Moonshot, Revisited
Notes from meeting the Kimi-K3 team.
Hello, and welcome to a special edition of AI Under Heaven!
Those of you who read the first issue know that I’m planning on writing occasional special issues on topics I consider timely and important…but I didn’t think this would happen less than a week later.
The news cycle is blowing up over Kimi-K3, a new model release from Chinese AI start-up Moonshot AI, praised for closing the intelligence gap with US frontier models from OpenAI and Anthropic, at a fraction of the cost.
There are questions about how much Moonshot owes to Anthropic for its success. Back in February, Anthropic accused Moonshot of extracting 3.4 million outputs from its models for “distillation” (that is, training a smaller model to be as smart as a bigger one based on that model’s data), the lab tracing the metadata back to “the public profiles of senior Moonshot staff.” Users have posted screenshots of Kimi-K3 identifying itself as Claude.
AI safety researcher Ryan Greenblatt tested K3, and identified it had been trained off data from an older Claude model, but not frontier models like Anthropic’s Fable 5. Commentator Kevin Xu points out that distillation does not legally count as IP theft in the United States. That could be why you can find datasets marketed as outputs from Fable 5 and specifically for distillation, all out in the open on Hugging Face. AI expert Nathan Lambert argues that even with distillation, the technical nature of AI models means Moonshot will still have had to do a lot of their own work to create a model as smart as Kimi-K3.
The White House doesn’t seem interested in counterpoints. On July 22, three senior White House policy makers issued statements on X claiming that Kimi-K3 was trained off distillations of Fable 5, condemning this as a “heist of invaluable American intellectual property,” according to US Under Secretary of State for Economic Growth, Jacob S. Helberg. “Lying, cheating and stealing is not innovation.”
While Moonshot is now being treated as a data point and levered into zoomed-out geopolitical “US vs. China” commentaries, it’s also important to come back down to Earth when we can. I met three of Moonshot’s senior research staff in Beijing on April 26, three months before any of this blew up (along with some other sharp Substackers).
Accusations painting them as incapable of independent innovation don’t seem accurate. But neither does the idea that this is a lab thinking hard about the geopolitical consequences of the game it’s playing.
Alex Colville (Analyst, ASPI)
Quick disclaimer: It would be wrong to draw any concrete conclusions just from a single one-hour meeting. Moonshot, like many other labs on our trip, were on a charm offensive, attempting to convince a group of Western writers that they were reliable, open and trustworthy. None of the following settles whether Moonshot’s extraction happened as Anthropic describes. So take it all with a big fistful of salt.
In the room were three engineers:
Lai Guokun, who works on Pre-Training (introduced to us by the HR team as “Moonshot’s heart”)
Du Yulun, part of the Pre-Training and Scaling team
Mao Shaoguang, who leads up Reinforcement Learning (RL)
Each spoke good English, two of them having studied at Carnegie Mellon University in Pittsburgh. It isn’t clear how representative they are of the rest of the Moonshot team.
I’m not going to say who said what. Not because of any agreement we made, but simply because my notes don’t relate beyond quotes and enough time has already passed for my memory to be unreliable on those details.
Work Culture: Relaxed and Research-Oriented
Founded three years ago, Moonshot was the brainchild of three assistant professors from Tsinghua University, a research campus for the cream of China’s AI talent crop. Early funders included Tencent and Alibaba, and by August last year the company was valued at $3.3 billion. The month before our visit, the Wall Street Journal reported that the company was seeing a massive surge of funding, placing them at a valuation of $18 billion. They were (and still are) reported to be eyeing an IPO in Hong Kong, following in the footsteps of other Chinese AI start-ups MiniMax and Z.ai. Initially the company was closed-source. They only started slowly releasing developer tools from late 2024, and open-weights flagship models from July 2025, starting with Kimi-K2.
Of all the AI labs we visited on this trip, the personnel at Moonshot seemed the most relaxed and frank. In some labs we were placed in rooms that made us feel like foreign dignitaries, technicians’ heads bent as they read out pre-written (and likely heavily vetted) answers to questions that had been sent in advance. But Moonshot’s technicians took our questions off the cuff, over pizza and coffee.
The team is young and about 400-strong. While their pay was lower than other labs, they relished what they claimed was a “lack of bureaucracy” and politics compared to other labs. “We have fun. We drink!” They certainly try to. The company is reported to have gone out clubbing in downtown Beijing this weekend to celebrate the launch of K3, with a sign in English reading “K3 scale up! K4 scale the fuck up! To the Moon!”
While the team came across as the most research-oriented of all the labs we visited, it’s also correct to say that they work within a relaxed, permissive atmosphere toward the work of other people. Kimi-K2 had been built off DeepSeek’s open-sourced software architecture. When I asked one of the team how they had come up with adaptations for the MuonClip Optimizer for Kimi-K2, an impressive innovation that made training more efficient, they said that one of their number (a researcher who runs an influential science blog) monitored arXiv every day for new research papers that they could use. While they said they used a mixture of different coding agents to perform vibe-coding when building out their work, one of their number said that after the launch of Kimi-K2, they switched to vibe-coding with Claude Code. Now? “I tell the agent to write some code for me, and I won’t even read it.”
Open-source
This relaxed attitude stems from open-source, which the team professed a deep faith in, considering it important both to the fate of their company and the evolution of AI as a whole. One noted that without the ability to release their models for free “no-one knows who we are.” They acknowledged that the marketing team was more interested in closed-source for the revenues it could bring, but they believed AI is only driven forward by compute and open-source. One noted that if researchers from Google hadn’t open-sourced the Transformer (a neural network architecture that now forms the foundation of AI models) back in 2017, then ChatGPT wouldn’t have been possible.
I asked one of these engineers whether or not they would open-source a model with the cybersecurity capabilities of Mythos, a model from Anthropic that can identify cybersecurity vulnerabilities. “Yes, probably,” he said, although his face creased into a frown, “but I’m not sure.” So not even technicians at the forefront of Chinese AI seem to know what’s going to happen there.
Resource-constrained
The team said they were data-constrained. This is a problem for labs trying to build frontier models, a law put simply: less training data, or poor quality training data, means a dumber model. China’s AI ecosystem is currently trying to overcome multiple bottlenecks on sourcing data, which includes government silos, poor record keeping, and a relative lack of Chinese-language data readily available on the internet. Private enterprises in China have started to work with AI labs to provide clean, high-quality data for training. But in our conversation, we didn’t get a sense of what methods the team was using to get around this problem of data constraints.
Everything about Moonshot’s set-up indicated severe compute limitations. Part of the reason they emphasised research was to make up for their limits in it. Their own work often focuses on boosting efficiency, attempting to use the limited compute they have to go further in training. One announced the team would make use of any technical mechanisms that could increase the efficiency of the compute they had, saying it was “unlikely” they would be able to catch up to the frontier of US labs due to these compute constraints. Their claims of compute limitations are backed up by their decision on July 19 to limit user access to Kimi-K3. For now, they simply don’t have the capacity to meet the surge in demand.
But this also meant:
Lack of interest in AI safety
I put the question to them about concerns on catastrophic risks stemming from super-intelligent AI. One said that beyond training to prevent their models from answering questions like “how to build a nuclear bomb,” the whole idea of this form of AI safety testing was “overrated.” “We don’t have the best model,” he summarised. This is supported by a joint preliminary study on Kimi-K3 by AI safety research institutes under the US and UK governments. Their conclusion was that in cybersecurity capabilities, Kimi-K3 “performs significantly below” frontier AI models.
Another of the technicians said he was more concerned about what AI models may do to his job in future. Surprisingly, the team didn’t seem fazed about the possibility of bad actors taking advantage of their models, claiming that as far as they were aware, “people are only using our AI to do good things.”
As I said at the beginning, all of these quotes come from a company attempting to convince a group of Western writers that they were reliable, open and trustworthy. Not every lab convincingly pulled this off. By contrast, Moonshot came across as a quirky bunch of developers exploring ideas from a purely technical standpoint and from every possible angle, with little thought to the consequences.
But with serious accusations now being thrown at them by powerful people, perhaps the fun will soon be over for Moonshot.
This newsletter is published under the umbrella of the Australian Strategic Policy Institute.
