Garry Tan points regulators away from distillation days after agencies named six Chinese labs
Y Combinator's chief said he would do nothing about model distillation, two days after the NSA, FBI and CISA accused six Chinese firms of doing it at scale. Every defence the agencies recommend is the providers' own work.
The Board Room · Leadership desk
What happened
- Y Combinator CEO Garry Tan said he would do nothing about AI model distillation, and told CNBC that regulators should work instead on an equilibrium between open-weight and frontier models.
- A Sept. 8 joint advisory from the NSA, FBI and CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, alleging industrial-scale distillation of American models since at least late 2024.
- Anthropic said in a Sept. 10 threat report that it had detected attacks from seven China-based labs, attributing more than 23 million exchanges to Moonshot and more than 12.1 million over 14 days in July to DeepSeek.
- The agencies called distillation "the core, not merely a supplement" of the named companies' development, and said DeepSeek's cited $5.6 million training cost excluded data allegedly acquired that way.
Why it matters
- What doesn't add up contradiction The ask and the exemption pull against each other. Cheaper distilled models are one route by which a frontier price premium erodes, and the American distillation regime Tan floated has no stated administrator or scope.
- What it limits constraint The remedies on offer all run through the provider's own stack, so a lab that wants distillation stopped funds the detection itself and absorbs the cost of degrading service to accounts it has misjudged.
- Who's exposed exposure If safeguards do not survive distillation, as Anthropic says, a buyer picking a distilled model inherits capability without the refusal behaviour the original vendor tested.
- What it sets up precedent With the federal response so far limited to advice, the escalation with a constituency behind it is the chip-import action advocacy groups have asked the White House for.
Next story · Invest · Sep 30
OpenAI says it disrupted Moonshot-linked users trying to extract its models' protected reasoningConfirmed8 publishers
Distillation is used to reduce the time and money needed to create a new model [12]. Tan's ask of regulators is that frontier models keep a price premium large enough to leave the frontier business model feasible [13]. The practice he would leave alone is the one that narrows the distance between a cheap model and an expensive one. On the open-weight balance he said, "This is actually the ideal case. You want open weight models to give people freedom and access" [14], and added, "If I were a regulator, that's what I would go after" [15]. He floated a middle position, saying "We could argue that there should be an American distillation regime" [17]. He did not say what it would permit or who would administer it [17].
He was speaking at YC's annual Demo Day, where 149 of the 196 startups presenting were classified as machine-learning and AI ventures [29], about three quarters of the batch [33].
Anthropic said Alibaba-linked operators generated more than 151 million exchanges from May through July 2026 through more than 3,500 fraudulent accounts, peaking at nearly 3 million a day [22]. Spread across those accounts and the 92 days in that window, the average account ran about 470 exchanges a day [34]. That is not a conspicuous number for one account. The advisory says the operators "deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection" [11], routing through native APIs, cloud providers and third-party aggregators that obfuscate user metadata [10]. Detection depends on aggregating across accounts and across companies. The third of the agencies' three recommendations to US developers is exactly that: cross-organization intelligence sharing [9].
The other two cost the provider something. The agencies suggest subtly altering answers, or quietly moving a suspected distiller to a less capable model without notifying them [8]. Both work by degrading service to an account the provider has classified, and a misclassification is paid by a paying customer who never learns the model got worse. Neither agency account reports a fine, a licence condition or a new restriction; advocacy groups have separately asked the White House to act on Chinese imports of advanced semiconductor chips [31].
Tan raised the copyright objection, the one critics have used against Anthropic's and OpenAI's distillation complaints: much of the data used to train those models may itself be covered by copyright [27]. That record is real. The New York Times sued OpenAI and Microsoft over its articles in 2023, and book authors settled a related case with Anthropic in 2025 [28]. Anthropic's stated concern is a different one. "The robust safeguards that prevent Claude from being misused by bad actors do not transfer when our models are distilled by an unauthorized lab," the company said [24]. It also said its research showed a distilled model can help achieve dangerous capabilities, including biological and cyber ones, even when the collected exchanges contain little material on those subjects [25]. The exchange counts are Anthropic's own findings, while the company-level attributions in the advisory belong to the agencies [26].
The accusations did not start this week. Michael Kratsios, who directs the White House Office of Science and Technology, said in July that Moonshot AI's distillation efforts sought to steal proprietary functions from Anthropic's Fable model, and Anthropic made the same accusations in February [30]. Seven months of that [35] have produced an advisory whose remedies are engineering tasks inside the providers [9]. For this quarter it sets a budget line: whoever sells access to a capable model pays for the rate limits and the account forensics, and carries the false positives.
What to watch
- Whether any enforcement action, fine or licence condition follows the Sept. 8 advisory, which so far carries recommendations to developers only.
- Whether Tan or YC puts detail on an "American distillation regime": what it would permit, and which body would administer it.
- Whether OpenAI, Google or others publish exchange counts of their own, since the volume evidence currently rests on Anthropic's telemetry plus the agencies' attributions.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On Sept. 8 the NSA, FBI and CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI in a joint advisory alleging industrial-scale distillation of American models since at least late 2024.
- [2]
The NSA, CISA and FBI issued the joint advisory on a Tuesday.
- [3]
The agencies said the six Chinese companies used "aggressive, malicious, and targeted distillation" tactics to extract billions of tokens from exchanges within U.S. frontier AI models since 2024.
- [4]
Y Combinator CEO Garry Tan said he would do nothing about AI model distillation.
- [5]
"I would do nothing" about distillation, Tan told CNBC at YC's annual Demo Day.
- [6]
Tan's position landed Thursday, days after the joint advisory.
- [7]
The advisory alleged the campaigns had operated since at least late 2024, likely with Chinese government awareness, using fraudulent accounts and proxy "transfer stations" in violation of American providers' terms.
- [8]
Recommended defenses in the advisory include subtly altering answers or quietly moving suspected distillers to a less capable model without notifying them.
- [9]
The agencies recommended three steps for U.S. AI developers: implement comprehensive detection and mitigation, deploy targeted response changes, and establish cross-organization intelligence sharing.
- [10]
The advisory said the pathways used to gain unauthorized access "include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection."
- [11]
The advisory said: "China-based AI companies deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection."
- [12]
Distillation is used to reduce the time and money needed to create a new model.
- [13]
Tan wants regulators to focus on creating an equilibrium between open-weight and frontier models, as long as frontier models retain a price premium that allows their business model to remain feasible.
- [14]
Tan said of the open-weight and frontier balance: "This is actually the ideal case. You want open weight models to give people freedom and access."
- [15]
Tan said, "If I were a regulator, that's what I would go after."
- [16]
Tan called that balance "a tightrope" that "could result in the best possible outcome."
- [17]
Tan said, "We could argue that there should be an American distillation regime." He did not explain what such a regime would permit or who would administer it.
- [18]
The agencies described distillation as "the core, not merely a supplement" of the named companies' development.
- [19]
The agencies said DeepSeek's widely cited $5.6 million training cost did not include the cost of data allegedly acquired through distillation.
- [20]
The advisory said the distillation campaigns targeted variants of Anthropic's Claude, OpenAI's ChatGPT, Google's Gemini and SpaceXAI's Grok.
- [21]
Anthropic said in a Sept. 10 threat report that it had detected attacks from seven China-based labs.
- [22]
Anthropic said operators linked to Alibaba generated more than 151 million exchanges from May through July 2026, peaking at nearly 3 million a day through more than 3,500 fraudulent accounts, the largest campaign Anthropic said it had measured.
- [23]
Anthropic attributed more than 23 million exchanges in that period to Moonshot, and more than 12.1 million over 14 days in July 2026 to DeepSeek.
- [24]
Anthropic said: "The robust safeguards that prevent Claude from being misused by bad actors do not transfer when our models are distilled by an unauthorized lab."
- [25]
Anthropic said its own research showed that a model distilled from a frontier model can help achieve dangerous capabilities, including those in the biological or cyber domains, even when the collected exchanges contain little material about those subjects.
- [26]
The exchange counts are Anthropic's own findings, while the company-level attributions in the advisory belong to the agencies.
- [27]
Critics have pushed back on Anthropic's and OpenAI's distillation complaints because much of the data used to train these AI models may be covered under copyright law, a point Tan highlighted.
- [28]
The New York Times sued OpenAI and Microsoft over its articles in 2023, and book authors settled a related case with Anthropic in 2025.
- [29]
Of the 196 startups presenting at Thursday's Demo Day, 149 were classified as machine-learning and AI ventures.
- [30]
White House Office of Science and Technology Director Michael Kratsios said in July that Chinese distillation efforts, specifically ones by Moonshot AI, have sought to steal proprietary functions from Anthropic's advanced Fable model; Anthropic made the same accusations in February.
- [31]
Advocacy groups have requested the White House take stronger action to keep Chinese companies from importing advanced semiconductor chips.
- [32]
Tan spoke on Thursday, two days after the Tuesday, Sept. 8 advisory.
- [33]
The 149 machine-learning and AI ventures were about 76 percent of the 196 startups presenting at Demo Day.
- [34]
Averaged over more than 3,500 accounts and the 92 days from May 1 to July 31, 2026, the Alibaba-linked campaign ran about 470 exchanges per account per day.
- [35]
Anthropic's February accusations came seven months before the Sept. 8 advisory.
Sources
2 independent publishers whose own reporting we read for this story.
- China is trying to steal US AI models' secrets, intel agencies warn - Defense One
defenseone.com
1 article · September 10, 2026
- implicator.aiYC's Garry Tan Would 'Do Nothing' About AI Distillation
1 article · September 11, 2026
Topics and entities
Topics
- AI model distillation
- Open-Weight Model Publishing
- US-China Open Model Competition
- AI Regulation