Reuters, working alongside the Washington-based Jamestown Foundation, has published one of the most detailed open-source intelligence reviews yet conducted on China’s use of American artificial intelligence — and its findings reframe the terms of the U.S.-China AI competition in a way that Washington’s current policy toolkit is not equipped to handle.
The core finding: researchers with ties to China’s People’s Liberation Army have systematically used outputs from models built by OpenAI and Anthropic as training data for smaller, domestically controlled AI systems targeted at defense applications. The mechanism enabling this is called model distillation — and it is, by design, invisible to the export control regime the United States has spent three years constructing.
What Happened
The Reuters investigation reviewed more than 80 Chinese academic papers and patents. The primary research was compiled by Sunny Cheung, a fellow at the Jamestown Foundation who analyzed more than 60 of the documents. Reuters says it independently verified that literature and identified an additional two dozen military-linked case studies beyond what Cheung supplied.
The papers document a consistent pattern: PLA-affiliated researchers querying large frontier AI models — systems trained at enormous computational expense by American companies — and using those outputs as training signal for smaller, more compact models that can run on local hardware without requiring the advanced semiconductors at the center of Washington’s export control strategy.
Cheung’s framing of what the researchers were actually after is precise and worth quoting directly. Getting a model to produce the right answer, he told Reuters, is the comparatively tractable problem. “Teaching it the reasoning behind the answer is much harder.” The academic literature, on his reading, shows Chinese military-linked researchers trying to extract that expensive, proprietary reasoning — not just surface-level outputs — and embed it in systems they fully control.
The Trump administration has also pointed to Moonshot AI’s Kimi K3 model as a case study, claiming it distilled capabilities from Anthropic’s Fable model — an allegation that illustrates how distillation concerns extend beyond the military research context into the commercial AI competition as well.
The Reading
Why Export Controls Have a Structural Blind Spot
Washington’s export control architecture — anchored in successive rounds of chip restrictions targeting Nvidia, AMD, and their supply chains — rests on a coherent theory: deny China the advanced semiconductors needed to train frontier AI models, and you slow its ability to close the capability gap. The logic is sound as far as it goes. Training a cutting-edge large language model requires clusters of thousands of high-end GPUs that simply cannot be sourced domestically at the required scale, at least not yet.
Distillation breaks that theory at the seam. When a researcher sends a query to a frontier model and uses the returned text as training data for a smaller local model, no physical object crosses a border. No chip is exported. No export control trigger is pulled. The “expensive part,” as the Reuters analysis puts it, has already been paid for — by OpenAI, by Anthropic, by the American investors and cloud providers underwriting their compute bills. The distiller is a free rider on that investment, and the current rules have no mechanism to charge them.
This is not a theoretical gap that legal scholars are debating in the abstract. According to the reviewed literature, it has been operationalized across dozens of PLA-linked research projects covering defense-relevant AI capabilities. The asymmetry between what the United States can regulate (objects) and what is actually being transferred (reasoning encoded in text) is not a loophole that a tighter version of existing rules can close — it is a category error in the regulatory framework itself.
Who’s Saying So — and Why That Matters
The credibility stack behind this investigation is unusually high for an open-source intelligence exercise. The Jamestown Foundation is a non-partisan Washington think tank with a long track record of rigorous analysis of Chinese military affairs. Reuters independently corroborated and extended its findings rather than simply republishing them. The underlying evidence is peer-reviewed academic literature and filed patents — not anonymous sources or proprietary assessments.
That evidentiary foundation matters because the policy stakes are high enough that the findings will be contested. OpenAI and Anthropic both have terms of service that prohibit military applications of their models. Whether those prohibitions can be enforced against users operating under Chinese jurisdiction — or operating through intermediaries — is a question neither company’s legal team has answered satisfactorily in public. The Reuters investigation does not prove that OpenAI or Anthropic were aware of these uses; it proves the uses occurred.
This echoes a broader pattern in AI security that has become harder to ignore. As Blockgeni has reported, the real AI security problem is often not the attack itself but the failure of evaluation and containment systems to detect it — and distillation-based capability transfer is, in a meaningful sense, an evaluation-containment failure at national scale.
The Irony Inside the Strategy
There is a geopolitical irony embedded in the Reuters findings that deserves direct attention. Beijing has been moving in the opposite direction on the consumer side: restricting its own citizens’ access to Western AI models on security grounds and pushing domestic labs to migrate away from American chip architectures. The public posture is of technological self-reliance and AI sovereignty.
Yet the academic literature shows the military research establishment doing precisely the opposite — systematically extracting value from the American AI ecosystem it is officially distancing itself from. The two behaviors are not contradictory if you understand the strategic logic: limit Western AI’s influence over Chinese civil society and commercial infrastructure while harvesting its most valuable proprietary asset (reasoning capability) for state defense purposes.
Read together, the chip-substitution push and the distillation harvest describe a two-track strategy: in the medium term, mine American AI outputs for military capability while domestic silicon catches up; in the long term, cut the dependency entirely once that silicon is competitive. The distillation window may, in other words, be time-limited — but Washington has not found a way to close it before it closes itself. That timeline is the actual policy variable no one is publicly managing.
This tension between public-facing AI sovereignty and behind-the-scenes extraction from U.S. models is also relevant to the broader debate over Chinese AI models in Western markets. As Mark Zuckerberg has argued, banning Chinese AI models from American markets may have unintended consequences — but the Reuters findings add a harder edge to that debate by documenting the directionality of the current knowledge transfer.
What to Watch
The White House has acknowledged the distillation problem, according to Reuters, but acknowledging a problem and possessing a policy lever to address it are different things. The most plausible near-term responses cluster around three domains: terms-of-service enforcement, access-gating on API calls, and new regulatory categories for AI model outputs.
API access controls are the most tractable. Both OpenAI and Anthropic could theoretically implement usage monitoring designed to detect patterns consistent with systematic distillation harvesting — high query volumes with structured prompting across a narrow technical domain, originating from IPs associated with known research institutions. Whether that is practically feasible at scale, and whether it would simply push the activity further underground, is an open question.
Regulatory categorization is harder. Treating AI model outputs as export-controlled items would require a legal theory that has not been tested and would likely face immediate challenge on First Amendment and free-speech-adjacent grounds in the United States. It would also create enormous friction for the many legitimate international uses of American AI APIs. The fact that OpenAI and Google are notably absent from the nascent open-source AI security alliance anchored by Nvidia and Microsoft suggests that even within the industry, there is no unified front on how to handle these questions.
Meanwhile, the underlying capability gap that distillation is helping to close continues to be relevant to broader AI development debates. The question of how AI reasoning capabilities propagate — and who controls them — sits at the center of the ongoing pacing debate among AI insiders who worry about the pace of frontier development outrunning governance mechanisms.
How AI Model Distillation Compares to Other Capability-Transfer Methods
Distillation is not the only mechanism through which AI capabilities can spread beyond their developers’ intentions. Understanding how it compares to alternatives helps clarify both the scale of the challenge and the limits of existing countermeasures.
| Method | How It Works | Requires Restricted Chips? | Detectable by Export Controls? | Used in PLA Context? |
|---|---|---|---|---|
| Model Distillation | Query a frontier model; use outputs as training data for a smaller local model | No — uses existing model outputs | No — text crosses no border in a customs sense | Yes — documented in 80+ papers/patents |
| Open-Weight Model Fine-Tuning | Download a publicly released model and fine-tune on domain-specific data | Partial — fine-tuning requires some compute, but far less than training | No — model weights are publicly available | Possible — open-weight models are widely accessible |
| Direct Chip Procurement (Restricted) | Acquire Nvidia H100/A100-class GPUs to train frontier models domestically | Yes — core target of U.S. export controls | Yes — physical hardware, trackable at borders | Attempted — subject of ongoing enforcement actions |
| Domestic Silicon (Huawei Ascend, etc.) | Train models on domestically produced chips that substitute for U.S. designs | No U.S. chips required | No — no U.S. goods involved | Yes — Beijing’s stated long-term strategy |
The table makes the structural problem plain: of the four primary vectors through which AI capability can transfer or be developed independently, only one — direct chip procurement — is currently addressed by U.S. export controls. Distillation and open-weight fine-tuning are both outside the regulatory perimeter, and domestic silicon development is a long-term trajectory that controls cannot reverse once it reaches maturity.
How Serious Players Should Respond
For American AI companies, the Reuters findings close the space for plausible deniability. OpenAI and Anthropic both operate terms of service that prohibit military use. The documented scale of PLA-linked distillation activity — across more than 80 verified papers and patents — means that passive reliance on those terms is no longer a defensible posture. Both companies should be expected to implement, and publicly describe, active API monitoring programs capable of identifying systematic distillation harvesting. Voluntary disclosure of such programs to the relevant Congressional oversight bodies would demonstrate genuine engagement rather than regulatory theater.
For policymakers, the immediate task is conceptual before it is legislative. The export control framework was built on the premise that physical objects are the chokepoint. That premise has not been wrong — chips remain strategically important — but it is incomplete in a way that the current evidence makes undeniable. The Bureau of Industry and Security and the relevant intelligence community stakeholders need a serious inter-agency process specifically scoped to AI model output transfer, with the explicit goal of determining whether a new regulatory category is legally and practically viable, and what its collateral effects on the legitimate global AI economy would be.
For institutional investors and board-level executives at companies with significant AI API exposure in global markets, the finding carries a specific governance implication: the question of where your model’s reasoning ends up is no longer purely an ethical one. It is becoming a regulatory and reputational risk that requires the same structured risk-management attention as data residency or sanctions compliance. The companies that get ahead of this — with clear use-case verification, regional access controls, and documented enforcement — will be materially better positioned when the regulatory response eventually arrives. And on the current trajectory, it will arrive.
