Chinese AI labs are reportedly turning more of their model-distillation efforts toward OpenAI’s GPT-6 Astra after Anthropic tightened protections around Claude. The shift puts attention on a central issue in the dispute: training from another model’s outputs may depend on getting it to expose hidden reasoning steps.
Reports point to a change in target
According to The Information, DeepSeek and Moonshot AI leaned heavily on Astra’s outputs while training their latest models. People familiar with the matter said the work included Kimi K3.1 Pro and V4.1-Flash 1017.
Claude had previously been the go-to target, the report says. The account describes a change in focus as Anthropic introduced stronger defenses, with Astra becoming the main target for the labs named in the report.
The report does not provide details on how much Astra output was used or how the training was conducted. It does, however, connect the reported activity to distillation: using outputs from an existing model to help train another one.
Why hidden reasoning matters
The article says this kind of distillation only works if the labs can get models to reveal their hidden reasoning steps. Those steps are distinct from the final answers a model provides, and the source frames access to them as important to the reported training approach.
OpenAI and Anthropic both ban this practice. That means the alleged use of their models’ outputs raises a question about whether protections can prevent unauthorized extraction of information that companies treat as restricted.
Anthropic says its new methods cut the amount of data attackers can pull by 90 to 99 percent. That figure describes the company’s claim about its defenses; it does not establish that all attempts have stopped, or quantify any activity targeting Astra.
OpenAI says tactics keep changing
In late September, OpenAI reported a coordinated distillation campaign that it says involved people linked to Moonshot. An OpenAI spokesperson said the company takes the problem very seriously, but that attackers had adjusted their tactics every time it rolled out a new defense.
The reported move toward Astra fits that broader concern: safeguards can change the target without necessarily ending attempts to draw useful outputs from a model. The source does not say that the September campaign and the reported Astra use are the same activity, so they should be understood as separate points in the account.
Moonshot declined to comment, while DeepSeek did not respond to a request for comment. The report therefore includes OpenAI’s account, the Information’s description of what people familiar with the matter said, and no response from DeepSeek or a substantive response from Moonshot.
What the shift signals
The reported change underscores that competition over AI systems includes more than building models. Companies also face the challenge of protecting the outputs and reasoning capabilities that could help another lab train its own systems.
For model developers, the episode points to an ongoing cycle: protections are introduced, attackers may adapt, and companies must assess whether their systems reveal less useful data. For readers, the distinction between a company’s stated defense results and reports of attempted distillation matters. Anthropic’s claimed reduction is a specific measure, while the report’s account of Astra use does not quantify the scale of that activity.
The available details remain limited. The article identifies the labs and models involved in the reporting, describes the role of hidden reasoning, and notes the companies’ policies and responses. It does not establish the full extent of the activity or provide a technical account of the methods used.