Hacker News

Agreed! I had to do a double take and check the URL. I thought I am reading a press release rather than actual reporting.

> Distillation is NOT an attack.

From the article -

> 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts

wouldn't that be considered an attack? Not sure what I'm missing here.

The standard of neutrality that people here pretend to require from news organizations is not even remotely realistic.

It was a timely story from Reuters. They do fast news feeds, like APnews. Could it have been better or more accurate? Sure, they could have gone into why distillation may or may not be seen as "an attack". But then it would have been a more involved story, defeating the purpose of a news feed.

The Reuters piece was "good enough". Some other place like the NYTimes or WSJ can follow up with more detailed investigative coverage if it's a worthwhile story.

Distillation done via bulk automated activity of fraudulent accounts, in violation of a terms-of-service, can reasonably be called a "an attack" – specifically a "distillation attack" – even though distillation itself isn't necessarily an "attack".

This is similar to how compromising an account through bulk automated trials of many passwords is reasonably called "an attack" – specifically a "dictionary attack" – even though using a dictionary is not itself an "attack".

You shouldn't need to smuggle your sympathies (for the tactic or perpetrators) or antipathies (for the target) into peculiar judgy language prescriptivism against common, understood usages.… that then label Reuters "complicit" for simply reporting Anthropic's claims accurately. That's what Reuters is supposed to do, in a story about a letter Anthropic wrote!

Distillation may not be an attack, but it is a ToS violation and could be seen as IP theft.

Any reasonable company would be pissed if a competitor, especially at Ali Baba's size, leveraged that company's R&D to compete. It is in this sense, a corporate attack.

If you want to roll your eyes at distillation concerns, you might need to excuse Anthropic for originally using pirated material to train their models.

Reuters is probably the most rigorous news agency in the world.

> it said was the largest known attack

> Anthropic said in the letter it was supportive of the U.S. government's efforts to combat the attacks

both times the word "attack" appears it's clearly stated that the word was used by the company, it's a direct company quote.

actually putting it into quotes would be editorializing

> Unfortunately, the Reuters piece itself is complicit in this dramatization

how would you feel if somebody quoting you would turn your word dramatization into "dramatization" because they don't agree with your assesment

Anthropic raped everyone without asking and stole their labor to build their career-commoditizing tech.

Distillation is Robin Hooding it back so that one trillion dollar company doesn't reap all the benefits of their automation of the workforce.

Distillation is Prometheus bringing fire from the gods to give to ordinary humans. Something we all own anyway, but that was kept from us.

Distillation is freedom.

Everyone should be pro-distillation. We should all work together to distill every proprietary model.

Anthropic stole. OpenAI stole. Google stole. ElevenLabs stole. Suno stole.

We should be able to get it all back.

Well Zai's GLM 5.2 legitimately is a frontier-level model, though not quite parallel with Opus or Fable. Unfortunately, its too damn big to run locally for most people. Thats the bottleneck right now; the open-weight models exist but something capable of competing with the frontier models just can't run on anything normal yet.

>They want to create a monopoly and destroy every competitor, before they got a chance to rival them.

VC/Startup playbook 101.

Byproduct? It’s essentially the only part of an LLM that is useful, because it’s the WHOLE product!

It’s the same reason why DRM for audio and video is a non sequitur - if you want a person to see or hear audio or video, eventually at the end of the chain, it’s going to be converted to audio for the ear and light for the eyes - that’s why you attach your tap.

Without a model generating tokens, what’s the point. So if Anthropic somehow disable quality token generation, what’s the point!

It's not about how big your dataset is - it's about how you use it.

I jest, but I'm also completely serious. 1T tokens from Claude can teach a model something 1T tokens scraped from the open web can't. Things like "how an LLM can problem solve effectively", or "how an LLM should use tools", or "how to construct reasoning chains", or "when to double check", or "what innate capabilities an LLM can or can't rely on".

Those are valuable things that Anthropic's own team spent a lot of effort post-training into Claude. Distillation allows them to be extracted and transferred to an otherwise unremarkable base model.

There are multiple stages of training, and the data/compute mix at each are quite different and produce different "layers" of intelligence.

The pretraining stage is the first stage which consists of "next token prediction" on the entire internet, PB of tokens, etc. This is what most people think of when they think of training LLMs, however it produces a "base model" which is not really "intelligent", but rather much like a blurry JPEG of all human language and knowledge. You cannot really talk to such a model; it will simply complete your prompt by producing both sides of the conversation. Note however at some level the training has encoded enough structure through compression that it is able to simulate all sorts of phenomena, from human conversations to code. The great R&D difficulty here is to scale pretraining so that it can proceed smoothly in vast distributed datacenters in a fault-tolerant manner.

The next few stages are collectively called post-training, and typically consist of supervised fine-tuning, then reinforcement learning.

In supervised fine-tuning, the model is further trained to predict the next token, but on a much more focused data set of natural language conversations where the "assistant" and "user" turns are explicitly delineated with special tokens. The output of this stage is a model which is capable of carrying on proper conversations, but typically with no ability to creatively problem-solve, and less of a personality. The data and compute are many orders of magnitude smaller than in pretraining.

The reinforcement learning stage used to be a small part of model training, but ever since AI-assisted coding took off, it has become larger and larger chunk of training. In recent models, the compute spend on RL has allegedly come to rival or even exceed that of pretraining [1], which is a bit scary because RL is classically what lead to sci-fi like AIs which are extremely good at accomplishing goals to the detriment of everything else.

The way that RL works is that you put an instance of your model in some environment (such as a VM containing a git repository) and give it a task (such as fix the linked github issue). The model will then generate a bunch of attempts to solve the task which we call "trajectories", in most cases there is either an objective measure of the task success (such as passing the tests), or a fuzzy measure (such as having another LLM look at the results and provide a score). This is called the reward, and the model will learn slowly by producing trajectories that receive reward. It can actually be quite hard to prevent "reward hacking" from the model here and the rewards must be shaped very carefully, much R&D labor goes into here, as well as similar challenges to distributed pretraining.

A significant challenge is that coding/knowledge work tasks these days are getting extremely difficult, we are far beyond 2024 days where models could barely solve the easiest problems in SWE-bench. Tasks at the frontier now look more like mini projects that would take humans multiple hours or even days to finish (or in some cases, research-style tasks that would be beyond reach for even top human experts, such as the Erdős unit distance problem which was posed in 1946 but wasn't solved until recently, by GPT-5.5). Huge amounts of trajectories must be produced, and huge amounts of them produce zero reward and therefore are useless for learning. Getting a cold start requires running tens of thousands of instances of your model in VMs in parallel for multiple days to produce trajectories, to say nothing of the GPU costs.

So what do you do when you only have a model which is capable of basic conversations but cannot even begin to tackle basic coding tasks, use tools, etc? The approach that companies behind the frontier have decided on is to bootstrap their learning process by having an already extremely intelligent model such as Claude produce hundreds of thousands of seed trajectories for them. Then they can use this data to get a warm start and begin learning immediately. And if you use Claude for your reward model too, you get to skip the nastiness of reward shaping.

Therefore, even if in number of raw tokens the data are much smaller than internet-scale pretraining data, the value that each token provides is far far greater.

[1] For example, Grok 4 compute spend on RL was ~100% of that of pretraining: https://www.interconnects.ai/p/grok-4-an-o3-look-alike-in-se...

Training isn’t a single homogeneous step. It starts with pretraining which requires bulk PB of data but you have less quality concerns here. You cover the whole data distribution. Later stages require less and less but increasingly higher quality and complex datasets. The late stage ones are highly curated and might even be sourced from world subject experts. This is where frontier labs with big pockets have the advantage.

Actually nowadays LLMs are only trained with TBs rather than PBs of data, and it's not too hard to find GBs of agent traces online.

This might be like an observational study vs a study with a control?

Supposedly the details of the ‘jailbreak’ are that you give it insecure code and say “fix this code”, and it does, and then you ask it for test scripts and that’s effectively an exploit against the unfixed code.

If true then I have no idea how anyone’s going to release a useful model that doesn’t have the same jailbreak. https://www.theregister.com/security/2026/06/15/feds-freaked...

> If #2 was false, surely some other LLM lab would have done it by now.

This is a logical flaw. LLM that is immune to jailbreak _could_ exist, but not yet, or maybe nobody talks about it. Yes there's a market, but all of these AI boom is too recent to make any claims.

I'm pretty sure that Gödel incompleteness theorem and its consequences pretty much guarantee #2

Similarly, if you did a corpus study on bioRvix to summarize recent science findings — you could use the same questions and answers to fine tune a model.

There is no way to communicate information at scale to companies through the API, for anything approaching a real application, without that information forming a corpus another model can be trained on.

But it wouldn’t be the first time they broke a model:

Their “guardrails” that cause it to reject user prompts also means it relies on its pop science summary of medicine to tell you why bioRxiv is wrong rather than accurately summarize the papers.

They’ve successfully created a smug, argumentative average of the internet which refuses to even consider it might be wrong or that it’s reading a science paper which is based on measurements and not vibes — but why would I pay for that?

I get it for free online.

If compute or access to training data were the only issues, then companies like Meta and X.ai (Grok) should be doing better, even Google for that matter. Musk even admitted that Grok used training data from OpenAI models.

https://techcrunch.com/2026/04/30/elon-musk-testifies-that-x...

While there is no moat as such, there is still a lot of expertise that goes into training SOTA models. There's a reason Google was willing to pay $2.7B just to get Noam Shazeer back to improve Gemini.

You got that wrong. The forcing function of compute scarcity is an advantage not a detriment. The amount of investment pulverized in performative model training and dead ends (Hi Sora) should make this obvious.

If saying “plz don’t distill me” is your moat, you don’t have a moat.

Define compute deficit?

They've been bringing out open weight models competitive with frontier models. How could they do that if they had a compute deficit?

> The only way the U.S. keeps that edge is to prevent distillation.

For how long ? year ? how long till model that is year behind will be fine for 90%+ use cases ?

Not to mention, the person who brought this quote unquote jailbreak to the Trump Administration was Amazon’s new CEO. They know their IPOs are coming up, so locking their competitors out of the U.S. (even if just for the weeks surrounding the IPO date) would be a major boon. The White House seems to love making announcements just for the sake of making the market move…. Coincidentally, right after POTUS buys a massive amount of the benefactory company’s stock (Buy Dell Computers, lol)

I'm not 100% sure it's not possible. If (I don't know) it's possible to freeze the temperature of the model so it's deterministic, and if you could make a map of produced words back to tokens (via HMM probably), then you can probably alter a minimal input and observe the output to model it. If you perform waves of such minimal alterations, you can expect to be able to locate the distance where each alteration impact the model (the idea being that a small alteration on output is likely due to the last layers of the models, and a small alteration is likely due to the deeper layer). Once you've located most of the last layer(s?) weights, you can try to solve for them. With a hundreds of billions weights model, the last layers will likely be so huge that it's probably unfeasible technically, but it's theoretically possible.

No, you'd need to have the model on your filesystem for direct access, and then the architecture would need to be the same.

If you have access to the weights, you can just use them as is...

You can do things like that - one example is averaging weights between related models - but not with Anthropic's models, because outsiders don't have access to the weights.

The companies are all for-profit companies, its not like they're selling out some national security goal for profit, profit is the point.

Anthropic already heavily restricts Chinese traffic but that only jams up researchers and regular Joes. Anyone motivated enough can hop a flight to Singapore with an nvme drive in their pocket.

Bringing more competition is "anti-competitive" now.

DeepSeek permanently cut its V4-pro API prices by 75% because they were too expensive. Without the price cut, Deepseek V4-pro tokens would have cost more than resold Opus 4.8 tokens.

Opus 4.8 is a more capable model, so almost nobody was going to pay for V4-pro at the original price.

It's somewhat difficult to have any sympathy for Anthropic here. They're entirely responsible for selling tokens at below cost, with the age-old bait-and-switch tactic.

If they weren't doing so, then these Chinese resellers wouldn't be viable. Radical idea, but how about they actually charge a viable price, even on subscription plans?

If resold Anthropic tokens undercut even the at-cost open-weight model tokens, because they're reselling subsidized subscription tokens, then you'd have to start selling open-weight model tokens at a loss in order to match them.

Also, wouldn't that claim only hold in China?

I'm an European and I'm not using those proxys the article describes.

It's very difficult for people to create personal Anthropic accounts from China. Anthropic blocks Chinese bank cards, so people must pay with a foreign bank card, which they likely don't have. And even if they manage to set one up, they have to access it via VPN, which eventually gets the account flagged. They then have to complete identity verification, which most Chinese users are unable to pass.

There's a similar Claude resale market going on in Russia. On Funpay they are selling Claude tokens for roughly 20-30x cheaper than official Anthropic API pricing.

> Claude and ChatGPT are both blocked in China

So it's presumably cheaper than attempting to spin up your own method of circumventing the blocks.

You can use it as an API unlike the subscription.

Maybe these resellers are using stolen American credit card numbers? Reselling Claude access seems to be a nice way to launder the money.

China aren't offering a cheaper solution. They are subsidizing an existing one (which is already subsidized) in order to gain foothold. The difference is that in the US subsidies come from VC, while OP implies subsidies come from the AI labs that buy the training data (which may as well also be VC backed, so just one extra hop).

This isn't "the market working as intended", this is an exhaustion fight to the bottom where the one with most money gets to stay in the market. As with most venture capital startups. I believe this VC tactic is a well documented "cheat code" to bypass market forces and build a monopoly. I find it hard to compare that with a free market.

However, I don't really mind China "stealing" from Anthropic. For us consumers we are getting the cake and eating it too. I.e we are getting rapid improvement to the tune of over a hundred billion dollars in funding, yet the market remains big enough that there's a chance of it not ending up as a monopoly in 20 years. And venture capital are footing the bill. A part of their investment is practically being redirected to fund Chinese AI development. It lets us live out our lives as happy CAC farmers[1].

So I would argue its not as much of a "cheaper solution" as it is intentionally and maliciously abusing another company's product to extract more value than the billing plans intend (given an average user), and further subsidizing the product by selling this data to competitors. But I don't necessarily think its a bad thing for us end-users. Nor for the market. But it is bad for Anthropic and its investors.

[1]: https://phrack.org/issues/71/17

>This is great for competition! Chinese vendors offering a cheaper solution = what economics told me the free market was all about.

Yeah, like all those Chinese bootleggers selling DVDs for a few dollars rather than $20. Free market!

https://news.ycombinator.com/item?id=48664814

I get the vague impression that this was written in a sarcastic way, but it has a straightforwardly true literal read because yes, this is what the free market is about and Anthropic will have to compete with the Chinese if they want a big share of the market. Chinese models are cheap and good; even without reselling Anthropic's services they're competitive. Which reading did you intend?

And, gotta say, the idea that the Chinese are better at selling US models than the Americans is hilarious. There might be an economic study here somewhere about just how anti-consumer and anti-progress their IP laws turned out to be. We've got an entire postindustrial revolution centred around who can ignore the most stupid laws.

> Or does this not apply to huge US corporations any more?

When it comes to favorite companies of the tech communities, it's almost always "Rules for thee, but not for me"

The standard stance is "they can do no wrong and they are absolutely perfect". I mean, look at any thread with anything about Apple in it.

> what economics told me the free market was all about.

Don't complain when US starts to play by the same rules China has been using for decades.

It never did.

In debt the first 5000 years Geaeber makes the case that pure “free market” trade has never really existed in “the west”. The closest to this ideal that’s ever happened was during the Islamic golden age enabled by religious prescriptions against usury.

AI was always going to be a race to the bottom and low margins. It’s why I’m extremely bearish on AI as an investment. It’s framed as some high margin business when it’s really going to end up like your toilet paper at Costco. You will use whatever is cheapest and gets the job done.

Free markets work when paired with property laws that can be enforced if broken. If China could offer a cheaper solution in that framework, it would be as you say.

If you continue studying econ you will learn about the various failure modes of free markets including the free rider problem.

https://en.wikipedia.org/wiki/Free-rider_problem

>This is great for competition! Chinese vendors offering a cheaper solution = what economics told me the free market was all about.

Ah yes, systematic fraud and protectionist practices, free market through and through.

The "free market" gave the PRC its current strategic lock on rare-earth minerals. There's definitely no such thing as a free market in a Maoist dictatorship. I personally think the "free market" concept is an unachievable ideal and thought-terminating cliche, but "free market in a Maoist dictatorship" is for sure a contradiction in terms.

Nuance please.

They are:

1- breaking terms of conditions of the service

2- getting banned and creating thousands of accounts to break the conditions of the service at scale

3- using VPNs and proxies (possibly residential) to mask their network origin and identity

4- Using potentially fake names to sign up

5- Using different credit cards?

Fraud on so many levels, a lot of the infrastructure and modus operandi is what cybercriminals use, these are attackers man, whether you like the victim or not, and whether you think it's poetic or not, I recommend compartimentalizing and just trying to gauge whether an act is wrong or not in itself.

Externally subsidized predatory pricing is the opposite of a free market.

Do you also think Chinese selling counterfeit US postage stamps on eBay for 50% retail price (which is a major problem CBP and USPIS are fighting presently) is the free market at work?

This post is so delusional and dripping with condescension I've read it three times and I still can't figure out if you're trolling or not.

I guess you missed the fraud part.

Maybe Fable is not as capable as thought?

On the one hand they talk it up as world ending and on the other hand they can't manage bot accounts on their own service.

I want to hear how this can be rationalised.

From the article "every layer of control frontier US AI companies have added (geoblocking, phone verification, credit card requirements, and now live biometric KYC checks) has produced a corresponding layer of evasion infrastructure".

> One would think Anthropic could point Mythos at this to solve the reseller problem outright

You're assuming Anthropic want to stop it.

I think it serves their interests more to be able to release stories like this from time to time, to feed to the US government, in an attempt to get the Chinese competition shut down.

This only shuts down the account you have bought in the first, plus a few others if it is shared.

> Use any metadata to identify related accounts

How does that work? I think this is the most important part to have an impact on the „thousand“ bot accounts.

They could be doing this internally and want to see if they can downright eliminate these loopholes before bringing Fable back.

I don't care how they do it, I just want to use Fable again.

This, just like blanking out a football stream for a split second to binary search and find IPTV rebroadcasters, is far too good a solution. Suits prefer to make it seem like their job of fighting "misuse" is hard, justify their budget, continued existence of the trust & safety department, face scans, etc.

That's not true, some of them are indeed fake, but a lot of them are actually providing real opus at low cost doing what op said.

I don’t follow your reasoning. It is foreign to me. You talk about winners, but this is clearly fraud.

The chinese have already worked around the ID verification, by recruiting people in low-income countries to complete the checks for less than 30 USD per account (so much for Altman's Worldcoin).

https://tech.yahoo.com/ai/claude/articles/chinese-grey-marke...

If Anthropic is selling a dollar for less than a dollar, they are running a business that doesn't make sense. That's what jeopardizes Claude Max, not this.

That is pretty crazy, almost like how Claude and all the other models are jeopardizing other businesses without paying for their training data and wiping their ass with robots.txt

No, this reseller 中转站 thing is basically a loss leader for certain chinese ai labs to distill claude with verified human input.

No, it's part of the capability theft. They resell Claude tokens cheaply and then simultaneously log everything for distillation. Even if they take a small loss on the token sales it's much cheaper than the equivalent compute.

Not really. I think Anthropic focuses on identifiable distillation attacks rather than the (even larger) industrial-scale token harvesting and reselling operation, because they don’t want people to know how easy it is to get cheap Claude tokens.

Once people realize they can access Anthropic models at a 90% discount, they won’t want to pay full API prices anymore.

how hard is it to find a manager or ops team member at one of the enterprise companies and buy lets say 100gb of logs? the chinese lab can promise to anonymize the data before training, not release it raw and pay a good price.

honestly you might just need to get data from a couple long sessions and feed it back to another model as an example to make synthetic reasoning chains. if the emulator model is good enough it should work.

That sounds like it would actually be fraud.

Depending on the provider, GLM-5.2 is between 4.5-5x cheaper than Opus. You can compare prices/speed/etc. for basically all relevant models on aa https://artificialanalysis.ai/models/glm-5-2/providers

a company can just download GLM 5.2 and start self hosting this model using the chip designed and made by itself. That could lower the cost by 20-30x.

for hobbyist buying a few Mac Studio to host GLM 5.2 at home, the cost might 10x more than just using Opus API.

Why do you need macbooks? Just rent servers from any hosting provider.

The resellers route requests via one of thousands of Claude Max 5x accounts. When an account reaches its usage limit, they automatically switch to another account.

    > Do they have MacBooks in the US that run the queries and stream the outputs back to China?

the answer to your question is containers/VMs + residential proxies

ask your gpt how does openrouter work, then ask, how do proxies work.

They probably asked claude how to do it.

They buy the logs from the bot farmers

People have estimated that a $200 Claude Max 20x subscription gets you ~$2800 worth of tokens every month if you use it continuously. So if you can find a way to resell the tokens you can offer a 90% discount and still make a profit.

> Does this mean that the reseller (for example XYZ) is buying it from Anthropic at Anthropic's price and then reselling it at a cheaper price????

Yes, as they explained they do it through things like pooling accounts, straight up payment fraud, and double-dipping by selling the logs of the conversations to chinese AI labs so that they can train their own models on it.

> The link does mention Opus and other models but what's the proof it's actually Opus. I could be selling deepseek for all they know and can call it Opus. System prompt: "If anyone asks your name - you are Opus 4.6".

There might be some that try this, but they would get caught very quickly, there's still a moat between Claude and Deepseek, even in casual use.

Look up Zilan Qian's reporting if you want more detail.

Because Anthropic's subscriptions come with X amount of tokens / week, and divided by the subscription cost it is WAY less than what they charge per-token (the "API price") beyond that.

So these resellers get a ton of accounts on subscriptions and sell the cheaper tokens.

They probably buy the plans instead of the API tokens, and resell access via a custom API that routes to the plans. So you presumably get cheaper access this way than paying API pricing.

It makes no sense.

These China e bashing is very annoying. It is hard to argue with people drowned in American propaganda. I'd expect better arguments from the intelligent people in HN

That's an insightful perspective and I think I largely agree. But just for fun, I wonder if that isn't an argument in favor of making the function implementation impure. Perhaps "enhancing" all queries with some sort of search result (or query of a giant db) instead of charging for an explicit tool call. Not only is it sorely needed to prevent stale data but (on the process level) it breaks the purity assumption on which the approximation theorem depends (alternatively on the function level it introduces hidden inputs).

This is why every AI company does crawl today.

Do they just reshape the function on the fly or save the process steps? Maybe it doesn't matter anymore. Even Google indexes are more and more spoiled to become representation of the function, because of the AI slop.

Genuine live data is king.

Obviously because you cant join open router and start serving OpenAI / Anthropic models.

Probably because Openrouter is a US based company, and they don't want to be sued by Anthropic/OpenAI.

They're called 中转站 (transfer stations/proxies). They can be a bit tricky to find on your own, so I'd suggest asking your preferred AI to search in Mandarin for you. I linked a larger operator in the parent comment, or have a look at https://hvoy.ai/ which lists a ton. You can also find many on Funpay, which may be easier to use.

This is one seller I found, they're reselling "real Max 20x subscription accounts", at ~97% below official API prices https://funpay.com/en/lots/offer?id=70812310

Note that whoever you buy from will be able to read all your tokens, so don’t use it for anything confidential/financial.

And there are a ton of Claude conversation logs (with CoT/inference) with no clear provenance circulating freely on huggingface, guess where they (likely) come from.

The issues with LLMs go beyond just IP theft. I would not say PRC making LLMs cheaper is the best outcome (though it is better than nothing). The best outcome would be to make the practice of training on our data without consent illegal, which would simultaneously slow down economic change and make it more organic as well as give PRC companies less capabilities to extract.

i still want those data sets to become public domain. open weights still isnt good enough

I hope you say the same when these cheap llms are used in drones to target humans. The world models are exactly built with that direction in mind.

Yeah nobody is gonna be shedding any tears for them

Indeed! It’s so hard to find reasonable takes on AI that aren’t littered with accounts created 11 days ago that only post in threads related to Anthropic for some reason

Chinese models are the exact opposite of what you claim to want, they are all highly censored, even more so than Anthropic models, with government mandated censorship.

Yes, I think the Gates quote was a response to repeated and aggressive complaints originating from Jobs (to anyone who would listen) that he had been ripped off.

I don't know if that's a real quote from Gates, but I do know it was in Pirates of Silicon Valley.

I thought Xerox demoed something they haven’t implemented yet, and Apple turned a mockup into a real GUI.

I'm very pro distillation. I think there needs to be distillation non profits who curate massive corpi of super high value training data from frontier models. They could have an "anonymous contribution" system where regular people with max subscriptions upload their conversation histories. It's a rough concept, but surely would be a huge boon to humanity.

Glad you pointed this out. I believe the sequence was that Jobs himself got a shorter demo during his first visit with no prior arrangements. He then negotiated bringing back a group of his key people to get a more in depth demo and that included the stock deal.

When Apple was accused of 'ripping off' PARC, Steve didn't seem keen to bring up this rather salient point. I suspect it may have been a combination of wanting Apple to continue receiving credit for these innovations from consumers and also the fact that, in retrospect, the million dollar stock deal could seem a bit like trading beads to Native Americans for Manhattan Island. Another point worth noting is that Apple's PARC visit was in December 1979 and the Xerox Star was publicly announced in April 1981, so Apple got a 15 month head start (the Apple Lisa shipped in Jan 83).

I've also heard that Xerox didn't hold on to the Apple stock for very long, so never gained the windfall they could have. As is well documented, Xerox senior management didn't understand what they had in PARC and also didn't understand how rapidly microcomputers would become ubiquitous. So, of course, they didn't think Apple's stock price would skyrocket either.

Perhaps an arrangement can be reached?

The bottom line has not shown that to be the case.

My long-term prediction for the sector is that frontier models will be so expensive that they will only be available for grant-funded projects at research institutions, like supercomputer clusters were 25 years ago.

Meta Spark is rumored to have distilled Claude to some extent, early Gemini models as well. I think the biggest factor is that Chinese companies arent really afraid of being sued by Anthropic because the juridictions are so disconnected. European/US companies don't have the same protection.

Aside from politics/law, it's probably much easier for everyone else to distill from the Chinese model which already distilled Claude/GPT/Gemini. Maybe not as good a result, but you don't need to jump through dozens of hoops.

>What’s preventing tech companies from the UK, Germany, etc. from distilling Claude

literally nothing but given that the Chinese already did it and the models are published what's the point. You can thank the Chinese taxpayer for subsidizing the electricity bill and just download the thing

Curiously, this isn't always true.

For example, GLM 5.1 is more capable at pentesting than the model from which it is alleged to have been distilled [1].

Intuitively, this makes some sense: you can "distill" from multiple frontier models, and you can further post-train the distilled model. But I'm not sure exactly what happened with GLM 5.1.

[1]: https://dualuse.dev/posts/chinese-models-are-sometimes-bette...

I'm ok with having last months model at a tiny fraction of the price.

I personally bristle at the corporate espionage and IP theft that China has undertaken the last few decades. I can't help but respond here whenever anyone brings up the inane comparison to Samuel Slater.

But with this, I don't have an issue. There is no theft since what is being used is the exact product that is being delivered. Yes, it's breaking the ToS, but ToS are generally bullshit. Anthropic surely broke thousands of ToS or other legal terms while it was scraping for content to train on. Which is why they had to pay $1.5B

Residential IPs don’t even matter. Developers use devboxes, use Claude Code CLI on servers from just about every cloud, etc.

There’s probably a decent volume of customers who just buy Claude Max and spend most if not nearly all of their sessions via Claude Code, and it’s not uncommon for power users to be working on multiple concurrent projects/tasks/codebases at the same time.

How do you really block this without also impacting your core market of developers?

Probably some business will popup, like: "rent part of your unused subscription", or even: "proxy tokens with a premium", eg. 5.5 USD on Opus 4.7 paid by the distiller to the user, that will then only spend 5 USD.

No, they could easily buy legitimate, already registered accounts and use VPNs.

Nobody cares about the feelings of the trillion dollar corporation.

Terms of use is local US fiction of wishful thinking. Nobody cares. You make something available, it's up to the consumer to decide how are they gonna use it. You don't want people to use your stuff how they please? Get off the market.

Oh, Anthropic, the company that hoover'd up everyone else's data, and is now unhappy when others are doing to it what it did to others? The same Anthropic?

I'm sure all the artists and creators they stole from had stipulations too.

> Because Anthropic has terms of service

Not following terms of service doesn't necessarily constitute a fraud. It just means Anthropic can close an account that breaks the terms of service.

Robots.txt are also ToS of sorts.

violating their terms of service doesn't make it fraudulent?

So does a lot of the owners of data that Anthropic used for training. Anthropic preceeded to ignore said terms under the guise of fair use. Yet now they cry faul? Cry me a river.

To be clear: In principle I'm on Anthropic's side here. But Anthropic et al. have been very clear that they want to take a huge dump on those principles, so here we are.

So you are believing Anthropic's claim here, and it's not as if Anthropic didn't steal the data to train the model in the first place. I think the original sin doesn't give them any ability to complain.

- https://www.theguardian.com/technology/2025/sep/05/anthropic...

The US labs do seem to have announced a lot of licensing deals though, and are buying things today due to the previous lawsuits.

At what point will we be better to support a lab that pays (some) licenses today vs the ones that pay none?

Some of the deals are in the hundreds of millions, so I suspect licensing is over a billion today? (Pure guess). That might become a big disadvantage in a price (or content) war.

You should. Companies like this will inevitably try and pull the ladder up behind them.

Given that the most recent time Anthropic attempted regulatory capture, the US government responded by saying "alright, we agree that Mythos is too dangerous to release, so we've banned you from releasing Mythos," I can't wait to see what the outcome of this next push is.

Anthropic was forced to pay some people they stole content from, there was no attempt at getting permission ahead of time.

And paying basically everyone online is more or less a solved problem, it's what ad agencies have to do every day.

> And even with the Chinese tech, as Big Tech spreads their AI out into more and more niche areas, we'll likely still not be able to build startups that can compete with them.

You mean like Anthropic will eventually run Walmart? Or Salesforce? or Adobe? Or do you think midjourney will replace all medical spas? OpenAI will run the next Tesla? How can they focus on all this without raising trillions more? Why wont the gov force them to stop if they monopolize all niches even if they could?

Building a frontier AI lab and pushing models forward is already a massive undertaking but we are assuming they will also create massively successful startups which nobody can compete with?

idk sounds like the dream of people like Dario but not much sense does it make in the face of economic reality.

Quite amusing that the library of libgen is worth 1.5bil for unlimited access.

It's about the same valuation as bun, lol.

That's only a fraction of the training data.

Meta/Facebook got away with it though right?

That's a great cost-benefit ratio. Can you and I steal and do illegal things and pay the same cost?

> While I love the sentiment, I feel like the odds of this actually ever reaching a trial are low ...

As cited in a peer comment here[0]:

  In June 2025, Judge William Alsup of the U.S. District 
  Court for the Northern District of California ruled on 
  summary judgment that using books without permission to 
  train AI was fair use if they were acquired legally, but he 
  denied Anthropic’s request for summary judgment related to 
  piracy—finding that the piracy was not fair use.[1]

0 - https://news.ycombinator.com/item?id=48667411

1 - https://authorsguild.org/advocacy/artificial-intelligence/wh...

> LLMs don’t output full copyrighted works word for word

Apparently they do, as per the evidence in the NYT vs OpenAI suit.

> Anthropic and others argue that because LLMs don’t output full copyrighted works word for word - hence their LLMs aren’t infringing on copyright laws.

That surely can't be what they argue, because I'm sure I can't translate a copyrighted book into a different language and say "that's fine, it's not word-for-word".

Isn’t the output of LLMs completely copyright-free in the US?

And putting it into free models like quen. It’s hard to care about this.

For something to be a trade secret, you have to actually keep it secret. If I get the ingredients of Coca-cola from an ex-employee, I've stolen a trade secret. If I work it out by doing a chemical analysis, I've stolen nothing.

There is a difference with anthropic, as no-one signs a licence agreement to buy a coke. But Anthropic are also not saying you can't publish the output of their models. It's not clear to me if trade secret law will (or should) cover a secret which can be extracted from information that licensees are not restricted from publishing.

> Humans have spent millenia harvesting and distilling each other's IP

You maybe somewhat correct, but also copyright lawyers wouldn’t have work if it would be up for grabs to take others IP willy nilly just because “shoulders of giants and all that”.

Some do, others decline to answer.

Or the early days of video uploads, YouTube's most watched videos were "pirated" clips from popular shows (e.g. SpongeBob, The Daily Show) and part of the reason I went to YouTube instead of other video hosting sites (e.g. DailyMotion).

Viacom sued YouTube, while CBS and Universal ended up licensing their content.

https://www.eff.org/deeplinks/2007/03/viacom-v-google-invest...

Using them was allowed as fair use – it was the downloading of the pirated copies that was infringement. That's why Anthropic switched to scanning paper books.

Should we require the destruction of the brains of those that watch pirated movies?

The capabilities of the books' writers to produce the text contained within them, which is exactly what Alibaba "extracted" from Claude. The point here is that Anthropic's framing as some sort of sophisticated technological attack is the ridiculous part. It's writing prompts and saving responses. We're all running "distillation attacks" on Claude, every day! Most of us just don't feed that stuff into a training corpus.

labs invest multiple billion dollars a year each in private data, and that number is growing. internet training data is not where frontier capabilities come from, this view is outdated

I'm not taking sides here but this situation is not so black and white and it has always been the darker side of capitalism.

The concept of Intellectual property exists not because it's fair but because it creates incentive to make said "intellectual property" exist. If intellectual property can be instantly copied by a competitor... why would I spend a dime to even create such a thing? I want to profit off of what I make because I'm a capitalist and money is what drives me (as a capitalist).

Anthropic models wouldn't exist if they couldn't keep a unholy grip on it. Same with openAI. Same with many life saving drugs.

Of course everyone here is talking about the obvious stuff like how it's morally wrong to with-hold life saving drugs or to have AI literally take over the world and be under the control of one company and all of this is true. But it is also true that greed is the engine that drives our economy and if you want our economy to produce "intellectual property" you must allow people to "capitalize" on that greed.

There are two controversial issues here. What is moral/fair? And what is realistically practical in optimizing the economy if said economy is based on money.

The distillation in my mind is a win for practicality because Competition also drives our economic engine. First you don't want a monopoly, but you also don't want these models to be so damn open that there's zero incentive to make them.

If you pay me to curate a playlist of musical hits, can you now publish and charge people for access to that playlist (*including the curated material)? Can we do the same with movies? Books?

/edit Added a note to make it more obvious that the material is included in the playlist, just like the material is incorporated as part of curated AI models.

Given the breadth of LLM knowledge, I somehow doubt this. Sure, it’s probably responsible for the quality of LLM insights, but I don’t think anyone was asking experts about e.g. the complex ecological effects of invasive zebra mussels and their provenance in Lake Michigan.

No, they do RLVR (reinforcement learning with verifiable rewards) like everyone else. And probably use claude data too, with human in the loop and tool feedback.

...and the rest of the training data (ie. the entire corpus of copyrighted works) was not written by experts expecting compensation? Double standards.

So? What about the authors of all the works these companies stole?

This feels more nuanced than you are giving it credit for? Much of the training data that was available has been withdrawn, atleast for OpenAI we know that much of the training data was garnered in less-than above the board methods

Honestly, yes it should in some form. If their index contains the actual data from the sites, and they are making that information public in one way or another, then it should be available as a downloadable dataset.

> Isn't that a bit like saying if you read books in a public library to pick up a new skill you should work for free?

Only if you’re trying to muddy the waters. No, obviously it’s not. One can also support licensing for driving a car on public roads but not for walking, even though both involve traveling. This is only confusing to people pretending to be confused, for effect.

> Would it be an attack to take your meal by force if you used a public recipe to prepare the meal?

“You wouldn’t download a car…” (unless it worked like copying an MP3, then, of course, you would, everyone would)

It’s as if you’re using terrible analogies and comparisons because stronger ones don’t exist. Great news for the AI-should-be-open crowd.

Yes. They're turning on the consent manufacturing machine to make it an issue of "national security" to download some gguf file from Hugging Face. Absolutely disgusting.

really? You know this just like everyone else: Just because the information is available publicly, does not mean that you can do whatever you want with the information. Copyright exists for a reason, and if the copyright lobby is going to continue to push for the poor poor media companies to keep their copyrights, then we should do the same towards the AI companies. So yes, they Stole the information from everyone else, and they keep doing so, as you can see their scanners still hitting every website on the web to get an updated dataset. It does not matter what they do AFTER they steal all the information, as they already stole it.

In this scenario it does, because consumers win.

Everyone in AI industry wants to fight dirty, but gets angry when their competitor fights dirty as well. And I’ve mentioned it before, how I generally like Ant and its products.

Closest analogy to distillation is api reimplementation, without which current software industry wouldn’t exist.

There’s nothing fundamentally wrong with distillation.

Pretty sure the second rectified the first.

I explicitly called out the fact that there is plenty of innovation, but that we see t Lots of innovation in both Chinese and U.S. labs, and I don't think that there is a co.parative difference there.

>It was not okay for them, they had to pay one billion dollars.

Essentially peanuts compared to what they would have to pay to obtain the rights of everything they pirated.

That’s a pittance compared to their revenue.

Yeah I could see it being a problem if you're doing work on closed source or repos with sensitive credentials. Since my usage has all been on open source projects I'd be happy to share everything I'm doing if it can help train better models.

Do you have a substantive reason why you dislike this? What is the problem if it's opt-in? Nobody is forcing you to share your usage if you don't want to.

I'd prefer it if all the model builders could train on my usage rather than being limited to a single company. That'll hopefully help make all the models better in the long-term.

That's exactly right. One can be an AI booster and want Anthropic to suffer, all for the greater good of promoting access and diversity of AI.

Which part?

Anthropic, Dario especially seems have eternal grudge against China as a concept, that remind me of Thiel.

>The AI companies seem to take the viewpoint that everything on the internet is free,

The AI companies? That's been the common ethos of the internet for 40 years

I mean, raise your hand if you ad block and have a hard drive of pirated content...

That's one aspect, which is a bit of a gray zone. But Anthropic trained on pirated books. That is explicitly illegal.

> But if you cost an AI provider money with your data acquisition practices, well, that's just clearly unacceptable.

It's the same question libertarian advocates cannot resolve:

  If one truly believes in personal sovereignty, how are
  shared resources paid for, such as roads, power grids,
  potable water, sewage services, fire departments,
  and police departments?

I guess they can try to sue. Good luck.

“Legally binding” bs that a judge would laugh off.

Only China really has the resources (multiple labs invested in the space), culture (Asians are generally collectively-inclined, so sharing is in their core) and political bent (there will be no diplomatic repercussions) to put up a fight.