OpenAI’s Astra reportedly becomes Chinese AI labs’ leading distillation target
Reports say Chinese AI labs are shifting distillation efforts from Anthropic’s Claude to OpenAI’s Astra, raising new questions about model theft defenses.
OpenAI’s Astra has reportedly become the leading target for model-distillation efforts by Chinese AI labs after Anthropic strengthened defenses around Claude, according to reporting from The Information cited by The Decoder.
The report names DeepSeek and Moonshot AI as organizations that allegedly relied heavily on Astra’s outputs while developing newer models, including products identified as Kimi K3.1 Pro and V4.1-Flash 1017. The claims could not be independently verified from the supplied evidence, and neither company provided a public response in the reporting summarized by The Decoder.
The development matters because it suggests that stronger safeguards at one frontier-model provider may redirect extraction attempts toward another provider rather than end the practice. For model builders and enterprise AI buyers, the episode also highlights how difficult it is to protect proprietary capabilities when advanced systems can be queried repeatedly at scale.
From Claude to Astra
Model distillation involves using the responses of a more capable model to improve a less capable or competing system. In this case, the reported activity appears to involve attempts to obtain detailed answers, including the hidden reasoning steps that some frontier models use internally.
Anthropic’s Claude was previously described as a preferred target for this kind of activity. The Decoder reports that Anthropic has since tightened its defenses, prompting Chinese AI labs to focus more heavily on OpenAI’s Astra, identified in the report as GPT-6 Astra.
The available evidence does not establish how broad this shift is across China’s AI sector, how much Astra data was collected, or whether the alleged activity materially improved any named model. It does, however, point to a changing contest between model providers trying to prevent unauthorized imitation and labs looking for ways to reproduce advanced capabilities at lower cost.
OpenAI has also reported a coordinated distillation campaign that it said involved people connected to Moonshot. The company’s response, as relayed by The Decoder, was that it treats the issue seriously but has seen attackers modify their methods when new safeguards are introduced.
What the evidence shows—and does not show
The strongest reporting in this cluster comes from The Information, but the full article text was not available in the supplied source material. The Decoder presents the account and attributes the central findings to people familiar with the matter. That makes the alleged use of Astra an important reported development, not a confirmed public disclosure by DeepSeek or Moonshot AI.
Moonshot declined to comment, according to The Decoder, while DeepSeek did not respond to a request for comment. Those nonresponses neither confirm nor disprove the allegations. No technical logs, datasets, query volumes, training records, or independent benchmark results were included in the available evidence.
Anthropic’s claim that its newer methods reduced the amount of data attackers could extract by 90% to 99% is a company-reported result. The source material does not explain the testing conditions, the definition of extracted data, or whether the reduction applies equally across different attack strategies. It should therefore be treated as a vendor claim rather than a general measure of security.
The reporting also does not show that OpenAI’s Astra is universally more vulnerable than Claude. The apparent shift may reflect relative access, model quality, account controls, pricing, output behavior, or the attackers’ changing tactics. Those factors remain unresolved.
Why this matters for AI builders
For frontier-model companies, the reported activity turns output access into a security problem as much as a product feature. API controls, rate limits, account screening, anomaly detection, refusal behavior, and monitoring all become part of protecting model capabilities. Defenses must also account for adversaries who spread requests across accounts, vary prompts, or combine ordinary-looking queries into a larger collection effort.
For smaller AI builders, distillation can lower the cost of reaching competitive performance, but dependence on another company’s outputs creates legal, operational, and technical risks. A system trained heavily on one external model may inherit its blind spots, refusal patterns, biases, or formatting conventions. It may also become vulnerable if the provider changes access rules or introduces output restrictions.
Enterprise buyers should interpret claims about model imitation carefully. A vendor may demonstrate similar benchmark scores without matching reliability in production workflows, tool use, long-context tasks, safety handling, or domain-specific accuracy. The alleged Astra activity does not show that a distilled system offers equivalent performance, nor does it establish that organizations using such systems knowingly participated in unauthorized extraction.
The episode also has competitive implications. If defenses simply move attention from Claude to Astra, model providers may face a continuing cycle of countermeasures rather than a one-time fix. That could increase the cost of serving high-capability models and encourage providers to offer more tightly controlled interfaces, provenance signals, or differentiated access tiers.
What to watch next
The first signal will be whether OpenAI publicly identifies additional details about the campaign linked to Moonshot, including the methods it detected and the controls it deployed afterward. Technical evidence would help distinguish targeted abuse from broad claims about Chinese AI labs.
A second signal is whether Anthropic publishes independent testing of its reported 90% to 99% reduction in extracted data. Details about attack assumptions, measurement methods, and performance against adaptive attackers will determine how meaningful that figure is.
Researchers and platform operators should also watch named model releases from DeepSeek and Moonshot AI for unusual similarities in response structure, capability profiles, or behavior. Such similarities would not by themselves prove distillation, but they could prompt closer examination of training sources and evaluation methods.
Finally, API providers may begin disclosing more about customer verification, usage monitoring, output watermarking, and restrictions on automated collection. Those measures will matter to legitimate developers as well as security teams because overly aggressive controls can make experimentation and open research more difficult.
Creati.ai perspective
The reported move from Claude to Astra is best understood as an arms race over access to model behavior, not as proof that one provider has definitively lost control of its system. The available evidence is too limited to establish the scale of the alleged extraction or the capabilities of any resulting models.
Still, the story gives builders a practical warning: output security cannot be separated from model deployment strategy. Providers need defenses that adapt to changing attack patterns, while buyers should evaluate provenance, access policies, and independent performance rather than assuming that benchmark similarity proves genuine capability equivalence.
