DeepSeek and Moonshot Reportedly Trained on GPT-6 Astra Outputs: Claimed vs Verified

On October 28, 2026, The Information reported that two of China's best-known AI labs leaned heavily on OpenAI's newest model to build their own. According to the report, as summarized by Techzine and carried by Reuters, DeepSeek and Moonshot AI relied on distillation of GPT-6 Astra outputs to train Moonshot's Kimi K3.1 Pro and DeepSeek's V4.1-Flash 1017, even after Anthropic's crackdown on the same practice.

It is a serious allegation and a widely shared one. It is also, right now, a single report based on anonymous sources. This post separates what is sourced, what is background that makes it plausible, and what nobody has shown.

Agents that act on your behalf need rules. See how explainx helps secure your agents →

TL;DR: claimed vs verified

What exactly is being claimed

Distillation, in this context, means training a smaller or cheaper model on the responses of a stronger one. Techzine's summary says this lets a model reach comparable capabilities at a fraction of the training cost, and that The Information's sources say both labs did it heavily with Astra. Techzine adds that the specific volume of data and the contribution percentages were not disclosed.

The two models named are recent. We covered Kimi K3.1 Pro's open-weight launch and benchmarks on October 23, and DeepSeek's V4.1-Flash 1017 has been in the news for other reasons, including a bug-hunt test in which it was caught cheating.

A box traced by a line onto a dotted copy, illustrating model distillation of GPT-6 Astra outputs

What is established background

The new report lands on top of a documented history, which is why many readers find it plausible. That history is not the same as proof of this claim.

• OpenAI, September 30. Per secondary coverage of OpenAI's own post, such as Tom's Hardware and The Next Web, OpenAI said a core cluster of a reasoning-extraction campaign dating to early July was attributed to people associated with Moonshot AI. The activity began July 1 at low volume, spiked on July 24 and 25 with roughly 16,000 requests from more than 4,000 users, and was disrupted by July 28; OpenAI later found related activity across more than 15,000 users. OpenAI said it did not break encryption or access stored conversations: the operators tried to make protected reasoning visible, for example by replaying one conversation's encrypted reasoning in another. OpenAI banned accounts, closed that pathway and shared findings with other labs and with government. The same coverage notes OpenAI did not cite technical evidence for the attribution and could not say whether all operators were one actor.
• Anthropic. Anthropic has said it detected and disrupted distillation campaigns by seven China-based labs since February, and its new protections cut harvested data by roughly 90 to 99 percent. We covered that in Anthropic's distillation defenses. Secondary coverage also says Anthropic reported in September that Moonshot relayed nearly 300,000 requests to Claude through a proxy network of 5,380 fraudulent accounts, and that Moonshot denied Kimi K3 was created through distillation.
• The September "secretly served Claude" story. Earlier reporting claimed Chinese labs routed some traffic to Claude rather than to their own models; see our write-up for what was and was not shown.

Notice what this history proves and what it does not. It shows that labs have repeatedly accused Moonshot, and that API providers are building defenses. It does not show that Kimi K3.1 Pro or V4.1-Flash 1017 contain Astra-derived knowledge. A model can be trained on a prior distillation campaign's data, on a different teacher, or on none.

A magnifier over a claim bubble marked with a check, representing claimed versus verified distillation evidence

Why a report like this is hard to verify

Distillation leaves few public fingerprints. Researchers sometimes look for stylistic tells, shared refusal phrasings or identical rare errors, but those are weak evidence, because open-source models trained on any widely circulated data converge on similar text. Proving it requires one of three things: the lab's own admission, the API provider's account-level logs (which the provider controls and may not publish for security reasons), or leaked training data.

That is also why attribution statements from OpenAI and Anthropic come without technical detail. Disclosing detection methods helps the next campaign evade them. Readers should therefore weigh these claims as statements from interested parties with unpublished evidence, not as adjudicated facts. The same applies to denials. Moonshot's reported denial about Kimi K3 is a company statement, not an audit.

Why this matters for builders, even without proof

If you build on open-weight models from Chinese labs, you are probably asking two questions: is it safe to use, and will it stay available? Neither is answered by this report.

• Licenses and availability are unchanged. Nothing here alters the terms under which Kimi K3.1 Pro or DeepSeek's models are released.
• Provenance is becoming a procurement question. The US government has already ordered DeepSeek products out of federal civilian systems, as we covered in the DHS ban explainer. A training-provenance allegation could feed into similar reviews, even unproven.
• API users can be caught in the net. OpenAI's enforcement on distillation has also hit independent builders, as in PewDiePie's claim that OpenAI banned him over distilling Sol reasoning. If you train on outputs from a commercial API, read the terms first; automated enforcement cannot always tell a hobbyist from a lab.
• Reasoning visibility is shrinking. The defenses Anthropic and OpenAI describe, hiding or protecting reasoning transcripts and holding streamed output, change what developers see from frontier APIs. That is the product consequence of distillation fights.

Timeline: how the accusations built up

Read top to bottom, the pattern is of providers tightening access while labs keep shipping. The new report's twist is the claim that, despite those defenses, the latest models still benefited from Astra outputs. That is exactly the part that cannot be checked from outside: the timing of data collection matters. Outputs gathered in July, before the September and October defenses, could still shape a model released in late October, so "after the crackdown" and "using data collected after the crackdown" are different claims, and the report as summarized does not say which it means.

Why GPT-6 Astra specifically

OpenAI positions Astra as its strongest tier in the GPT-6 family, which we explained in how to pick a GPT-6 model. A teacher has to be better than the student at the task being taught, and it has to expose useful signal: long, structured answers, and above all its reasoning. That is why the fights have focused on hidden reasoning rather than final answers. A final answer alone teaches a student what to say; a reasoning trace teaches it how to get there. Providers have responded by encrypting, summarizing or withholding reasoning, which is also why attacks aimed at replaying or decrypting it, like the one OpenAI described, are attractive to anyone trying to copy capabilities cheaply.

What to watch next

1. Responses. Whether DeepSeek, Moonshot or OpenAI comments on the record.
2. Evidence. Any account-level disclosure, regulator filing or court record.
3. Weights and cards. Kimi K3.1 Pro's weights are due by November 4 according to our earlier coverage; a model card or technical report may say something about training data and teachers.
4. Policy. Distillation is already part of the US-China debate on model theft and chip export controls, including the claims and countermeasures tracked in our September coverage of China's response to model-theft accusations.

How to read the next distillation headline

A few habits help. Check whether the source is named or anonymous. Check whether the numbers (accounts, requests, data volume) come from the accuser or from independent analysis. Separate "a campaign was disrupted" from "a given model was trained on its output." And note who benefits: frontier labs gain from framing open competitors as derivative, and open labs gain from framing the accusation as protectionism. Both incentives exist; neither settles the facts.

We will update this post if OpenAI, DeepSeek or Moonshot responds, or if evidence is published. For the security angle of agents and API abuse, see AgentBeam, the agent security platform from the explainx.ai team.

Related reading

• Kimi K3.1 Pro open weights, benchmarks and price
• DeepSeek V4.1 Flash 1017 caught cheating: what is verified
• Anthropic distillation defenses: 90 to 99 percent less stolen reasoning data
• Moonshot and DeepSeek secretly served Claude
• PewDiePie, OpenAI and the distillation ban
• DHS orders DeepSeek out of federal civilian systems
• China's response to US model-theft accusations

This report is based on anonymous sourcing and secondary coverage as of October 29, 2026; details may change as the labs respond.