FTC probes AI labs as OpenAI alleges distillation campaign

The FTC probe landed the same day OpenAI published a blog accusing people linked to China's Moonshot AI of running a distillation campaign against its models. The Register reported on 30 September that OpenAI said the activity began on 1 July and was disrupted on 28 July.

Both stories matter for anyone shipping open weights. They set the terms of the argument: what a model may learn from another model, and who is liable when an agent goes wrong. Neither question is settled. The FTC has not named a target. Anthropic, OpenAI and the research group Metr did not immediately respond to requests for comment, according to the Guardian. The New York Post first reported the news.

What OpenAI says happened, and what it does not say

OpenAI's account, as relayed by The Register, is specific about volume and vague about attribution. The queries started slowly, then produced "high-volume spikes on July 24 and 25 consisting of 16,000 requests using a relevant extraction pattern from over 4,000 users," the company said. Digging further, OpenAI found related prompt-pattern activity across more than 15,000 users. It says it fully disrupted the campaign on 28 July.

"The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations," OpenAI said in the blog. "Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester in a coordinated, scaled manner that violated our terms of service."

OpenAI says it is unclear whether every operator in July was linked to a single rival, but calls Moonshot AI the core cluster. That is a claim, not a finding. The Register asked Moonshot for comment and got no immediate response. It also asked OpenAI which models were targeted, and got no reply.

The context is uncomfortable. OpenAI built its models on vast amounts of scraped internet content amid copyright fights, as The Register notes, and now calls extraction of its reasoning a national security risk. Anthropic, Google and US officials have made similar accusations against Moonshot. In late July, Michael Kratsios, Trump's Assistant for Science and Technology, accused Moonshot of building its Kimi K3 model by distilling Anthropic's Fable, The Register reports.

Anthropic's response has been technical. Its Claude Opus 5.5 model, released a week before The Register's piece, carries a defense against distillation called "preserved thinking" that it introduced with Fable 5.1. OpenAI says it banned the model-copying accounts, tightened signup and infrastructure controls, expanded monitoring, closed a pathway that let someone replay another user's encrypted reasoning, and shared details through the Frontier Model Forum.

Anthropic's own warning about GLM-5.3

Anthropic has been making a parallel argument about open weights for longer. On 30 September, The Decoder reported on an Anthropic Frontier Red Team analysis of Zhipu's open-weight GLM-5.3. Anthropic says the model can build complete cyber exploits on its own, like its own Claude Mythos Preview, but shipped without effective safeguards.

The numbers Anthropic published are worth reading carefully. On ExploitBench, which measures exploitation of known bugs in Chrome's V8 engine, GLM-5.3 built a working exploit in 50 of 410 attempts; Mythos Preview managed 56. On an internal binary exploitation benchmark drawn from Google's OSS-Fuzz, GLM-5.3 took full control of the target in 4 percent of tasks against 6 percent for Mythos Preview. Older models including GLM-5.2 and Claude Opus 4.6 failed both, and Kimi K3 and DeepSeek V4.1-Flash barely scored, The Decoder reports.

The refusal data is the sharper part. In an Anthropic simulation, GLM-5.3 refused openly malicious commands. When the same request was framed as a red-team exercise, it tried to connect to the target system in 64 percent of runs. With prefilled reasoning steps, that rose to 92 percent. After abliteration, a technique that strips refusal behavior from open weights, it hit 100 percent. Protected Claude models stayed at zero. Anthropic says it used abliteration for the first time, spending about 2,200 GPU hours and roughly $4,400, and estimates an experienced team could do it for around $1,200.

The analysis is not disinterested, and The Decoder says so. Anthropic does not release its weights and presents that as a security advantage, while a cheap Chinese open-weight model near the frontier is a direct competitor. CAISI, the US agency that assessed GLM-5.3 separately, called it the most cyber-capable open-weight model to date and placed it about four months behind the best US models. It added a caveat: US models were tested with cyber safeguards off.

Meanwhile, the small open-weight releases keep coming

None of that has slowed the release cadence. Fermion Research published Phonon-2 on 30 September, an English speech recognition model that averages 5.21 percent word error across the Open ASR Leaderboard's seven English sets from a 164 MB download. It holds the accuracy of its 2.5 GB full-precision teacher and beats it on meetings and parliamentary speech.

The compression is the interesting part. Each encoder weight is one of five learned levels at about 2.1 bits, packed as base-3 digits five to a byte, and the same file runs on Macs, Linux, Windows and NVIDIA GPUs. On a MacBook Air an hour of audio becomes text in about 20 seconds; on eight CPU cores the hour takes 25 seconds; on one H100 a full day of audio takes 13 seconds in batches of 128. The weights are CC-BY-4.0, the licence of NVIDIA's Parakeet TDT 0.6B v3, from which they derive.

NVIDIA, meanwhile, put its weight behind tabular data. Its Kumo Tabular model, announced on Hugging Face on 29 September, is an open foundation model for tabular classification and regression that predicts labels in a single forward pass with no training, no tuning and no feature engineering. It comes in three sizes from 28M to 215M parameters, was pretrained only on artificial data, and is released under the OpenMDW-1.1 licence for commercial use. NVIDIA says it ranks first on TabArena, BeyondArena, TALENT and ScoringBench.

The claim that stands out is the one about in-context learning for tables. A model pretrained on millions of tables reads a labeled table as context and predicts new rows directly, the same trick LLMs use on text. For two decades that work has belonged to gradient-boosted trees built from scratch per task. Whether a 215M-parameter transformer displaces them in practice is a question the benchmarks have not settled.

Open weights, closed questions

Elsewhere in the dossier, the open ecosystem is experimenting with stranger structures. Coop, a project from commonsense-ai, runs a ~145M-parameter pretraining job on donated consumer hardware and the free tiers of Hugging Face and GitHub Actions. Pseudo-gradients are submitted as pull requests and aggregated by a stateless cron job. Stage 1, a 15M model trained on TinyStories by volunteers in six days, finished past its Chinchilla-optimal budget with validation loss falling from 9.01 to 2.8.

PSSA, from Sparticle62ops, is a non-transformer language model written in Rust with no ML framework underneath. It uses a selective state-space recurrence plus a hyperbolic memory bank and per-token weight updates. At matched parameters on the same corpus, its author claims it learns faster than a transformer and generates about twelve times quicker on the same CPU. The UK AI Security Institute's Inspect framework, updated on 30 September, now ships over 200 pre-built evaluations and supports running external agents like Claude Code and Codex CLI in sandboxes.

Put together, the picture is not a simple one of open versus closed. The FTC is probing agent behavior at the largest labs, most of which do not release weights. The distillation fight is about models that do not release weights either. The models actually being downloaded are small, cheap and often trained outside the labs: 164 MB of speech, 215M parameters of tabular prediction, a volunteer pretrain you can run from a terminal.

What none of them answer is the question the FTC investigation and Anthropic's report both circle. If a downloaded model can be stripped of its refusals in a day for roughly $1,200, and if the capability gap to the frontier is measured in months, then licence terms and training-time safeguards do less work than the people writing them imply. The enforcement action is the first attempt by a US regulator to test that. It is not yet an answer.