The Cheap Model Is Someone Else's Model

On September 10, Anthropic published a report saying that since February it had disrupted distillation campaigns from seven labs based in China, all targeting its public models. The largest, which it attributed to Alibaba, ran through more than 3,500 fraudulent accounts, peaked at nearly three million exchanges a day, and harvested over 151 million transcripts between May and July to train the Qwen 3.5, 3.6 and 3.7 models.

Distillation is a technical word for a simple thing: you ask a strong model millions of questions, record how it thinks, and train a cheaper model to imitate it. The copy is never as good. It's usually good enough, and it's priced accordingly.

I don't run a frontier lab. I run training sessions for companies in Casablanca that are choosing which AI to put into production. And this story lands on my desk in a very specific form: a procurement officer holding two quotes, one of them a fraction of the other, asking why.

Why the cheap one is cheap

The question is never "which model is better." Nobody in a procurement meeting can evaluate that, and the benchmarks contradict each other anyway. The real question is: what am I actually paying for, and what am I not?

When a vendor's price is a fraction of the market, one of a few things is true. They're running a smaller model and calling it something else. They're running an open model of uncertain provenance, and the provenance now has a name attached to it. They're routing your data somewhere the cost is lower, with terms to match. Or they're subsidising you to win the account, and the price will change.

None of those is illegal. Some of them are fine. All of them are things you should know before your customer service history, your contracts, or your pricing grid go through the pipe.

The distillation story doesn't change the models. It changes the burden of proof. A vendor who couldn't say which model runs their chatbot used to be evasive. Now they're a risk.

The four questions

I've reduced the training I give procurement and legal teams on this to four questions. They fit on an index card. I've watched them end meetings.

Which model, by name and version, answers my users? Not "a leading LLM." A name you can look up, with a date.

Where does the request go, physically, and what's kept? A Moroccan customer's complaint about a Moroccan bank should not be training data for anyone. The vendor's answer should be a sentence, not a paragraph.

What happens when the model changes? The frontier labs now ship a new top model every few months. Your vendor's contract either handles that or it's a contract for a snapshot that will be obsolete before the ink dries.

And: can I leave? What do I get back, in what format, and how long does it take? A vendor who can't answer the last question in under a minute has built their business on you not asking it.

What the labs are doing about it

Anthropic's response, shipped with Fable 5.1 on September 1, was to close the specific loophole the campaigns used, the way the API exposed the model's step-by-step reasoning, and to tighten what a new account can do. OpenAI has been less public about its own countermeasures, but nobody believes it isn't fighting the same fight.

Both companies now openly say their best models are strategic assets. Earlier this year, Anthropic's Fable 5 was pulled from the market for most of June because of American export controls. Access to its restricted sibling, Mythos, was refused to China outright. Central banks in five countries held urgent meetings about what it meant for their institutions to have or not have access. Mistral, in France, started building alternatives for European organisations that couldn't get in.

Morocco is on nobody's allowlist for any of that. That's not a complaint. It's a fact about where we stand, and it should inform how a company here builds.

Build so that you can switch

The practical conclusion is the same one I reach in every article I write about tooling, and it's not accidental. Build so that the model is the least important part of your system.

Your data, cleaned, structured, owned by you, in a format you can export tomorrow. Your instructions and examples, written in plain language, in a folder, not buried in a vendor's configuration screen. Your process, understood by a named person in your team, not by the vendor's account manager. A test set, your own, that you run against any model you're considering, in an afternoon.

A company built like that can move from one model to the next when the price, the terms, or the politics change. A company built the other way has a chatbot and a dependency, and won't find out which one it bought until the vendor's next email.

The sovereignty question, at company scale

There's a national version of this conversation, and it's the right one to be having. Digital Morocco 2030 talks about an AI made in Morocco. That's a decade of work, and it will happen or not at a scale I don't control.

But there's a company-scale version that every leader can act on this quarter. Sovereignty at the level of your business means knowing what runs your systems, where your data goes, and being able to leave. It's not about building a Moroccan model. It's about not being the last person to find out whose model you've been running.

Ask the four questions. If the vendor's answers are good, you've lost ten minutes. If they're not, you've saved yourself the year it takes to find out the hard way.

And if you'd like someone in the room who has sat on both sides of that table: I do that.