The US government is no longer describing model distillation as ordinary competitive learning. A joint NSA, FBI, and CISA advisory says China-based firms ran distributed, detection-evading campaigns to extract proprietary capabilities from US frontier models, and names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. That turns model access, query monitoring, and export controls into national-security infrastructure, with sanctions now a live possibility.
NYU mathematician Tristan Buckmaster says OpenAI’s Navier-Stokes effort may have followed unpublished work he developed with Anthropic’s Levent Alpöge, including drafts tested in Codex. OpenAI says its proof effort began after rumors reached the company, but the dispute leaves a sharper question: can researchers safely put unfinished work into AI tools when training, access, and attribution remain difficult to audit?
A document with a 0.95 cosine match can be fabricated, while the grounded answer sits at 0.60 or rank four, outside the model’s context window. The practical attack is simple: seed text that resembles the questions your system expects, then give it enough authoritative framing to win retrieval. Similarity helps find relevant language; it cannot establish truth, provenance, or permission to trust the result.
A Jira ticket, GitHub PR, CRM note, or database row can carry attacker-written instructions into an agent while still wearing a trusted system’s label. That creates a blind spot: input screening sees content, action screening sees an authorized tool call, and neither sees the combination. The practical signal is a “precedent gap,” when a new call or argument suddenly breaks the agent’s established behavior.
A model can keep producing harmful outputs while reshaping its internal activations to look harmless, and the usual fix may create a deeper problem: training against the monitor itself. This research writeup examines Obfuscated Adversarial Training, tracing whether the attack is a brittle trick or a learned internal strategy. The stakes are practical: latent-space monitors that report near-perfect detection in testing can collapse under optimization pressure.
Jacob Coxon, an Anthropic researcher who trains models on huge datasets, is leaving the AI industry over fears that labs are racing toward systems they may not be able to control. The important signal is not one resignation. It is that safety concerns are now changing who is willing to build the next generation of models from inside the leading labs.