a research institution may run millions of evaluations; an enterprise may generate synthetic datasets under an explicit license. Anthropic’s own attribution methodology implicitly concedes the point: what distinguished the alleged Alibaba campaign was not its size but the conjunction of size with a fixed extraction prompt, fraudulent account infrastructure, and systematic chain-of-thought targeting [3] [9]. Rate, structure, identity, timing, and task similarity together create risk signals that none creates alone. Frontier-model security will therefore increasingly depend on behavioral analytics operating across the full population of accounts—closer in spirit to anti-money-laundering surveillance than to conventional API management—and the federal advisory’s recommendation that providers detect anomalous prompts and account networks, and even degrade responses served to suspected extraction traffic, points in exactly this direction [4] [34].
4.3 Reasoning Visibility Becomes a Strategic Design Choice
The September allegations also elevate a product-design question into a strategic one: how much of a model’s internal process should be visible to its users? Frontier systems can expose different levels of reasoning. Some return only final answers. Others provide summaries of their reasoning. Some developer interfaces expose full trajectories; agents generate extensive execution logs by necessity. Developers genuinely value this visibility, because it improves debugging, interpretability, auditability, and trust—values the transparency community has rightly championed. Competitors value it for a different reason: detailed reasoning traces contain far richer learning signal than final answers alone, which is precisely why the alleged campaigns engineered prompts specifically to force chain-of-thought output [3] [4].
This creates a genuine tension between transparency and capability protection, and pretending otherwise serves no one. A provider that reveals extensive reasoning makes its system easier to understand, supervise, and improve—and simultaneously makes portions of its behavior easier to imitate. A provider that hides everything protects intellectual property while degrading auditability and user trust. Anthropic’s reported countermeasures—summarized rather than raw reasoning in exposed contexts, with full traces preserved internally for safety analysis—represent one point on this tradeoff curve, not its resolution [33]. There is no universal solution, and this paper does not pretend to one. The point is narrower and firmer: reasoning exposure has become a strategic product-design variable with national-security implications, not merely a user-interface decision, and laboratories should be making the choice deliberately, with both audiences—their developers and their harvesters—explicitly in view.
4.4 Contracts Are Not the Same as Export Controls
Both Anthropic and OpenAI restrict certain uses of model outputs through their terms of service: Anthropic permits numerous specialized, non-competing model-development activities while prohibiting use of Claude to train competing general-purpose models without authorization, and OpenAI’s terms similarly restrict use of output to develop competing models [7] [23]. These are contractual rules. Export controls are law. The distinction matters more than it might appear. Terms of service bind customers contractually, offer civil remedies, and can be enforced through account termination—remedies of limited value against a well-resourced foreign actor operating through fraudulent accounts from a jurisdiction where the contract is practically unenforceable. Export regulations express national-security policy, carry criminal and administrative enforcement mechanisms, and reach conduct that contracts cannot. Legal analysts examining the distillation disputes have noted that trade-secret and computer-fraud theories face serious jurisdictional obstacles against Chinese firms operating primarily outside U.S. reach, which is precisely why the dispute migrated so quickly from terms-of-service enforcement to congressional memos, White House memoranda, and interagency advisories [23] [31].
Current U.S. controls remain far more mature around physical compute, certain training activities, and advanced model weights than around the broad universe of ordinary model outputs—and the government has begun closing the gap in real time. The White House Office of Science and Technology Policy issued a National Security and Technology Memorandum on adversarial distillation of American AI models on April 23, 2026, designating the Commerce Department’s Bureau of Industry and Security as the enforcement arm and reporting that foreign actors were deploying tens of thousands of proxies in coordinated harvesting campaigns; Congress has taken up a proposed Deterring American AI Model Theft Act; and policy institutes have recommended Entity List additions and sanctions designations for distillation attackers and their enablers [20] [29]. Capability Harvesting exposes the underlying regulatory gap all of this activity is racing to fill. If output becomes a meaningful strategic input into foreign frontier-model development, governments must eventually answer a genuinely difficult question: when does inference cease to be an ordinary commercial service and become a controlled capability transfer?
4.5 Why a Blanket Model-Output Export Ban Would Be a Mistake
The obvious policy response—classify frontier-model access like controlled hardware and wall it off—would be too simple, and would likely be self-defeating. Broad API access is one of the principal reasons American AI platforms become global standards. It creates developer ecosystems that compound American advantage; it generates the revenue that finances the next generation of models; it fosters international dependence on American technology in exactly the way that dollar clearing fosters dependence on American finance; it gives American companies visibility into how frontier AI is actually being used worldwide; and it distributes safety improvements faster than any closed national system could. Excessive restriction would invert every one of those advantages. Foreign developers would migrate toward Chinese open-weight alternatives—which, as Stanford notes, briefly narrowed the gap to the strongest closed U.S. model to half a percentage point in this cycle [28]—American companies would lose visibility, China could become the default AI provider across much of the Global South, and open ecosystems would reorganize around non-American standards. Analysts of China’s domestic incentive architecture add a further warning: municipal compute-voucher programs and subsidy competitions mean that restriction on the American side is met by acceleration on the Chinese side, not by paralysis [24].
Skeptics of the emerging enforcement consensus deserve a hearing on the merits as well, because the line being policed is genuinely difficult to draw:
Erik Cambria, Professor of Artificial Intelligence, Nanyang Technological University [16] > “The boundary between legitimate use and adversarial exploitation is often blurry.”
Chinese scholars press the point from the other side, arguing that the technique itself cannot be criminalized without indicting the industry’s ordinary practice:
Liu Dian, Research Fellow, Fudan University China Institute [17] > “Model distillation itself is a technical method widely used across the global AI industry.”
And analysts outside both governments note the competitive convenience of the timing—RAND’s Austin Horng-En Wang observed that one plausible motive for escalating the accusations was to shore up the leading position of U.S. models by constraining rivals’ access [18]. These objections do not refute the allegations, which stand or fall on the forensic evidence. But they correctly identify the design constraint for policy: the correct objective is not to stop intelligence from being used, or to treat every high-volume foreign customer as an adversary. It is to distinguish ordinary use—even intensive, commercial, competitive ordinary use—from industrial-scale extraction conducted through fraud and misrepresentation for the purpose of reproducing strategically important capability. That is a far harder regulatory problem than banning a chip, and it deserves instruments designed for its actual shape.
4.6 A Future Capability-Control Framework
By 2027–2030, policymakers will likely need to supplement semiconductor export controls with a more nuanced capability-access regime, and its architecture can already be sketched. The framework should separate at least four categories conceptually. Ordinary consumer inference should remain broadly accessible, essentially untouched, because its strategic content is negligible and its economic and diplomatic value is enormous. Enterprise and developer access should retain commercial flexibility, governed primarily by contract, with standardized attestations about downstream use replacing today’s inconsistent terms-of-service patchwork. Very high-volume access to the most capable frontier systems—the tier where harvesting economics actually operate—should carry stronger verification, monitoring, and auditability obligations, shared between providers and government through the intelligence-exchange channels the September advisory proposes [4] [5]. And the highest-risk capabilities—those with major cyber, biological, military, or autonomous-agent implications—may require specialized access frameworks irrespective of whether the user physically possesses a single advanced chip, as the early controls on Mythos-class models already foreshadow [19].
This would represent an important and historically unusual transition. Export policy would move from controlling what hardware crosses the border toward also understanding what strategic capability crosses the interface. The customs house, in effect, acquires an API.
Section 5: The Geopolitical Implication: Controlling Silicon May Not Control Capability Diffusion
5.1 Semiconductor Controls Buy Time, Not Permanent Monopoly
The strongest argument for advanced semiconductor controls has never been that they could prevent China from developing artificial intelligence forever. Serious advocates of the controls never claimed that. China possesses world-class researchers, enormous domestic demand, deep capital markets increasingly redirected by the state toward strategic technology, sophisticated platform companies, and overwhelming incentives to eliminate dependence on American technology. What controls can do is raise costs, slow scaling, constrain cluster sizes, complicate advanced manufacturing, and increase the economic price of every experiment—effects that matter tremendously in a technology whose frontier moves in months. The controls purchase time, and in a compounding technology, time is the most valuable commodity a policy can buy.
Capability Harvesting means the time purchased by hardware controls can be partially refunded to the adversary if foreign developers learn extensively from the systems produced by unrestricted compute elsewhere. Every harvested demonstration shortens the follower’s search; every extracted reasoning trace converts a discovery problem into a replication problem; every silently relayed request lets constrained compute borrow the products of unconstrained compute. The strategic metric for the control regime should therefore be reframed. The question is not how many chips did we deny? It is: how much independent discovery time does the regime force upon the competitor? A regime that denies a million accelerators while permitting a hundred and fifty million capability demonstrations to flow outward may be forcing far less independent discovery than its chip-count suggests. That is a more demanding metric than counting shipments—but it is the metric that actually corresponds to the strategic objective.
5.2 Intelligence Is Becoming an Intangible Strategic Export
Industrial policy historically focused on tangible assets: ships, machine tools, aircraft, nuclear technology, semiconductors. Even the intangible categories of traditional export law—software, technical data, “deemed exports” through conversations with foreign nationals—assumed an identifiable artifact or a discrete disclosure event. Artificial intelligence creates a genuinely new category, because the most important product may be behavioral competence, transmitted through use.
Suppose a frontier model teaches a user how to write highly advanced code, one worked example at a time. Was software exported? Suppose an AI agent demonstrates an unusually effective planning strategy across ten thousand observed trajectories. Was technology transferred? Suppose millions of outputs are subsequently used to improve another nation’s model. At what point did commercial inference become industrial know-how? Existing legal concepts were not designed for a product that simultaneously functions as a service, a teacher, an evaluator, and a synthetic-data generator, and the definitional strain shows in every document the government has produced this year: the OSTP memorandum reaches for “adversarial distillation,” the interagency advisory for “industrial-scale campaigns,” the draft legislation for “model theft” [4] [20] [29]—each phrase an attempt to name a transfer whose value cannot be measured in kilograms, chips, or racks. The value crossing the border is measured in reduced uncertainty: the difference between a research program that must find its way and one that has been shown the way. Capability Harvesting is, in the strictest sense, an intangible export-control problem—the first one whose exported good is competence itself.
5.3 Open-Weight Models Make Containment Even Harder
The problem compounds once open-weight systems enter the picture, as they now decisively have. Open-weight models accelerate innovation, academic research, competition, sovereign deployment, and local customization—genuine and substantial goods. They also make capability diffusion effectively irreversible. A government can sanction a cloud provider; a company can terminate an account; an API can throttle, degrade, or refuse. A downloaded model can simply be copied. Once weights circulate, access control in the API sense ceases to exist for that artifact, permanently.
This means the U.S.–China competition is developing two parallel diffusion systems with different physics. The proprietary frontier distributes capability through controlled interfaces, where harvesting must be conducted against active defenses. The open-weight frontier distributes capability through freely transferable artifacts, where nothing need be harvested because everything is given. DeepSeek’s V4.1-Flash weights shipped on Hugging Face under the MIT license within hours of announcement [12]; Stanford’s Index found the strongest open-weight model within 3.4 percent of the leading closed U.S. model, after the gap briefly narrowed to half a point [28]. The two systems interact in ways that multiply the containment problem. Closed frontier models can be harvested to generate synthetic data; open models can absorb the improvements; the improved open models then spread globally beyond any recall; and the next round of harvesting begins from a higher base. Capability transfer therefore operates through chains—closed teacher, to intermediate corpus, to open student, to global diffusion—rather than through direct, traceable relationships between an origin and a destination. Interdicting any single link leaves the chain largely intact. There is an irony here that Chinese labs themselves appear to have registered: reporting on the 2026 Index noted that Alibaba and Zhipu were quietly narrowing their own open-source commitments just as their openness strategy achieved parity, suggesting that capability protection instincts are not an American monopoly [9].
5.4 The Five-Layer AI Economy Becomes a Five-Layer Security Problem
Capability Harvesting demonstrates why each layer of the Five-Layer AI Economy now requires its own security logic, and why securing any single layer secures nothing by itself.
| Layer | Strategic asset | Traditional control | Capability-Harvesting exposure |
| 1 — Energy | Gigawatts for strategic compute | Siting, grid policy, allocation | Efficiency gains shrink the energy needed to exploit harvested capability |
| 2 — Chips | Advanced accelerators | Export controls, entity lists | Harvest raises capability-per-chip, diluting denial |
| 3 — Datacenters | Clusters, cloud capacity | KYC for cloud, location rules | Proxied and resold access obscures who computes |
| 4 — Models | Weights, reasoning, evaluations | Weight security, ToS, new output rules | The commercial interface is the extraction surface |
| 5 — Apps & Agents | Routing, tools, autonomy | Almost none today | Routers relay, retain, and launder provenance |
Table 2. Each layer’s control regime can be undermined from an adjacent layer. Layer 2 denial is diluted by Layer 4 efficiency; Layer 4 interface defenses are bypassed by Layer 5 routing; Layer 4 restrictions are mooted by open weights.
The critical insight is architectural: the layers do not merely stack, they interpenetrate. Layer 2 control can be undermined by efficiency gains at Layer 4—every improvement in intelligence-per-FLOP is a partial repeal of an export rule. Layer 4 interface restrictions can be bypassed through Layer 5 products that obscure which model actually processed a request. Layer 3 restrictions dilute through distributed and resold cloud access. And Layer 4 output controls are permanently mooted for anything released as open weights. The Five-Layer AI Economy is therefore no longer only an industrial description. It is an interdependent national-security architecture, and it will be defended well or badly as a system, not as a list.
5.5 The 2027–2030 Race May Be About Intelligence Yield, Not Absolute Compute
This produces a different way of scoring the U.S.–China competition. Washington’s instinct is to measure advantage through quantities: GPUs procured, fabs constructed, datacenters energized, megawatts secured, capital deployed, training FLOPs accumulated. Those measurements remain necessary—Nvidia’s $89 billion datacenter quarter and the half-trillion dollars of annual global corporate AI investment are not artifacts of accounting [8] [13]. But the next phase of the race may be decided increasingly by a ratio: capability per unit of compute, what this paper calls Intelligence Yield.
A country with fewer GPUs that uses them more efficiently narrows a hardware disadvantage without acquiring a single additional chip. A laboratory with stronger synthetic data raises the productivity of every training run. A team that learns from a foreign teacher slashes experimentation cost. An architecture that quarters its memory footprint serves multiples more inference from the same infrastructure—which is exactly the design brief DeepSeek executed with V4.1-Flash [12]. A stronger agent generates more economic output per token. Stanford’s finding that China matched U.S. model performance while being outspent twenty-three to one is the macro-level expression of this ratio at work [8]; the CISA advisory’s insistence that DeepSeek’s celebrated training costs conceal the value of harvested data is the micro-level accusation about how part of the ratio was achieved [21]. Whether one credits efficiency genius, harvested capability, or—most plausibly—both, the strategic conclusion is identical: the transition from Compute Quantity to Intelligence Yield is underway, and Capability Harvesting is one of its principal instruments.
5.6 Three Possible Futures
Three futures now compete for the 2027–2030 horizon, and present policy will help determine which one arrives.
The first is Controlled Diffusion. American frontier laboratories retain a meaningful technical lead; detection of industrial-scale extraction improves faster than extraction techniques evolve; broad commercial access is preserved; and government-industry coordination concentrates on the genuinely dangerous capability tiers. Semiconductor controls continue buying development time, American models remain the global default, and capability diffuses—as it always will—but slowly enough that frontier leadership persists and compounds.
The second is Accelerated Convergence. Model outputs, open weights, publications, synthetic data, and efficiency innovations combine to erode the value of any single country’s compute advantage faster than that advantage can be rebuilt. Chinese companies remain modestly constrained by hardware but close the capability gap through architecture, post-training, and rapid absorption of whatever the frontier demonstrates. Model performance converges faster than semiconductor capacity diverges—which is, on Stanford’s numbers, a fair description of 2023 through 2026 already [8].
The third is Capability Multipolarity. By 2030, no country controls a durable frontier. The United States retains the strongest compute ecosystem; China fields highly efficient models atop the world’s largest open-weight ecosystem; Europe specializes in regulated industrial deployment; Gulf states supply capital and energy; dozens of countries assemble sovereign models from globally available architectures. Intelligence becomes internationally transferable even while physical infrastructure remains geographically concentrated. In that world, the most powerful country is not the one that possesses all intelligence—no one does—but the one whose ecosystem most effectively creates, protects, commercializes, and continuously renews capability.
The honest assessment of September 2026 is that the world sits somewhere between the first and second futures, with the third visible on the horizon. Which future consolidates depends less on any single export rule than on whether the renewal rate of the American frontier stays ahead of the harvest rate of its competitors.
Section 6: What Have We Learned? Seven Pillars
Pillar 1 — The Strategic Asset Is Moving From Compute Toward Capability
The first lesson is not that compute has stopped mattering; ninety-six billion dollars of quarterly Nvidia revenue forecloses that reading [13]. It is that compute is no longer sufficient as the unit of geopolitical analysis. Advanced accelerators are the machines from which frontier intelligence emerges, but once the intelligence exists, its observable behavior becomes a second strategic resource with entirely different diffusion physics. Export controls can constrain the production equipment; they cannot automatically prevent learning from the product. National AI strategy must therefore distinguish, explicitly and institutionally, between compute advantage and capability advantage. The United States currently possesses enormous strengths in both. The events of 2026 demonstrate that the two are not permanently coupled, and that an adversary denied the first will attack the second with everything it has.
Pillar 2 — Distillation Converts Frontier Leadership Into a Potential Externality
The second lesson is economic. Frontier leaders spend billions discovering capabilities, and those discoveries generate positive spillovers for customers, developers, researchers, and the global economy—spillovers that are the whole point of commercialization. But the same discoveries generate strategic spillovers for competitors, and distillation is the mechanism that converts the one into the other. The scaling-law literature makes the asymmetry precise: where a capable teacher exists, students learn more cheaply than they could ever discover [10]. That does not make distillation illegitimate—it makes access to frontier intelligence economically valuable in a way that traditional software licensing never contemplated. The frontier laboratory believes it is selling answers. It is simultaneously emitting training signal, and the difference between those two descriptions of the same API response is now a matter of national strategy.
Pillar 3 — Model Security Is Becoming Infrastructure Security
The third lesson is institutional. Anthropic, OpenAI, Google, xAI, and their successors can no longer treat misuse detection as ordinary trust-and-safety enforcement, because their access systems now perform functions with geopolitical consequences. Identity verification matters. Traffic analysis matters. Account-network detection matters. Model routing matters. Output policy matters. Agentic trajectories matter. API architecture has become part of the national-security surface of advanced artificial intelligence—which is precisely what the interagency advisory acknowledged when it asked private companies to detect coordinated foreign campaigns, degrade responses to suspected adversaries, and share threat intelligence across an industry [4] [5]. This does not mean frontier labs should become government agencies; their independence and commercial vitality are strategic assets in themselves. It means policymakers must recognize that a significant portion of national AI capability is operated by private companies whose commercial interfaces shape the international diffusion of strategic technology, and build the shared institutions that recognition implies.
Pillar 4 — Silicon Controls Must Become Stack Controls
The fourth lesson follows directly from the Five-Layer architecture. A strategy concentrated entirely on Layer 2 is now demonstrably incomplete. Energy policy determines whether strategic datacenters can be built; chip policy determines available computation; datacenter policy determines where compute operates and who reaches it; model policy shapes how capability can be accessed; application policy determines how capability reaches organizations, individuals—and harvesters. The security architecture must become multilayered without becoming totalitarian. Not every layer should be regulated identically; not every model output is sensitive; not every high-volume API customer warrants national-security screening, and a regime that pretends otherwise will strangle the ecosystem it exists to protect. But policymakers need visibility across the entire system, because the central question has changed from “Did the chip get through?” to “How did the capability get through?”—and the second question can only be answered by an instrument that sees all five layers at once.
Pillar 5 — Attribution and Measurement Are Now Strategic Capabilities in Their Own Right
The fifth lesson emerged from the forensics of 2026 itself. Every consequential claim in this new domain—151 million exchanges, 3,500 fraudulent accounts, a shared extraction prompt, billions of harvested tokens—rests on attribution performed by the victim, using telemetry only the victim possesses, published without independent adjudication [1] [3] [4]. Careful observers noted that the widely quoted totals were journalistic sums rather than report figures, that the counts are floors rather than measurements, and that none of the accused firms has substantively answered [9] [30]. This is not a reason for paralysis; it is a reason to treat measurement itself as strategic infrastructure. The United States and its allies need shared standards for detecting, quantifying, and attributing extraction campaigns—the AI-security equivalent of the norms that took cyber attribution from corporate press release to indictment-grade evidence over fifteen years. A control regime built on unverifiable claims will be contested into irrelevance, at home by civil libertarians and abroad by adversaries with their own counter-narratives. A regime built on auditable, cross-laboratory, methodologically transparent measurement can survive contact with both.
Pillar 6 — Legitimacy and Alliance Architecture Decide Whether Capability Controls Work
The sixth lesson is diplomatic. Capability controls, unlike chip controls, regulate a service the whole world uses daily, and their legitimacy will be contested continuously—by Chinese officialdom calling the accusations pretextual [17] [30], by scholars noting the blurriness of the line [16], by analysts observing the competitive convenience of the enforcement push [18], and by allied governments wary of American extraterritoriality reaching into their developers’ API calls. The chip-control coalition succeeded because it enrolled the Netherlands, Japan, Korea, and Taiwan around a small set of chokepoint firms. A capability-control regime has no equivalent natural coalition unless one is built: shared definitions of illicit extraction, reciprocal enforcement commitments, common high-risk capability tiers, and carve-outs that visibly protect legitimate research and commerce worldwide. Absent that architecture, unilateral American capability controls will be arbitraged through every friendly jurisdiction with an internet connection—and the moral distinction between protecting national assets and hoarding a general-purpose technology will be lost in translation, at real cost to the standards-setting power that broad diffusion was supposed to secure.
Pillar 7 — The Winner Will Be the Ecosystem That Regenerates Intelligence Fastest
The seventh lesson is the most important, and it disciplines all the others. No technological advantage in AI should be treated as permanently protectable. A frontier model becomes an older model within quarters. A secret architecture becomes understood. An expensive capability becomes cheap—DeepSeek now sells frontier-adjacent inference for fractions of a cent per million cached tokens [12]. A benchmark advantage disappears; Stanford watched thirty points of lead collapse to 2.7 in three years [8]. A scarce chip eventually meets a competitor. The sustainable national advantage therefore cannot come from freezing today’s frontier behind ever-higher walls; a sealed American intelligence fortress would fail economically before it failed technologically, and it would fail technologically too. The advantage comes from moving the frontier faster than competitors can absorb it—from ensuring that capability diffusion, which cannot be stopped, continuously trails capability creation, which can be accelerated. That requires chips, energy, datacenters, research talent, capital, global customers, strong model security, functioning talent pipelines—the 89 percent collapse in researcher migration into the United States is, on this logic, as strategically alarming as any harvesting campaign [8]—and above all, continuous invention. That is the Five-Layer AI Economy operating as a competitive national system rather than as a defended museum.
Conclusion: Why “Capability Harvesting” Defines the Next Phase of the AI Competition
For most of the semiconductor era, technological power could be visualized physically, and the visualization was accurate. Factories produced chips. Ships transported them. Datacenters installed them. Governments could count them; customs authorities could inspect shipments; intelligence agencies could investigate supply chains; export controls could specify model numbers, performance thresholds, and destination countries. The entire apparatus of technology security assumed—reasonably, for eighty years—that strategic value travels inside objects.
Artificial intelligence is making technological power less tangible, and 2026 was the year the intangibility became operational. The most important economic product created by a frontier AI cluster is not the cluster itself. It is capability. A fifty-billion-dollar datacenter exists to manufacture something that weighs nothing: reasoning, coding, planning, prediction, design, scientific inference, decision-making, agentic action. Once those capabilities are offered commercially—and they must be offered commercially, because commerce funds their creation—the industrial system that produced them begins communicating with the outside world. Every interaction becomes a tiny demonstration of what the system knows how to do. Most demonstrations are harmless. Most are economically productive. Millions of businesses and developers should be able to use advanced AI without being treated as national-security threats, and any policy that forgets this will do more damage than the harvesters ever could.
But Anthropic’s September 2026 disclosure, arriving two days after the first joint federal advisory ever devoted to the subject, provides a glimpse of what happens when the economics of model interaction are industrialized for a different purpose. More than 151 million exchanges attributed to an Alibaba-linked campaign over three months, organized around a single reasoning-extraction prompt across thousands of fraudulent accounts. Hundreds of thousands of requests relayed through Moonshot’s services, including traffic assessed as military-linked. More than twelve million exchanges tied to DeepSeek-related activity in a fourteen-day window. Six companies named by three federal agencies as having drawn billions of tokens from Claude, GPT, Gemini, and Grok since 2024, in campaigns the agencies describe as the core of a national development strategy [1] [3] [4]. Again—and this caveat belongs in the conclusion as much as the introduction—these remain allegations by interested parties rather than adjudicated findings, contested by Beijing and unanswered by the accused [30]. But even if tomorrow’s investigations revise individual numbers, the structural fact they illustrate will remain, because it does not depend on any of them: a frontier model is observable; observable intelligence can produce data; data can train models; models produce more intelligence. That feedback loop is what makes Capability Harvesting the right name for this era.
The word “harvesting” is doing deliberate work. Harvesting is different from stealing an object. A farmer does not reproduce the soil when harvesting a crop; the crop is the economically useful output created by the underlying productive system, renewed with every season. Likewise, a rival laboratory does not need to duplicate another company’s chips, datacenters, researchers, weights, datasets, and training pipeline. It may instead gather portions of the useful output that system continuously produces, and fold those outputs into its own development process, season after season, release after release. The analogy is imperfect—crops do not encode the farm’s methods, while reasoning traces partially do—but it is strategically revealing in exactly the place where policy has been blind. America can protect the field, the tractor, the seed inventory, and the machinery. If the crop is continuously exposed at the edge of the field, protecting the machinery alone cannot protect all of the economic knowledge embodied in the harvest.
This is why Capability Harvesting fits naturally after Export Evasion in the intellectual sequence of this project. Export Evasion belonged to the era in which the principal fear was that China could obtain the machines America attempted to withhold; it concerned hardware leakage, and it played out at Layers 2 and 3 of the Five-Layer AI Economy. Capability Harvesting belongs to the era in which China may not need identical machines to capture portions of the intelligence generated by America’s machines; it concerns intelligence diffusion, and it plays out at Layers 4 and 5. The second problem may ultimately prove harder than the first, because intelligence is fundamentally easier to copy than infrastructure—and because the defender’s own business model requires exposing it.
There is an equally important caution running in the opposite direction, and this paper ends on it deliberately. The United States should not respond by attempting to close every frontier model to the world. That would confuse protection with isolation, and isolation would forfeit the very advantages protection exists to preserve. Global distribution is itself a strategic asset. When developers build on American models, American platforms become standards. When businesses integrate American APIs, American laboratories earn the revenue that finances the next generation. When allies depend on American AI infrastructure, technological relationships reinforce geopolitical ones. When American models remain available globally, American companies retain visibility into how frontier AI is actually being used—including by those who would harvest it. A fortress ecosystem would surrender all four advantages in exchange for a protection that open weights, allied leakage, and efficiency innovation would erode anyway.
The correct response to Capability Harvesting is therefore not Capability Isolation. It is Capability Renewal. Protect the most valuable systems intelligently, concentrating friction where harvesting economics actually operate. Detect industrial-scale unauthorized extraction with the seriousness, shared standards, and auditable methods the problem now deserves. Strengthen identity and model-access security without criminalizing volume. Modernize export policy so that it understands the differences among hardware, training, weights, and inference—and writes them into law rather than into press releases. Build the allied architecture that gives capability controls legitimacy beyond American borders. Preserve, visibly and credibly, the research, startup, and enterprise access on which the ecosystem’s vitality depends. And then innovate relentlessly, because the deepest lesson of this entire episode is that today’s frontier cannot be permanently enclosed. If intelligence has economic value, others will attempt to learn from it. If a model can be queried, aspects of its behavior can be studied. If a capability can be demonstrated, someone will attempt to reproduce it. The ultimate American strategic advantage cannot depend solely on preventing competitors from learning what America already knows. It must depend on America discovering the next capability before competitors have finished harvesting the previous one.
That is why the title fits. Capability Harvesting describes the transition from a geopolitics of possessing artificial intelligence to a geopolitics of learning from artificial intelligence. It explains why semiconductor controls remain necessary while becoming insufficient. It explains why frontier-model APIs have evolved from ordinary commercial products into strategically sensitive interfaces guarded by hybrid teams of engineers and counterintelligence analysts. It explains why Alibaba, Qwen, DeepSeek, Moonshot, Anthropic, OpenAI, Google, and the laboratories still unfounded should be understood not simply as competing technology companies but as participants in a global system through which intelligence itself now circulates. And it completes the extension of the Five-Layer AI Economy: the first three layers build the factory; the fourth layer creates intelligence; the fifth layer distributes it. Capability Harvesting begins when distributed intelligence becomes raw material for building the next factory of intelligence. That loop—not merely the GPU—is likely to define one of the most important technology competitions of 2027 and beyond.
Footnotes / Endnotes:
[1] Anthropic — Detecting and Countering Misuse of AI: September 2026 (Threat Intelligence Report, September 10, 2026). https://www.anthropic.com/threat-intelligence-report-september-2026
[2] Reuters (via Rappler) — “Anthropic disrupts Russian, Chinese AI campaigns targeting its Claude models,” September 10, 2026. https://www.rappler.com/technology/anthropic-threat-intelligence-report-september-2026/
[3] Amanda Silberling / TechCrunch — “Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek,” September 10, 2026. https://techcrunch.com/2026/09/10/anthropic-details-distillation-campaigns-from-alibaba-moonshot-ai-and-deepseek/
[4] NSA, CISA, and FBI — Joint Cybersecurity Advisory AA26-251A, “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies,” September 8, 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a
[5] CISA Press Release (Nick Andersen, Acting Director) — “CISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models with Industrial-Scale Knowledge Distillation Campaigns,” September 8, 2026. https://www.cisa.gov/news-events/news/cisa-nsa-and-fbi-warn-china-based-ai-companies-targeting-us-ai-models-industrial-scale-knowledge
[6] Bloomberg News — “OpenAI Accuses China’s DeepSeek of Distilling US AI Models to Gain an Edge” (memo to the House Select Committee on China), February 12, 2026. https://www.bloomberg.com/news/articles/2026-02-12/openai-accuses-deepseek-of-distilling-us-models-to-gain-an-edge
[7] Ina Fried / Axios — “OpenAI says DeepSeek may have ‘inappropriately’ used its models’ output” (including David Sacks remarks), January 29, 2025. https://www.axios.com/2025/01/29/openai-deepseek-ai-models-data-training
[8] Stanford HAI, AI Index Report 2026 (released April 13, 2026), as reported by The Next Web — “Stanford AI Index 2026: China narrows US lead to 2.7% while spending 23x less on AI investment.” https://thenextweb.com/news/stanford-ai-index-2026-china-us-performance-gap
[9] Maria Garcia / Implicator.ai — “Stanford’s 2026 AI Index puts US lead over China at 2.7% as DeepSeek V4 stalls,” April 13, 2026; and Progressive Robot — “Distillation Campaigns: Surprising Alibaba and DeepSeek Risk,” September 11, 2026. https://www.implicator.ai/stanfords-2026-ai-index-puts-us-lead-over-china-at-2-7-as-deepseek-v4-stalls/ ; https://www.progressiverobot.com/2026/09/11/anthropic-distillation-campaigns-alibaba-moonshot-deepseek/
[10] Dan Busbridge, Amitis Shidani, Floris Weers, Jason Ramapuram, Etai Littwin, Russell Webb (Apple) — “Distillation Scaling Laws,” Proceedings of the 42nd International Conference on Machine Learning (ICML 2025). https://arxiv.org/abs/2502.08606
[11] Ben Cottier, Robi Rahman, Loredana Fattorini, Nestor Maslej, David Owen (Epoch AI / Stanford) — “The Rising Costs of Training Frontier AI Models,” 2024, and Epoch AI, “How much does it cost to train frontier AI models?” https://epoch.ai/blog/how-much-does-it-cost-to-train-frontier-ai-models
[12] DeepSeek — V4.1-Flash release, September 10, 2026, as documented by CellCog, “DeepSeek V4.1 Flash: Price, Specs, and the Rumor Scorecard,” and TechJack Solutions, “DeepSeek-V4.1-Flash: Complete Pricing & Specs Guide 2026.” https://cellcog.ai/blog/deepseek-v4-1-flash-release-date/ ; https://techjacksolutions.com/ai-tools/deepseek/deepseek-v4-1-flash/
[13] NVIDIA Corporation — “NVIDIA Announces Financial Results for Second Quarter Fiscal 2027” (Form 8-K, Exhibit 99.1; Jensen Huang statement), August 26, 2026. https://www.sec.gov/Archives/edgar/data/0001045810/000104581026000073/q2fy27pr.htm
[14] Alibaba Group Holding Limited — “Alibaba Group Announces June Quarter 2026 Results” (Form 6-K, Exhibit 99.1; Eddie Wu statement), August 20, 2026. https://www.sec.gov/Archives/edgar/data/1577552/000110465926099220/tm2623667d1_ex99-1.htm
[15] CNBC — “Anthropic’s distillation battle turns to the dark web as China concerns swell,” September 3, 2026. https://www.cnbc.com/2026/09/03/anthropic-distillation-battle-turns-to-dark-web-china-concerns-swell.html
[16] CNBC — “Anthropic joins OpenAI in flagging ‘industrial-scale’ distillation campaigns by Chinese AI firms” (Erik Cambria, Nanyang Technological University), February 24, 2026. https://www.cnbc.com/2026/02/24/anthropic-openai-china-firms-distillation-deepseek.html
[17] Asia Times — “US calls for AI poisoning to sabotage China’s model distillation” (Liu Dian, Fudan University China Institute, via Global Times; China MOFA response), September 2026. https://asiatimes.com/2026/09/us-calls-for-ai-poisoning-to-sabotage-chinas-model-distillation/
[18] Rest of World — “OpenAI accuses DeepSeek of malpractice ahead of AI launch” (Austin Horng-En Wang, RAND Corporation), February 2026. https://restofworld.org/2026/openai-deepseek-distillation-dispute-us-china/
[19] Craig S. Smith / Forbes — “Distillation: The New U.S.–China AI Fight,” June 25, 2026. https://www.forbes.com/sites/craigsmith/2026/06/25/distillation-the-new-uschina-ai-fight/
[20] Institute for AI Policy and Strategy (IAPS) — “AI Distillation Attacks: Executive and Congressional Action Can Go Further,” May 2026. https://www.iaps.ai/research/ai-distillation-attacks-executive-and-congressional-action-can-go-further
[21] Anamarija Pogorelec / Help Net Security — “Chinese AI firms are siphoning capabilities from American models, CISA warns,” September 9, 2026. https://www.helpnetsecurity.com/2026/09/09/china-malicious-ai-knowledge-distillation-against-us-companies/
[22] Cryptopolitan — “Anthropic ties 151 million Claude queries to alleged Alibaba distillation” (including June 10, 2026 Senate letter figures and market reaction), September 10, 2026. https://www.cryptopolitan.com/anthropic-alibaba-claude-distillation/
[23] Beck Reed Riden LLP — “Understanding AI Distillation in the Trade Secret Context,” May 2026. https://beckreedriden.com/understanding-ai-distillation-in-the-trade-secret-context/
[24] Lawfare — “The Incentive Architecture Export Controls Cannot Reach,” May 2026. https://www.lawfaremedia.org/article/the-incentive-architecture-export-controls-cannot-reach
[25] U.S. House Foreign Affairs Committee — Chairman Bill Huizenga, Opening Remarks, Hearing on “Strengthening Export Control Enforcement,” February 24, 2026. https://foreignaffairs.house.gov/news/press-releases/south-and-central-asia-subcommittee-chairman-bill-huizenga-delivers-opening-remarks-at-hearing-on-strengthening-export-control-enforcement
[26] Mariella Moon / Engadget — “US authorities accuse Chinese AI companies of industrial-scale campaigns to copy American models,” September 9, 2026. https://www.engadget.com/2253604/us-authorities-accuse-chinese-ai-companies-of-industrial-scale-campaigns-to-copy-american-models/
[27] Newslaundry — “From biological weapons to espionage: What Anthropic’s report reveals about AI misuse” (154-page report details; account infrastructure), September 11, 2026. https://www.newslaundry.com/2026/09/11/from-biological-weapons-to-espionage-what-anthropics-report-reveals-about-ai-misuse
[28] China Biz Insider — “Stanford’s 2026 AI Index says China’s top models are closing the gap with the US” (transparency index; open-weight gap data), 2026. https://chinabizinsider.com/stanfords-2026-ai-index-says-chinas-top-models-are-closing-the-gap-with-the-us/
[29] Investing.com — “US Targets ‘AI Distillation’: What It Means for China and Big Tech” (April 23, 2026 OSTP National Security and Technology Memorandum; BIS enforcement role), April 2026. https://www.investing.com/analysis/us-targets-ai-distillation-what-it-means-for-china-and-big-tech-200679129
[30] Tech Insider — “China Rejects US AI Distillation Claims: 6 Firms Named” (Ministry of Commerce response, September 9, 2026; February 2026 OpenAI memo title and contents), September 2026. https://tech-insider.org/china-rejects-us-ai-distillation-claims-2026/
[31] The Rapacke Law Group — “Chinese Tech Firms Accused of Using DeepSeek Distillation to Replicate Proprietary AI Models” (Nvidia market reaction; enforcement obstacles; legislative response), March 2026. https://arapackelaw.com/intellectual-property/chinese-deepseek-distillation/
[32] Fonearena — “Anthropic September 2026 Threat Report: AI Misuse Across Cyber Operations, Surveillance and Weapons” (fraudulent reseller/proxy operations GTG-50020/50021), September 2026. https://www.fonearena.com/blog/492107/anthropic-september-2026-threat-report.html
[33] CellCog — “Anthropic’s Threat Report: Attacks Run on Agent Frameworks, and the API Key Is the Loot” (summarized-reasoning countermeasures; report scope), September 2026. https://cellcog.ai/blog/anthropic-threat-report-september-2026/
[34] The Daily Caller News Foundation — “Feds Recommend How to Stop China From Stealing American AI Data” (advisory’s recommended actions, including degraded responses), September 9, 2026. https://dailycaller.com/2026/09/09/nsa-cisa-fbi-chinese-artificial-intelligence-data-stealing/
