Garry Tan AI Distillation Plan Challenges Frontier Labs’ Control

Garry Tan has proposed a sharp change in how the United States handles AI distillation, despite frontier labs trying to restrict the practice. The Y Combinator CEO wants smaller American open-weight developers to learn from leading U.S. models and release more domestic alternatives. His position challenges the idea that frontier companies should control how customers reuse model outputs.

The Garry Tan AI distillation proposal arrived during an escalating fight over Chinese AI developers. Anthropic says DeepSeek, Moonshot AI, and MiniMax conducted coordinated campaigns to extract capabilities from Claude. Tan’s response is not to prohibit the training technique. He wants American developers to use it under a domestic system.

That turns the usual national-security argument inside out. OpenAI and Anthropic have portrayed unauthorized distillation as a shortcut that transfers American capabilities to foreign competitors. Tan argues that restrictions could leave American users dependent on either closed U.S. services or open-weight Chinese models. The dispute is therefore about more than copying. It concerns who can turn frontier intelligence into an independent product.

Garry Tan AI Distillation Would Create a Domestic Alternative

Tan wants the United States to answer foreign open-weight competition by producing more American open-weight models, not only by blocking foreign developers.

Model distillation trains one system using answers generated by another, more capable system. The larger system acts as a teacher, while a smaller student model learns from its outputs. Developers can use those responses as training examples, evaluation material, or feedback for reinforcement learning.

Distillation itself is neither unusual nor automatically abusive. AI companies regularly use their own large models to train smaller products. The conflict begins when one company systematically queries another company’s service without permission, then uses the answers to develop a competing model.

Tan has drawn a line between the technique and deceptive access. He is not asking American startups to steal credentials, conceal coordinated account networks, or evade technical protections. He is questioning whether frontier providers should be able to prohibit competitive training through their service contracts.

In comments reported on September 11, 2026, Tan argued for what he called an “American distillation regime.” Smaller U.S. labs would gain legitimate access to American frontier systems and use their outputs to train open-weight alternatives. Open-weight means the trained parameters are available for others to download and run, even when the complete dataset remains private.

Tan’s argument combines competition policy with a claim about knowledge ownership. Frontier models learned from books, software, public websites, discussions, and other human work. He therefore sees a contradiction when their developers claim broad freedom to learn from public material but tightly limit downstream learning from model outputs.

“Controlling what users and customers do with API calls to closed weight models feels constraining,” Tan told TechCrunch. He described access to intelligence trained on public data as closer to a public good than something locked behind restrictive terms.

His position does not deny that frontier research requires capital. Tan said the companies pushing model capabilities forward need sustainable businesses. He also argued that open-weight systems should preserve user freedom and access.

That balance is central to his proposal. A domestic distillation framework would need to reward the teacher-model provider while giving smaller developers meaningful reuse rights. Without those rights, access could become a conventional licensing program that protects incumbents without producing independent competitors.

Tan has not provided a detailed legal structure, technical protocol, or compensation formula. He has instead challenged the assumption behind current restrictions. His proposal asks whether competitive model training should be treated as prohibited extraction or a normal way for AI capabilities to spread.

That distinction matters because an approved distillation program would look very different from an attack. It could use identified participants, negotiated access, documented datasets, security requirements, and evaluation obligations. Those conditions would preserve accountability while testing whether domestic open-weight developers can narrow the capability gap.

The immediate change is therefore political rather than technical. A prominent startup investor has openly encouraged American labs to adopt a practice that leading model providers are working to restrict. His intervention gives open-weight advocates a direct answer to the claim that distillation controls are required for U.S. leadership.

Why American Open-Weight Labs Are Under Pressure

American open-weight developers face a widening strategic squeeze between closed domestic APIs and capable models released by Chinese companies.

A startup that builds on a closed model receives convenient access but does not control the underlying weights. The provider can revise model behavior, change access policies, introduce new restrictions, or discontinue a version. The startup must accept those dependencies while competing in markets where model behavior directly shapes its product.

Open-weight models provide a different operating structure. Developers can deploy them inside private infrastructure, fine-tune them for narrow tasks, and evaluate specific versions before an upgrade. They can also inspect how changes affect a product without waiting for an external API provider.

Those benefits matter to companies handling sensitive documents, regulated workflows, or proprietary software. A team can keep its inference environment closer to its data and retain a chosen model version. It still needs strong security, evaluation, and governance, but it gains control over deployment.

The problem is that training a frontier model from the beginning demands extensive computing resources, specialized researchers, and large datasets. Smaller U.S. labs cannot simply reproduce every investment made by OpenAI, Anthropic, Google, or Meta. Distillation offers a shorter route to selected capabilities without recreating the teacher’s full training process.

Chinese open-weight developers have strengthened the pressure. DeepSeek, Moonshot, Alibaba, and other labs have released models that developers can download, adapt, or use through inexpensive services. Whatever methods produced each model, their availability gives American builders alternatives that the domestic market has not consistently supplied.

This creates a policy contradiction. U.S. officials want to limit dependence on Chinese technology, yet strict controls on domestic distillation can reduce the number of American alternatives. Blocking one path to capability transfer does not automatically give smaller U.S. labs the resources to train competitive systems independently.

Tan’s proposal targets that gap. If American startups can learn from domestic frontier models through an approved process, they can produce models governed by U.S. entities and used within American infrastructure. The result would not guarantee technical parity, but it could expand the available supplier base.

The pressure also reaches enterprise buyers. Organizations rarely want their entire AI workflow tied to one provider. Procurement teams consider availability, data handling, model stability, latency, migration costs, and the ability to operate during service disruptions.

A diverse open-weight market gives those buyers another option. They can use a frontier API for demanding work while assigning repeatable tasks to locally controlled models. Distillation can help train those smaller systems around particular capabilities, although performance must be measured on the buyer’s actual workload.

This is especially relevant when companies build long-lived knowledge systems. A searchable knowledge base can outlast any single model contract. Keeping information architecture separate from one provider makes future model changes easier to manage.

Developers also need to distinguish model ownership from application quality. Open weights do not automatically provide reliable answers, good retrieval, or secure deployment. They only give builders more direct control over the model artifact. The surrounding product still determines whether that control creates practical value.

Tan’s strongest point is therefore not that every startup needs an open-weight model. It is that American developers need a credible option outside a few closed providers. Without one, the United States could lead frontier research while offering limited domestic choice to companies that require model control.

Frontier Labs See Distillation as an Extraction Threat

OpenAI and Anthropic view competitive distillation as an economic and security problem because it can transfer valuable capabilities without transferring development costs or safeguards.

Anthropic drew the clearest boundary in February 2026. The company said it had identified coordinated campaigns by DeepSeek, Moonshot, and MiniMax that generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts.

According to Anthropic’s distillation findings, the campaigns used proxy services and coordinated accounts to avoid detection. The prompts concentrated on areas such as coding, tool use, agentic reasoning, and model grading. Anthropic attributed the campaigns using network data, request metadata, infrastructure patterns, and information from industry partners.

These figures remain Anthropic’s findings rather than an independent public audit. The named companies’ exact training datasets are not available for outsiders to examine completely. However, the account behavior described by Anthropic goes beyond ordinary customer experimentation.

Anthropic also makes an important distinction that sometimes disappears from political debate. It calls distillation a legitimate and widely used training method. Its objection concerns competitors acquiring capabilities through deceptive access, account fraud, regional restriction evasion, or other prohibited conduct.

The company says one proxy network operated more than 20,000 fraudulent accounts at the same time. Such systems can distribute requests across multiple services and replace accounts after providers block them. This makes attribution and enforcement harder than detecting one customer making an unusually large number of calls.

OpenAI’s contractual position is similarly restrictive. Its current service agreement generally prevents customers from using outputs to develop competing AI models, except for defined permitted uses. It also bars model-extraction attacks and attempts to bypass access protections.

These contracts give frontier providers a direct enforcement tool against customers. A company can suspend accounts or revoke API access without first proving copyright infringement in court. That matters because the broader legal status of learning from model outputs remains unsettled.

The economic concern is straightforward. Frontier labs invest in research, computing infrastructure, data preparation, safety testing, and product operations. If a competitor can query the finished service and transfer its most valuable behavior into another model, the competitor avoids much of that initial expense.

The security argument extends beyond commercial loss. Anthropic says a distilled model might reproduce capabilities without preserving the teacher’s safeguards. If its weights are then released, the original provider cannot withdraw the model, monitor its users, or patch every distributed copy.

In its later open-weight position, Anthropic argued that distillation can bring Chinese frontier capabilities within months of U.S. systems. It called for action against industrial-scale extraction while rejecting a blanket ban on open-weight models.

This distinction places Anthropic closer to Tan than their rhetoric suggests on one issue. Both accept a role for open-weight AI. Both also recognize legitimate uses of distillation. Their disagreement concerns who should authorize cross-company training and how much control the original provider should retain.

Tan starts from the risk of concentrated private power. Anthropic starts from the risks of capability theft and irreversible distribution. Each side therefore treats a different actor as the main threat.

For Tan, excessive restrictions protect incumbents and reduce American open-weight competition. For frontier providers, loose access lets rivals appropriate expensive capabilities and remove safety controls. A workable domestic regime would have to address both concerns rather than declaring either one imaginary.

The Public-Good Argument Collides With Contracts and Safety

The hardest question is not whether distillation works, but whether the United States can authorize it without normalizing deceptive extraction or weakening incentives to fund frontier research.

Tan’s public-good argument has intuitive force because frontier AI did not emerge from isolated corporate knowledge. Model developers trained systems on enormous collections of human expression. Authors, programmers, researchers, educators, and online communities created much of the material that made modern language models useful.

That history complicates claims that model-generated information deserves absolute downstream control. Publishers and creators have already challenged AI companies over training without consent. Tan applies a similar fairness argument to companies that now want contractual protection from other models learning through their services.

However, moral symmetry does not settle the legal question. Publicly accessible information is not automatically free of copyright, contractual, privacy, or database restrictions. Likewise, receiving an API response does not necessarily grant permission to collect millions of responses for competitive training.

A domestic distillation system would need to define legitimate access. That definition cannot depend only on whether the participating company is American. Credential theft, false identities, account farming, and deliberate evasion remain deceptive regardless of the developer’s nationality.

It would also need to distinguish routine product use from systematic extraction. That boundary is technically difficult. A company evaluating thousands of prompts for safety can resemble a company building training data, especially when both test narrow capabilities at scale.

Brookings fellow Kyle Chan described that detection challenge as searching for needles in a large haystack. The federal response has included proposed processes for identifying foreign actors that extract key features from closed American models. Yet identifying suspicious traffic is easier than proving exactly how another model was trained.

The same uncertainty would affect approved domestic participants. A frontier lab might offer limited distillation access while withholding its strongest reasoning, coding, or biological capabilities. Smaller developers could receive formal permission but insufficient information to create competitive models.

Price and capacity could become another barrier, even without publishing specific commercial terms. Frontier providers control their own API limits and infrastructure. If approved training requires enormous volumes of queries, access conditions could still favor well-funded companies.

Safety testing presents a separate tradeoff. Open-weight developers can inspect, fine-tune, and deploy a released model without permission from its creator. That supports research and local control, but it also means the original developer cannot reliably revoke the system after discovering a serious vulnerability.

A domestic framework could require evaluations before release. It could also create graduated rules based on capability instead of treating every model alike. A small specialized model should not face the same requirements as a system with advanced cyber or biological abilities.

Yet tests do not eliminate the distribution problem. Benchmarks can miss new capabilities, and users can fine-tune weights after release. Once copies circulate, later restrictions have limited reach.

The proposal also risks weakening investment incentives. Frontier research remains expensive even when the exact costs are not public. If every successful capability must immediately become training material for competitors, private companies could reduce external access or delay releases.

Tan does not argue that frontier labs should disappear. He wants them to remain funded while open-weight developers receive meaningful freedom. The missing mechanism is how to divide returns between the teacher and the student without letting the teacher veto real competition.

Licensing is one possible path, but the details would determine its value. A license could authorize specified training uses, require attribution, prohibit deceptive access, and establish security duties. It could also become an expensive gate that only established companies can pass.

A supervised research program offers another model. Participants could access frontier outputs within controlled environments, document their training methods, and publish evaluation results before releasing weights. Such a program would provide evidence about whether domestic distillation produces useful, safer alternatives.

Neither approach resolves the broader ownership dispute. Frontier labs can argue that model behavior reflects proprietary research, even when training material came from public sources. Open advocates can answer that behavioral capabilities should not become permanent private property merely because a company concentrated the underlying knowledge.

That conflict resembles earlier disputes over software compatibility and platform control, but AI models introduce greater uncertainty. A student system does not copy a simple interface. It absorbs statistical behavior that can include general knowledge, specialized reasoning, errors, and safety patterns.

The skeptical conclusion is unavoidable. Tan has identified a genuine competitive problem, but he has not yet shown that an American distillation regime can deliver strong open models legally and safely. Until a developer tests the idea through a transparent program, it remains a policy thesis rather than an operating model.

Three Signals Will Show Whether Tan’s Plan Can Work

The next stage depends on concrete commitments from American developers, frontier labs, and policymakers rather than another round of arguments about openness.

The first signal is whether a credible U.S. open-weight developer publicly adopts cross-company distillation. The announcement would need to identify the teacher models, authorization basis, intended capabilities, and release conditions. Quietly using synthetic data would not test Tan’s proposal because the central question concerns legitimate competitive access.

A transparent project would also need comparative evaluations. Developers should test the student against its base model, the teacher, and other open-weight systems. Those results should cover real workloads rather than a small collection of headline benchmarks.

If such a model performs well under documented permission, Tan’s argument gains strength. It would show that domestic distillation can expand model choice without relying on hidden accounts or stolen credentials. If no serious lab attempts the process, the proposal will look disconnected from commercial and legal realities.

The second signal is whether a frontier provider creates an explicit distillation license or partnership. General API access is not enough because current contracts commonly restrict competing model development. A meaningful program must allow an independent participant to train and release something that can compete.

The provider’s safeguards will matter. Identity verification, traffic monitoring, capability limits, and pre-release evaluations could separate legitimate training from the operations described by Anthropic. Clear rules would also help developers understand what conduct triggers enforcement.

This signal would weaken Tan’s case if the program exists only on paper. Narrow permissions, limited outputs, or conditions that prevent practical deployment would preserve the current market structure. A successful framework must offer the student developer real independence.

The third signal is how U.S. policymakers define model extraction. Congress and federal agencies are examining foreign access to American AI systems, while frontier companies are sharing more threat information. Broad language could capture legitimate research and domestic competition alongside deceptive attacks.

A targeted policy would focus on fraud, unauthorized account networks, circumvention, stolen credentials, and sensitive capability extraction. It could preserve room for licensed distillation and independent open-weight development. That outcome would strengthen Tan’s central claim that national security and domestic openness do not have to conflict.

A broader prohibition would move policy in the opposite direction. If competitive training from model outputs is treated as inherently illicit, American open-weight labs will have fewer paths to narrow the gap. Developers would then rely on independent training, collaboration with willing providers, or foreign open models.

Readers should watch these signals in that order. First, look for a developer willing to build transparently. Second, inspect whether a frontier lab grants useful rights. Third, examine whether policy distinguishes deceptive extraction from authorized learning.

The Garry Tan AI distillation debate will not be resolved by deciding whether openness is always good or always dangerous. The practical test is whether American labs can produce independently usable models while respecting access rules and verifying serious risks.

Over the next several months, ask three questions whenever a domestic open-weight model appears: Who supplied its training outputs, what permission governed that access, and which evaluations support its safety claims? Clear answers would turn Tan’s proposal into a workable competitive strategy. Missing answers would leave the United States with the same choice between concentrated domestic APIs and foreign open-weight systems.