The Credit Line Nobody In AI Wants To Pay

Welcome to Memorandum Deep Dives. In this series, we go beyond the headlines to examine the decisions shaping our digital future. 🗞️

This week, the U.S. government accused a Chinese lab of stealing from an American one, and the accusation involved no stolen code, no stolen weights, and no stolen staff. Michael Kratsios, director of the White House Office of Science and Technology Policy, said Moonshot AI had distilled Anthropic's Fable model to build Kimi K3. Treasury Secretary Scott Bessent warned that sanctions and Entity List designations were on the table. Beijing promised to respond in kind.

The technique at its center has been public since 2015, and it is not complicated. A developer sends a powerful model a very large number of questions, keeps the answers, and trains a cheaper model to imitate them. The student never touches the teacher's parameters. It learns from behavior alone, which is why no court has managed to say what it actually is. In February 2025, researchers at Stanford and the University of Washington did it for under $50.

So the row looks like a fight over whether one model should be allowed to learn from another. Read what both sides have actually written, in the statements, in the licenses, and in the bill now moving through Congress, and neither of them says that. The argument is over something much smaller, much older, and far more expensive for the people demanding it than any of them have admitted.

From footnotes to sanctions

Every student who writes a thesis learns to cite the work behind it, because citation does two jobs at once: it grounds new work in what is already known, and it shows the writer is not passing off borrowed ideas as original. Painters work by the same rule, since an artist who uses chiaroscuro is borrowing a technique developed centuries ago. As long as that lineage is acknowledged, the result reads as part of a tradition. Unacknowledged, the same brushwork reads as theft. What both fields settled is narrow: not that borrowing stops, only that the borrower names the source.

Technology never settled the credit question that cleanly because it pursues two goals at once: advancing knowledge and building products that capture markets. Its own history is full of moments when borrowing was lawful, yet the credit still went missing for years. Apple built the interface that made the Macintosh famous on ideas its engineers saw during two visits to Xerox PARC, access Apple granted in exchange for letting Xerox buy 100k pre-IPO shares for $1M. Microsoft supplied IBM with an operating system it had not written, having bought the rights to 86-DOS from Seattle Computer Products for $75k in total before renaming it. Nobody was sued in either case, and nobody needed to be, which is what makes the pattern worth holding onto: once the deal is lawful and paid for, the only thing left to argue about is the acknowledgment.

Machine learning has now produced its own version of that argument, and the mechanics are simpler than the vocabulary suggests. In a 2015 paper, Geoffrey Hinton, Oriol Vinyals, and Jeff Dean described the method now called distillation, in which a developer sends a large volume of questions to a powerful model, records its answers, and trains a smaller model to reproduce them. The smaller model never sees the teacher's weights, the numerical parameters that hold everything a model has learned, and it does not inherit the teacher's architecture either. It learns from behavior alone, which is why the law has never managed to classify it, since nothing has been copied in the usual sense.

For a long time, this remained a quiet corner of research because only wealthy labs could build models worth copying in the first place. That changed in February 2025, when researchers at Stanford and the University of Washington trained a reasoning model for under $50 in rented computing time, using answers drawn from one of Google's systems. A cheap student could now pick up a fair share of what a very expensive teacher knew. The companies that had paid for the teachers started asking who was allowed to learn from them, and the question did not stay inside the industry for long.

It reached the White House on July 22, 2026. Office of Science and Technology Policy Director Michael Kratsios wrote on X that the government had information that Moonshot AI had distilled Anthropic's Fable 5 to build Kimi K3, its new open-weight model. CyberScoop noted that he gave no account of how the government knew. Treasury Secretary Scott Bessent followed hours later, and TechCrunch reported his warning that sanctions and Entity List designations were on the table, because, as he put it, "open source is not open season on American IP.” Kratsios made a second allegation the same day: that Moonshot had obtained Nvidia GB300 servers restricted from sale to China and accessed others in Thailand. That claim stands on its own, and nothing about crediting a teacher answers it. Beijing rejected the charge within the week and promised to respond in kind, which turned a method first outlined in a research paper into a quarrel between two governments.

Nobody is arguing about learning

Read what the two sides actually say, and something is missing from it. Neither one claims that a model should not learn from another model. Kratsios went out of his way to call ordinary copying a healthy part of an open field, and the companies complaining hardest sell the method themselves. OpenAI has offered it to any developer who wants it since October 2024. The argument turns instead on two much smaller things: how the borrower got in the door, and whether it ever said whose work it was standing on. On the second of those, the industry stopped waiting for governments years ago.

The rule the industry wrote for itself

AI companies have already decided that borrowing is fine so long as you say so, and they wrote that decision into the paperwork that ships with their models. Meta's Llama license tells anyone who trains a model on Llama's answers to display the words ‘Built with Llama’ and to put Llama in the new model's name.

Moonshot, the firm Washington now accuses of taking without asking, demands much the same from anyone building on Kimi. DeepSeek did not wait to be told, naming its models after both the teacher and the base it started from, so that anyone downloading a file could read its parentage off the label. None of this is a statement of good intentions, since these are binding terms and the industry tested one of them publicly last spring.

In March 2026, the coding company Cursor launched Composer 2 and presented it as its own work. A developer, posting as Fynn, found a Kimi model identifier in the responses and published it. Three days later, as TechCrunch reported, Cursor confirmed that Composer 2 had started from Moonshot's open weights, and Moonshot confirmed the arrangement was licensed and paid for.

Nothing had gone wrong except the missing credit, and once the credit appeared, everyone lost interest. The rule worked as intended, cost one company a bad afternoon, and asked nothing at all of any government.

The same failure looks very different when the borrower sits outside the contract. Anthropic reported in February 2026 that three Chinese labs had run millions of conversations through Claude using tens of thousands of fake accounts. That is a real complaint and a serious one, but read it closely, and it describes how they got in rather than what they learned once inside. Public argument calls both things theft, and the heavier word lets a case about forged sign-ups carry the moral weight of a case about plagiarism.

Where the accusers started also matters. Anthropic trained Claude partly on books pulled from pirate sites, and a judge approved a $1.5B payment to authors this July. The charge against Moonshot rests on little the public can check, since Anthropic's model returned to service on July 1, 2026, and Moonshot shipped its own on July 16, 2026, leaving 15 days for work that researchers say takes far longer.

Why the rule bends

The rule holds firmly in one direction and slips in the other because nothing above it carries any force. Copyright covers what people write, and what a copying model reads is mostly text a machine produced. Trade secret law protects what a company keeps hidden, and these answers go to any customer willing to pay. That leaves the contract, and a contract binds only the person who signed it.

Congress has stayed inside that limit rather than trying to break it. A bill that cleared its House committee unopposed in April does not turn a model's answers into property. It builds a way to name foreign firms and cut them off from American technology, and a blacklist only reaches those who need American chips and software to keep working. So the duty to name your teacher tracks who Washington can reach. Whoever actually did the borrowing is a separate question.

Where a company stands on all this tends to follow what it sells. A letter published July 24 opposing broad limits on downloadable models launched with 25 signatories and has since passed 230. CNBC noted at the time that OpenAI, Anthropic, and Google had all declined to sign. OpenAI and Google added their names within two days. Anthropic has not. Positions on how borrowing should be policed are forming inside balance sheets, which is a poor foundation for a rule meant to cover everyone.

Who a fair rule would cost

That is the trouble with the fix that looks obvious. Ask everybody to name their sources, and the bill arrives in wildly different sizes. A company that owns the teacher pays nothing, and quietly gets advertised every time a student ships. A company whose worth rests on looking original pays a great deal, which is why Cursor left the line out and then put it back in within the hour. A frontier lab pays most of all, because a rule that follows a model back to what made it would not stop at other models. It would keep going until it reached the books, the websites, and the archives underneath the lab's own system, and that is the stretch nobody has volunteered to label.

The public argument is much broader than the one that is still open. Whether one model may learn from another was settled years ago, in the licenses, in the products, and in the names printed on the files. What remains open is who has to say so, and who decides. That now sits with a Commerce Department weighing blacklists, a Congress weighing a sanctions bill, and a court that nobody has yet asked whether any of these contracts hold. Scholars and painters reached their answer without a single piece of that machinery, by treating the credit line as the price of entry rather than a favor handed to a rival. The AI industry gets there only when the credit line is owed by every borrower, including the ones with the standing to refuse.