Distillation disputes are now trade policy, not license disputes

On July 22, 2026, White House OSTP chief Michael Kratsios accused Moonshot of running "large-scale distillation against U.S. models" — specifically, of distilling Anthropic's Fable to build Kimi K3 — and of accessing Nvidia GB300 servers in Thailand. Treasury Secretary Scott Bessent escalated within hours: "Open source is not open season on American IP", with sanctions and Entity List designations described as on the table.

The consensus read is that this is an IP fight between labs. It is not. Anthropic has said nothing publicly, and TechCrunch got no comment from Moonshot or Treasury either. This is governments arguing over model provenance, and that is a different machine entirely.

The enforcement layer skipped a step

Every frontier lab's terms of service already bans distillation. Those clauses were never enforceable against a foreign lab — there is no court that makes them bite. So enforcement did not graduate from license to litigation. It jumped straight to export-control tooling: the Entity List, the same instrument built to keep GPUs out of specific hands, now aimed at model outputs.

That jump has a gap in the middle, and the gap is technical. There is no working standard for proving distillation. Nobody — not the accuser, not the accused, not the enterprise caught between them — can currently produce provenance evidence for a set of open weights. Kratsios claims Moonshot ran an internal platform with rotating access methods to avoid detection; no evidence has been published, and I could not verify the GB300-in-Thailand allegation either. Meanwhile the timeline is the strongest counter-fact on record: Fable has been publicly available only since July 1, 2026, and K3's open weights shipped roughly a week later. Experts quoted by TechCrunch doubt a frontier model gets primarily built on three weeks of another model's outputs. Distillation as a contributor is plausible. "Built on Fable" is not established.

So we have a customs problem without a customs test. Sanctions were a threat, not a fact, as of July 22 — but procurement teams do not wait for facts to harden before they update their risk sheets.

What changed for your model approval sheet

At work I sat in a client review this quarter where a Chinese open-weight model cleared every row on the vendor sheet — license compatibility, eval scores, hosting isolation. There was no row for sanctions exposure, because until this week that row did not exist for a model artifact. It exists now. If a lab lands on the Entity List, every deployment of its weights inside a regulated enterprise becomes a question for legal, and no vendor can hand you the provenance evidence that would settle it either way.

My bet: within twelve months, enterprise AI contracts will carry model-provenance warranties that no party can technically verify — indemnification theatre, signed because auditors need a signature, not because anyone can test the claim. The labs that ship attested training-data lineage first will win regulated deals on paperwork, not benchmarks.

Until then, my rule is boring and mechanical: every open-weight model in a client stack gets an origin file and a swap plan. The origin file records where the weights came from, who published them, under what license, and what public claims exist about their lineage — including accusations, dated. The swap plan names the fallback model, the eval set that gates the swap, and a rough cost to execute it. Half a day of work per model, done before anyone asks.

Steal this before your next architecture review: add two rows to the model-approval sheet — "provenance status" and "swap cost". If the second row reads "unknown", that is the real finding, and it is worth surfacing while it is still cheap to fix.

When enforcement jumps from license terms to sanctions lists, an open-weight model stops being a download and becomes an imported component — file its origin, price its replacement.