Kimi K3 Isn't Free. It Just Looks That Way.

On July 17th, Moonshot AI unveiled a 2.8-trillion-parameter model it calls Kimi K3, one the company says can rival the top systems from OpenAI and Anthropic, and promised to release the weights, for free, on July 27th, at which point it would be the largest open-weight AI system ever distributed^[1]. Five months earlier, Anthropic said it had traced 3.4 million conversational exchanges to Moonshot itself: fraudulent accounts, proxy networks, and a systematic campaign to extract Claude's reasoning by asking it, over and over, to show its work^[2]. Anthropic has not verified that K3 specifically was built on that extracted data; what it published is a pattern of Moonshot's conduct five months before K3 was unveiled, not a lab report on this particular model. But nobody has to guess how Moonshot operates. Anthropic already published the receipts on that.

That is the case against comfort, stated carefully: the open-weight models arriving out of China this year are not simply capable systems on a rival's release schedule. According to Anthropic and OpenAI, the companies building them have done three things. They've run sustained campaigns to extract capability from American labs without consent. They've wrapped some of what results in a censorship layer answerable to Beijing rather than to the user. And they've handed the finished models out at no cost, because giving away what you didn't fully pay to build is the cheapest form of soft power there is. Whether that specific pipeline produced K3 is inference from a documented pattern, not a confirmed fact about K3 itself; the distinction matters. Keep that in mind while we work through everything that follows.

What did Anthropic and OpenAI actually find in their own logs?

Start with the word, because it's carrying a lot of weight. Distillation is just training a smaller or newer model on the outputs of a stronger one, and it's a routine, legitimate technique. Frontier labs distill their own flagship models into cheaper customer variants all the time^[2]. What Anthropic described in February wasn't that. It was DeepSeek, Moonshot, and MiniMax running what the company called "hydra cluster" operations: roughly 24,000 fraudulent accounts, more than 16 million exchanges with Claude, all built to slip past the regional access restrictions Anthropic places on China^[2].

Look at what each one was after. DeepSeek's 150,000-exchange campaign asked Claude to narrate its own reasoning step by step (in effect, manufacturing chain-of-thought training data), and separately generated "censorship-safe alternatives to politically sensitive queries" to teach its own model to steer around dissidents and party leaders^[2]. Moonshot's was bigger: 3.4 million exchanges aimed at agentic reasoning, tool use, and computer vision, with the request metadata traced back to the public profiles of senior Moonshot staff^[2]. That one ran and was caught roughly five months before K3's unveiling. Anthropic's report describes the operation; it does not confirm a link between the extracted data and K3's specific weights. MiniMax's 13-million-exchange campaign was still live when Anthropic caught it, and when Anthropic shipped a new model mid-campaign, MiniMax swung nearly half its traffic to the newer system inside 24 hours.

Why does it matter that Beijing wants to lock its own "open" models down?

If the openness of these models were purely a gift to the world, Beijing would have no reason to restrict it. It's restricting it. Reuters reported this month that Chinese authorities have spent the past month meeting with Alibaba, ByteDance, and Z.ai to discuss curbing overseas access to the country's most advanced AI models, including some not yet released, mirroring the logic of the very US export-control regime it's nominally racing against^[6]. A state that treats its own frontier weights as a strategic asset worth rationing does not regard those weights as a neutral public good once they cross its border. Whatever comfort a downloadable file offers, the government standing behind the company that built it doesn't seem to share it.

That posture lines up with what OpenAI told Congress about the ecosystem these models grow out of: state subsidies and preferential procurement after the CCP elevated AI to a national-modernization priority at the Fourth Plenum in October 2025, plus Cybersecurity Law amendments, effective January 1, 2026, that formalize state support for foundational AI research and compute buildout^[3]. The memo goes further. It describes DeepSeek's censorship as trained into the weights during post-training, not merely bolted on at the server: refusals on subjects like Tiananmen Square and Taiwan independence that travel with a downloaded copy^[3]. And on the hosted app sits a second, far more visible layer: a server-side filter users have caught in the act, generating a real answer on Xinjiang or the South China Sea, then deleting it mid-response and swapping in a refusal^[3].

Does running the weights locally solve the problem?

So download the weights, run them offline, problem solved? Partly. It does remove one layer of exposure: South Korea's privacy regulator found DeepSeek's hosted app had been shipping user data to a Chinese cloud firm it identified as an affiliate of ByteDance, TikTok's parent (though it noted the firm is a separate legal entity), and pulled the app from local stores^[7]. A locally hosted copy doesn't phone home the way a hosted app can. What it can't do is touch the other layer OpenAI described: the bias and refusal patterns trained directly into the weights during post-training survive the download intact, no server connection required^[3]. And auditability isn't the same as an audit. "Open weight" means a developer can inspect and run the parameters; it does not mean anyone outside the lab can see the training data, the reward model, or the instructions given to the human raters who shaped its refusals. An open file is not the same as an open process.

Is adoption already outrunning the caution?

We're now at a point where this isn't a fringe debate. Alibaba's Qwen family has passed 700 million downloads on Hugging Face, the most-downloaded open-source model family in the world as of January 2026. Think about what each of those downloads represents: a developer or a company deciding that whatever's baked into the weights, whether that's extracted Claude reasoning or a classifier tuned to CCP sensitivities, is an acceptable price for a free, capable model. And K3 is about to land straight into that appetite, weights due July 27th. It's the clearest sign yet that benchmark score and price will win the argument over provenance all over again, whatever the unverified specifics of its own training run turn out to be.