Report claims China is distilling U.S. frontier models to power military AI applications

Reuters and the Jamestown Foundation spent months digging through more than 80 academic papers and patent filings, and what they found isn't subtle. Chinese institutions with direct ties to the People's Liberation Army have apparently been feeding outputs from GPT-3.5, Claude 3 Haiku and other American models into their own training pipelines, a technique called distillation. Instead of building sophisticated systems from scratch, which requires the kind of advanced chips Washington has spent years trying to keep out of Chinese hands, researchers are essentially cloning the reasoning of U.S. frontier models into smaller, cheaper systems that run on whatever hardware they have.

The examples in the report read like a checklist of exactly what export controls were designed to prevent. PLA Unit 96941, the cyberwarfare arm of the Chinese military, reportedly distilled GPT-3.5 to build a lightweight model that processes sensitive source code on internal networks. The North University of China, a school with deep links to weapons manufacturing, allegedly used Claude 3 Haiku to generate synthetic data for a social-media surveillance classifier. And at the National University of Defense Technology, researchers are said to have shrunk a U.S. image-recognition model down small enough to run directly on drones, feeding real-time video into navigation and targeting systems.

None of this happens in a vacuum. Alibaba's Qwen3.8 preview last month claimed second place behind Claude Fable 5, edging out GPT-5.6 on benchmarks. Moonshot AI's Kimi K3 landed as the largest open-weights model released so far, with similarly bold performance claims. Every time a Chinese lab drops a model that punches above its supposed compute budget, the distillation accusations flare back up, and Treasury Secretary Scott Bessent has floated sanctions against firms caught doing it. Microsoft's Satya Nadella has pointed out, not unreasonably, that Anthropic itself trained on scraped internet data without asking anyone's permission, so the moral high ground here is a bit muddy on both sides.

What distillation doesn't do, according to SapienX co-founder Trevor Koverko, is hand China a path to genuine AI independence. It's copying selected skills into a smaller box, not inventing something new. So the drones and the surveillance classifiers and the code-processing tools are real capabilities, built cheaply and fast, but they're borrowed capabilities. China still needs its own breakthroughs to actually leapfrog the labs it's currently distilling from, and that's a much harder problem than scraping outputs.

The timing is awkward, arriving right before U.S.-China talks on AI governance and safety. Washington will frame this as theft and a workaround of sanctions. Beijing will call it hegemonic gatekeeping by companies that built their own models on data nobody licensed either. Both arguments have a point, which is usually how these things end up going nowhere fast.