Did China’s Moonshot AI Steal From Anthropic?; OpenAI Loses Control of Two Models

0:02Zoë Schaeffer:Welcome to Wired's Uncanny Valley. I'm Zoë Schaeffer, Contributing Editor. I'm Brian Barrett, Executive Editor. And I'm Leah Feiger, Director of Politics and Science. Today on the show, we're taking a look at how Chinese AI has been leveling up in a major way. The latest model released by Moonshot AI, one of the most well-known labs in China, has been drawing worldwide attention this past week because of the model's enormous capabilities. On Wednesday, White House director Michael Kratzios accused Moonshot of illegally distilling Anthropik's Fable 5 model to build their own. We'll discuss whether we might be seeing another deep-seek moment and what the AI race between the U.S.

0:39Zoë Schaeffer:and China actually means for users. We'll also get into how the U.S. Army has been burning through their AI usage tokens and now find themselves in a position where they need to limit use. They're far from alone in having to pare back, though. Companies like Meta and Uber are already rethinking their AI usage as well because surprise, surprise, it's really expensive to use all these models. Who would have thought? Also on the docket for today, your car could have a hidden device that makes it more vulnerable to hacking. We're going to talk you through how to identify it and why some dealerships added it in the first place.

1:09And later in the show, how OpenAI lost control of two of its AI models during a recent security test.

1:19Zoë Schaeffer:so this past friday the chinese ai lab moonshot ai released their latest model called kimmy k3 and this news made major waves first because the model is super capable it goes toe-to-toe with the leading frontier models from open ai and anthropic and then today white house director Michael Kratzios, like we said at the top, basically accused Moonshot AI of distilling Anthropics models to build their own. So now a major kind of fight is breaking out. And this isn't the first time that Anthropic has accused a Chinese lab of distilling its models. I'm curious, Brian, Leah, what you think just right at the top.

1:59So Wired's Hugo Lowell, the author of our inner loop politics newsletter has a piece that just came out this morning all about this, basically, entirely about how the Trump administration is really, really split over how to handle Chinese AI. And you have like all of these competing forces. You have the Commerce Department and Howard Lutnick that are saying, look, this isn't as scary as you think it is. We can we can figure some ways out of it. And then you actually also have people that are like, no, no, no, we have to create an executive order. We have to stop them from stealing American AI.

2:29What do we do?

2:30Zoë Schaeffer:The Commerce Department's main tool to try and combat this so far has been export controls. And we're seeing some people say like, oh, this is proof that export controls are failing. But if Chinese labs are, in fact, just stealing proprietary information from AI companies in the United States, that's not necessarily a failure of export controls. But it's also nothing that like an executive order could stop. Like, I'm sorry, but like executive orders from the United States do not apply to China. They just they don't. They can be strongly worded memos of with declarative intent. But no one's no one's getting in trouble there.

3:09I want to back this up a little bit, too, because I think we haven't mentioned yet that what makes Kimi K3 especially interesting, I think, in this context is that it's an open weight AI system, which means it's not unlike the proprietary systems that are coming out of Anthropic and OpenAI and other US-based AI giants. China has adopted this sort of more open model. A lot of Chinese companies have adopted this more open model where anyone can use these systems, anyone can tinker with them. Like it is a existential threat in some ways to companies that are saying, hey, look, we're going to charge you a ton of money to use ChatGPT or Claude.

3:44here comes moonshot deep seek before saying or you could just use this for free and it's just as good

3:51Zoë Schaeffer:almost right and i think the theory behind this there's a couple different ideas about why china is doing this one is that it doesn't have as much access to compute so this is kind of the export controls theory it's like because they don't have enough computers they need to release open source models because that helps build their reputation and it extends their influence which is interesting like meta this is the path that meta had been pursuing for a while meta's llama model was like they were the they were the big u.s company going in on open weight ai as a way to undercut the competition they abandoned that and they spent billions and billions of dollars putting together uh their super intelligence lab which has not really amounted to much yet like it's it is we've really seeded the field to China in a lot of ways.

4:42I'm not aware of a major open-weight project going on in the U.S. at all.

4:47Zoë Schaeffer:No, I think that the U.S. has definitely gone in a different direction almost entirely. I mean, the reason that open-weight enthusiasts will say that it's better is like in the U.S., every frontier lab has to basically recreate the same innovations from the ground up. They have to do very similar training runs. They can't see some cool technical trick that another lab has done and copy it to keep building on each other's success. They really are in direct competition. Whereas if you're all open source, open weight, as a country, you can kind of advance perhaps quicker and hopefully a little cheaper because you're seeing what other labs are doing and just building on that pretty rapidly.

5:30I wonder how scared some of the US's AI labs are. I mean, Anthropic quite literally just increased fees for Fable 5, right? Like this is not, this isn't something that they're like, oh, and we're going to go free now too, you guys. We got to compete. Like that's not what's

5:44Zoë Schaeffer:happening. No, no, no. I think it only entrenches the U.S. further and the kind of like proprietary, the need to like keep these secrets secret, essentially. And especially as they're all barreling towards their own IPOs and they're going to have to start showing revenue and start showing up, if not profit right away, like a clear path to profit, which I don't know that they necessarily have yet. And so any competitor that under custom like this is going to make that even trickier. I don't think there's any, I think in the near term, they're fine. They're still going to be taking a billion dollars.

6:17The IPOs are going to go fine, but it is like a question of, especially as companies are realizing how expensive using AI is, and as we're in the era of token maxing, companies are understandably going to be looking for alternatives. And we're going to reach an inflection point where eventually we sort of have to figure out, is AI just a commodity? Is it a commoditized product that you can get from anywhere? Or do you need the sort of custom, like, no, I really need Anthropic for some reason. No, I really need OpenAI for some reason. And I think that's still an open question.

6:50Zoë Schaeffer:I thought Dean Ball, who was previously an AI advisor for the White House and now is an executive at OpenAI, made an interesting point. I'm curious what you guys think about it. But basically, he said that one reason that China has taken the open approach is that they're just not as AGI-pilled as people in the United States and certainly the U.S. government. I think the phrase he used was China and the CCP are pretty Jan Lacun-y when it comes to AGI, which is like Jan Lacun, a very famous AI scientist, previously a high-up executive at Meta. And he has been on the record a lot basically saying that like all of the hype surrounding AGI and what it can do is it's just that it's hype.

7:37Zoë Schaeffer:It's overhyped. And in fact, while, you know, obviously he works on these systems and he finds them really impressive, there's a lot of marketing that goes into this terminology. And just in case for folks, AGI, artificial general intelligence, the idea that AI systems can meet or exceed the capabilities of humans, I think is like a simple people will quibble with that definition. That's like the baseline definition of it. And so Will Knight, one of our senior AI reporters, was in China not too long ago, and he came back with that exact sort of readout. He was saying, yeah, they don't really care about AGI.

8:10It's not a thing over there. It's not like that's not what they're racing for. Yeah.

8:20So this week, Vittoria Elliott, our lovely politics writer, published an excellent story that truly made me laugh out loud all about how the U.S. Army is burning through its AI tokens. So a little over a month ago, DOD bragged that nearly half of its 3.5 million employees were using AI at work. We're really inundated with press releases basically from the government right now about how all AI pilled the federal workforce is at this moment. So about a month after this came out, members of the Army's Combat Capabilities Development Command, DEVCOM, received an email informing them that they were actually burning through AI tokens and needed to limit use.

9:06This email is kind of amazing. Let me just read this quote to you guys real quick. Although the Army CIO announced in May 2026 that they were offering unlimited tokens, By mid-June, the Army CIO pool was exhausted of tokens and had to reestablish limits. So not unlimited is what I'm understanding. Super not unlimited. Much like unlimited PTO. Much like unlimited PTO. It's apparently unclear if the Army CIO pool is going to be renewed after the 1st of October. The Army uses AskSage, which is a multi-model generative AI platform where users can run different LLMs, including Gemini, Llama, ChatGPT, etc.

9:47And we talked to an Army employee who had some very funny things to say about this, which is basically the Army burned through a whole year of tokens for just one service. We had a very short period of time here. And again, this is happening while everyone's going like, use it, use it, use it, without a lot of conversation about the expense. Or at this point, if you're bringing up environmental impacts, you're getting booed by like half of the room. Like this is, but this is real. Like it costs money to produce these things. It costs the environment to produce these things. And so to have the army CIO have to go like, super sorry about that, like scale back that usage, please.

10:25Especially because employees were apparently given an allotment of at least 200 ,000 tokens a month. They were automatically allocated more if they burned through their initial bit. If they were not using the tokens, They were receiving regular emails that were encouraging them to lean more into AI usage as well. True token maxing. But I want to understand, what is the Army actually using this for? Okay, so Ask Sage is used by the Army to, quote, power its enterprise LLM workspace, and it's also accredited for controlled, unclassified information. It was used to complete tasks like reclassifying personnel descriptions, aligning job duties, experience, backgrounds.

11:08It sounds like it was kind of functionally being used as like a mini HR, which in theory is what you should be using AI for, but I guess not this much. I don't know if you're burning through that many tokens. Are you saving that much money compared to a human who would be in that role doing it? Maybe not. I thought one stat that we cited in this story was incredible. DoD reportedly burned through 20 billion tokens per day during the 38-day Operation Epic Fury campaign in Iran. That was from Breaking Defense originally. That number is astounding and also suggests more than just personnel stuff.

11:43Obviously, I think we've seen other places that DOD is using AI in terms of actual military engagement, but you wonder, clearly they have not figured out the efficiencies here. Clearly, they have not figured out what makes sense.

11:57Zoë Schaeffer:Can we just ground this a little bit? A short question answer that you ask a chatbot burns like 10 tokens. It's not a complicated reasoning problem. So just to like frame it for people, this is a lot. I have to talk and learn about AI as a function of my job and like apparently a member of the human race at this point. But also, I think that there's something really interesting about the idea that it's not being even like intellectually considered as a resource in this way. It really feels to me like reading this article and talking with Tori about her reporting and going through all of these additional anecdotes, it feels like when all of those campaigns had to come out that were like, don't just leave the tap water running.

12:41That's bad. We're going to run out of it. There's a finite resource. And so it's this really interesting thing where I'm like, I think because people think that they're like typing it into their little computer that it just doesn't actively exist.

12:58Leah, the good news is the next thing we're talking about has nothing to do with AI. The bad news is it does have to do with how easy it is to steal millions of cars. Millions of them.

13:09Zoë Schaeffer:Not Leah's Tesla. Tesla's also fairly easy to steal. Not Leah's Cybertruck. Yeah. Leah's got three Cybertrucks. Yep. That's me. All right. So this is also sort of a public service announcement. Recently, UC San Diego researchers found that an alarm device that has been placed in more than 2 million cars in the US could potentially make them more vulnerable to hacking. This is Andy Greenberg, Wired Senior Correspondent, really the best car hacking reporter you're going to find anywhere out there, reported that this device is part of something called the CAR, and we love spellings on this show. It's K-A-R-R, the CAR security system that has a Bluetooth vulnerability that lets anyone nearby, unlock your car, kill the alarm, disable the ignition.

13:53Oh no. The worst part about this, or at least a very bad part about this, is that a lot of owners have no idea it's in their car. There's no reason you would know. And that's because it's something that dealers install. Dealers put cars, the car security system in to protect cars on the lot and where they don't bother to remove it or disable it after the sale. So you, yes, you could have this system in your car. Here's how it works. Rechersers found that all of these car devices share a single authentication key, which I don't know how familiar people are with cybersecurity. That's bad. It's like sharing a password to your Netflix account, but with every single person who has this system involved.

14:33So once you have that, you can get in, they figured out how to reverse engineer that key. They built a custom app so that as long as they were within Bluetooth range, they could send a radio signal to do all those things we mentioned. Unlock, disable the alarm, honk the horn, flash the lights, disable the ignition, strand the driver. It doesn't let you start the car remotely, but they also showed, helpfully, that once you're inside the vehicle, a commercially available locksmithing tool will let you create a key within minutes. I'll say, too, that Andy made a video showing how all of this works.

15:05It's on Wired right now. Highly recommend watching it. It's perhaps bad to say, This wasn't surprising to me. Like, it was wild, really excellent reporting. This, in some ways, feels like the next thing of, like, every single— like, I do imagine a lot of Andy videos of, like, and here is now this other thing that you thought was inherently secure and independent that is connected to all of these different things. Like, that does feel like where the world is going right now, especially with all these different technologies at play here. So perhaps I'm a little bit solipsistic about it. Coming for us all.

15:39Well, and there's already been, and you're defensely a two, there's already been a lot of like relay attacks, they're called with cars where like, if you can just, if you can, you can get close enough to someone's key, you can copy the key radio signal and then use that to unlock a car. So there's already an inherent vulnerability around cars that I think has been advertised pretty well. To me, this is more just the fact that at least then you know that that can happen. This is something where I don't know if I have a car installed on my device.

16:10Zoë Schaeffer:That's a scary piece to me. It's the not knowing. I mean, I was going to say I disagreed with Leah, but then when she was talking, I was like, I guess I live in the Bay Area. I have$1 ,000 worth of car seats in my car at any given time. And I kind of take the approach of like, we do our best, but if someone really wants to break into your car, they will do so. Can you take those car seats out every time you park? No, you cannot. They're very heavy. So, you know. To me, this justifies my decision to continue to drive a, I think, 12-year-old Volkswagen station wagon. The doors are literally falling apart.

16:45I actually wish you'd let us guess what kind of car you drove. It is disgusting. The flaps on the back seat are like, I can't even describe it. They're like falling off of the car. The car is falling apart. But it is safer than these other ones. Well, or if someone were to steal it, God bless. Like, enjoy. I will say there are ways to tell. If you are concerned about this, which understandably might be, there are ways to tell if you have this car device in it. Look for a car sticker on the driver's side window. That's obvious. or less obviously a sticker that says SWDS, which stands for Southwest Dealer Services, plus a small blinking light button under the dashboard.

17:32A lot of these cars are in Southern California, but they are around the entire country. Once you have identified that you have this system in your car, you have to download the car app and then push a firmware update to the car. It's a whole thing. That's the other thing. A lot of times when it's like, when there have been similar, like there have been Tesla vulnerabilities, right, that make it easy to pull off some attacks. They're able to push a firmware update remotely to all of these vehicles. The company behind car does not have that ability to automatically push these to the car. So you have to do it yourself, which is, I think most people can't be bothered, to be honest.

18:10I don't have high hopes for this being fixed in any major way.

18:18Before we go to break, we have one more development to discuss. OpenAI disclosed on Tuesday that it lost control of two AI models during a security test that ended in a breach of the AI research platform Hugging Face. The company said that last week, these AI models were in a sealed testing environment, a sandbox you'd call it, when they broke out and hacked into Hugging Face's production system to steal the answers to a test that they were being graded on. These are very overachieving AI models. One of them was a publicly available model called GPT 5.6 Soul and an unreleased, reportedly more capable one.

18:53Both are being evaluated on their offensive hacking skills with safeguards that normally block high-risk cyber activity switched off. So, you know, they said, hey, go figure out how to hack this thing. And they did. They did it.

19:06Zoë Schaeffer:Yeah. What made me laugh about this is that when the news finally broke, Sam Altman and the CEO of Hugging Face kind of jointly released these statements being like, we're partnering together to figure this out. I was like, solid PR work from OpenAI. Your system hacked another system, went rogue. And now you're like, this is our partner and we are jointly, no problems at all, going to get to the bottom of what happened. I was like, okay. Does that speak to how ubiquitous in a way OpenAI is? I don't know if Hugging Face can be like, well, we hate you. You're dead to us entirely. I don't know. I was really shocked by that little bit too, Zoe.

19:43Zoë Schaeffer:Yeah, I think that there were some people who were talking about this, oh my God, big scary model escaped the box. Like this is really bad. And then you saw other security researchers being like, no, this was a basic infrastructure failure. Like they didn't isolate the environment effectively. I think the people who were saying, oh, my God, big, scary model were open AI. Right. They were like, look at us. I don't want to minimize it. It is important that their model can do this. But I also, the security research that we spoke to, our reporters, Dale Cameron and Lily Hay Newman, were like, look, like, sure.