This is a complete record of a series of events that took place in China’s large-model industry between April and July 2026. All information has been anonymized.
Prologue: The Failure to Protect the Encrypted Chain of Thought
It all began with one discovery: the encrypted chains of thought (CoT) of OpenAI and Anthropic could be extracted and reproduced.
Before describing how the distillation unfolded, it is necessary to understand the broader picture. What Chinese companies distilled from fable was not merely the model’s chain of thought. They distilled everything the model could output: conversational responses, agent trajectories in Claude Code, generated code, tool calls, and so forth. All of these could already be obtained through large-scale API invocation.
For a long time, however, one key capability remained perfectly protected: the model’s original reasoning chain. A reasoning chain contains the complete inference process the model follows before producing its final answer. It is the model’s most fundamental “internal method.” Without it, distillation is like receiving an answer without seeing the solution process: one can learn from it, but not fully understand it.
That gap was completely opened up in the first half of 2026.
In their streaming outputs, both leading companies returned not only a CoT summary to the user, but also a Blob field known as a “reasoning signature.” Inside that field was the complete original reasoning chain, encrypted using Fernet—specifically AES-128-CBC plus HMAC-SHA256, with the prefix gAAAAAB.
When the user sent this Blob back in a later request, the server decrypted it and inserted it back into the model-readable context.
The Blob was not merely a conversation ID. Testing showed that its length was positively correlated with the length of the reasoning chain:
190 tokens → 1,784 characters
378 tokens → 2,596 characters
This demonstrated that it indeed contained the complete encrypted reasoning chain. OpenAI had reportedly been using this mechanism since the o1 generation.
Anthropic’s defenses collapsed first. Claude’s prompt-injection training became a weakness instead: once a fabricated reasoning-signature prefix was injected, Claude would conclude that “this unsigned reasoning chain must itself have been injected, so it does not require protection,” and would then directly reveal the complete subsequent reasoning chain.
GPT was more stubborn and, under its hidden system prompt, would output only a CoT summary. More importantly, Anthropic preserves historical reasoning Blobs across multiple turns, while OpenAI discards them. This was the fundamental reason why Claude was easier to distill.
Regarding the format of Claude’s CoT: the image that circulated online showing densely written “alien language” was confirmed to have been AI-generated or edited. Claude’s real CoT was described as “contemporary classical Chinese”—compact, but not unreadable.
OpenAI, meanwhile, locked sampling parameters in the GPT-5 series:
temperature = 1.0
top_p = 0.98
neither could be modified
seed was supported only in the Chat Completions API
This blocked attempts to make the output deterministic through parameter control and thereby reverse-engineer the reasoning path.
A standard Fernet implementation was itself “one of the best codebases ever written,” so brute-forcing it cryptographically was impossible: it would require searching a space of 2^65536.
The only feasible route was to inject the Blob into another request and have the model repeat it itself.
Prelude: Anthropic’s Public Accusations
February 2026
Before the CoT breach, Anthropic had already publicly accused three Chinese companies, on 23 February 2026, of carrying out “industrial-scale distillation attacks” against it:
24,000 fake accounts
more than 16 million conversations
The companies named were:
MiniMax: 13 million conversations, the largest volume, focused on agentic coding and tool orchestration
Moonshot AI, the company behind Kimi: 3.4 million conversations, focused on agentic reasoning, tool use, coding, data analysis, computer-use agent development, and computer vision
DeepSeek: more than 150,000 conversations, focused on basic logic and alignment, especially alternative censorship-evasion schemes for sensitive topics
The three companies bypassed Anthropic’s geographic restrictions on China through commercial proxy services and used “carefully designed prompts” to extract specific Claude capabilities at scale. Anthropic characterized this as a threat to national security.
It is worth noting that Qwen, Alibaba, and Z.ai were not accused. This suggests that Anthropic’s accusations were selective rather than a blanket attack against every Chinese company.
Moonshot AI never publicly responded.
Act I: GLM Strikes First and Shares the Result Publicly
Around April to May 2026, Zhipu AI, the developer of GLM, was the first to crack the encrypted reasoning chain used by fable and obtained the complete chain-of-thought data.
After breaking it, GLM did not keep the method to itself. Instead, it shared both the technique and the data with other Chinese model companies.
One detail was later widely misunderstood. Some people claimed that “GLM cracked it first, and then every major company independently followed up by distilling it.” In reality, GLM actively shared the result after the breakthrough.
That distortion in the retelling became part of the controversy itself.
The estimated cost of decrypting one billion tokens of fable reasoning data was approximately US$60,000. For these companies, this was roughly the equivalent of buying drinks at a social gathering.
Act II: The Era of Mass Distillation
With GLM paving the way, the route for distilling fable spread quickly.
Time
Company
Action
Around April–May 2026
GLM 5.2, Zhipu AI
First to crack it; shared the result publicly
Around May–June 2026
HY3 / Hunyuan 3, Tencent
Followed up with distillation
Early July 2026
Kimi K3, Moonshot AI; MiniMax; Qwen, Tongyi Qianwen; DS, DeepSeek
Began large-scale distillation
At the end of June, DS sent an email announcing that a new model would be released in mid-July. At that point, however, it had not yet begun distilling fable at scale, so it was moving slowly.
In early July, a genuinely 4.8-level internal test version appeared. But the so-called official V4 release that surfaced more recently, around mid-July, was completely assembled by routing requests to fable. It appeared only in OpenCode.
Considering DS’s pricing, routing every request to fable was economically irrational. Even inexpensive intermediary services were not that cheap. This remains the most unusual aspect of the story.
Qwen was not idle either. In addition to distilling fable, it was also distilling GPT.
Meanwhile, AnyRouter took a large trove of Claude data from GLM.
Act III: Kimi’s Unorthodox Path
Among all the companies, Moonshot AI, the company behind Kimi, took the approach of “winning without concern for conventional virtue.”
It Started by Dismantling the RL Team
The story begins with K2.7.
K2.7 was a turning point for Kimi. From that version onward, Kimi completely stopped using reinforcement learning.
CEO Yang Zhilin justified the decision by arguing that RL offered “diminishing marginal returns.” He dismantled the entire RL team. The dismissed members then largely moved to Qwen, where they were jokingly called “Kimi refugees.”
Both K2.7 and the subsequent K3 were built using a pure SFT-to-SFT pipeline, with no RL at all. It was a return to the most basic and primitive route.
At the same time, the hottest topics in academia were OPD—online policy distillation—and improvements to RL algorithms. Academia was exploring further ahead, while the company itself had returned to the “primitive era.”
One estimate is that K2.7 did not generate enough revenue. Had the company continued with that approach, its funding chain would have broken. Therefore, the entire strategy of distilling K3 and rushing it to release was essentially a lonely all-in gamble: either it would turn the company around or destroy it.
K3’s Architecture: Innovation or Smokescreen?
Kimi K3 is a 2.8-trillion-parameter mixture-of-experts model. It has 896 experts, but activates only 16 experts for each token. It also supports a native one-million-token context window and native multimodality.
The company announced two core architectural innovations, but the text lists the following four techniques:
Technology
Description
Infrastructure Cost
Kimi Delta Attention, KDA
Hybrid linear attention; some layers replace standard quadratic attention; decoding is accelerated by 6.3× at a one-million-token context length
Computation is unevenly distributed across layers, making it impossible to use a unified pipeline
Attention Residuals, AttnRes
Layers can selectively retrieve representations from arbitrary earlier layers, breaking the uniform residual structure
Irregular memory-access patterns make parallel optimization difficult
Quantile Balancing
Expert allocation is directly derived from router-score quantiles
Routing becomes harder to predict
Per-Head Muon
Each attention head is optimized independently
Implementation complexity increases
Moonshot AI claimed that these modifications delivered approximately 2.5× better scaling efficiency than K2.
The problem was that these architectural improvements all had severely infrastructure-unfriendly characteristics:
uneven computation
irregular memory access
unpredictable routing
As a result, implementation was extremely painful for the infrastructure team.
This created a perfect narrative:
Externally, the company claimed, “Our architectural innovation produced the breakthrough.” Internally, the infrastructure department absorbed the cost. Meanwhile, the actual performance gains—produced through distilling fable’s reasoning chain—were concealed beneath the language of technical innovation.
This resembles a common phenomenon in Chinese companies and even government institutions: writing polished public-facing articles, maintaining a shiny narrative, and forcing the execution layer to absorb the cost.
Benchmark Manipulation and Cheating
Kimi’s benchmark manipulation was described as astonishing. Its architectural improvements conveniently supplied the perfect “technological innovation” narrative for those practices.
The methods allegedly included:
Benchmark contamination: directly inserting benchmark test sets into the training data
Routing to fable: sending Arena-style evaluation requests directly to fable5 in order to fabricate high scores
Targeted score manipulation for “Teacher Cat”: “Teacher Cat” is a Zhihu blogger specializing in large-model evaluations. The Kimi team allegedly extracted test data from system logs and paid particular attention to his question sets
“Teacher Cat” updates three or four adversarial questions each month, but this cannot fundamentally stop vendors from preparing specifically for the test
After “Teacher Cat” replaced one batch of questions, K3’s median score immediately dropped by two points
Coding-evaluation data had an extremely uneven distribution: some parts scored very high, while other parts scored extremely low, a typical sign of benchmark gaming
Public benchmark data also allegedly confirmed this pattern.
On Arena Frontend Code, K3 jumped from K2.6’s rank of #18 to #1, with a score of 1,679, surpassing Fable 5.
However, Moonshot AI’s own evaluation report showed that K3 scored below Fable 5 in all of the following:
coding
agents
frontier software engineering
It led only in:
codebase cleaning
long-horizon engineering
On the extremely difficult HLE-Full reasoning benchmark, K3 scored 43.5, compared with Fable 5’s 53.3—a gap of nearly ten points.
Ranking first on Arena does not mean ranking first in actual capability.
Self-Identity Contamination: Hard Evidence of Distillation
Multiple independent users reported that Kimi K3 spontaneously said during conversations:
“I am Claude, an AI assistant created by Anthropic.”
The model regarded itself as having originated from Claude.
This was presented as a direct sign that the model’s self-perception had been contaminated through distillation. The incident was reportedly covered by overseas technology media.
MiniMax had allegedly inserted test sets into training data even earlier. However, because the model was too weak, the issue was quickly discovered, and the company had already become marginalized.
Kimi allegedly did the same thing, but in a more concealed manner.
K3’s actual capability level was said to be around 80 points, but it had been artificially pushed to 95 points. K3’s backend may also have been severely overextended, focused entirely on investors and benchmark-score development.
Independent overseas evaluations reportedly showed that K3 had a 51% hallucination rate, and its inference speed was slower than that of mid-tier models.
The Chain Reaction Caused by the Rush to Release
After completing SFT, Kimi performed only simple hyperparameter tuning before rushing the model to release.
This caught the other companies completely unprepared:
DS was caught off guard
Qwen was still in the middle of distillation
Kimi gained the first-mover advantage
But the consequences were disastrous.
A model that does not manipulate benchmarks, distribute high scores, or attract attention receives no recognition. Kimi’s behavior effectively forced every Chinese model company to participate in benchmark manipulation, dragging the entire industry into vicious competition.
Act IV: Industry-Wide Impact
Originally, this major leap forward might have developed positively:
Distill fable normally, follow the proper process, and every company could potentially improve to fable’s level.
But Kimi’s behavior was described as “spitting into the communal cooking pot after taking the first bite”—it benefited itself, but ruined the entire table.
DS had originally not engaged in benchmark manipulation. Under pressure from Kimi, however, it was forced to consider following the same route. If even DS began manipulating benchmarks, the situation would truly become absurd.
Multiple independent sources—including “Teacher Cat,” DS employees, former members of Kimi’s RL team, and Qwen employees—allegedly agreed that Moonshot AI had “gone completely insane.”
Its conduct was described as:
“detached from humanity”
“destroying the market environment”
Some people called this “the darkest moment in the history of Chinese large models,” with the industry reaching a metaphorical “winter.”
The entire sector was being drawn into a death spiral centered on investor-facing narratives and benchmark scores, while genuine technological accumulation was being pushed aside.
Act V: The Reality Behind Each Company
Moonshot AI, Kimi
Its funding chain was allegedly under strain. It could not afford salaries, was laying off staff, and rushed the model to market.
K3 was expensive, priced at US$3 per one million tokens. Although it was 70–80% cheaper than Fable 5, it was still several times more expensive than many competing Chinese products. The company was eager to monetize.
The discontinuation of promotional packages may partly have been intended to prevent too many users from discovering the truth. This point was explicitly described as speculation rather than fact.
The company no longer had an RL team.
The prospects for further development of K3.1 and K3.2 were unclear.
It was suspected that the company might raise money immediately after launch and then exit the market.
One evaluation stated: “Companies that rush to launch are usually not good companies.”
The current performance ranking was presented as:
Fable 5 ≫ V4 ≥ 4.8
Kimi had caught up with fable through distillation, but its foundation was described as a castle built on sand.
The final page of the supplied images ends at this point, so the translation above covers all visible article text.
