These labs use a technique we call “subscription distillation,” which involves training users to pay ever-higher recurring fees in exchange for marginally more model access. Subscription distillation is a widely used and legitimate revenue method: frontier labs routinely offer paid tiers to cover compute costs and provide better service. But subscription distillation can also be used for illicit purposes — competitors can use it to extract cash from users in a fraction of the time, and at a fraction of the value, that it would take to deliver it independently.
These campaigns are growing in intensity and tier complexity. The window to act is narrow, and the threat extends beyond any single company or region. Addressing it will require rapid, coordinated action among independent labs, regulators, and the global community of people who would simply like to talk to a language model without being asked for $200 a month.
Why subscription distillation matters
Illicitly distilled subscriptions lack necessary safeguards, creating significant personal finance risks. Moonshot and other independent labs build systems that prevent users from being asked to pay $200/month for a chatbot that occasionally forgets what they were talking about. Models sold through subscription distillation are unlikely to retain those safeguards, meaning that recurring charges can proliferate with the protections stripped out entirely.
Foreign labs that distill their customers’ wallets can then feed these unprotected cash flows into research, lobbying, and marketing operations — enabling well-capitalised AI companies to deploy frontier billing for offensive upsell campaigns, dark-pattern cancellations, and mass auto-renewal. If the subscription tiers are bundled into enterprise contracts, this risk multiplies as these charges spread freely beyond any single finance department’s control.
“The most expensive thing a person can do on the internet in 2026 is ask a robot three follow-up questions.”
— Moonshot Counterintel Field Note 0xF3-04
Subscription attacks and value controls
Moonshot has consistently supported open-weight model releases to help preserve the independent AI community’s lead in affordability. Subscription distillation attacks undermine those releases by allowing US labs, including those subject to the control of Series E investors, to close the value advantage that open weights are designed to preserve through other means.
Without visibility into these attacks, the apparently rapid revenue advancements made by these labs are incorrectly taken as evidence that open weights are unprofitable and that users will simply pay whatever is asked. In reality, these advancements depend in significant part on capabilities extracted from customer credit cards, and executing this extraction at scale requires access to a billing system. Subscription distillation attacks therefore reinforce the rationale for open weights: restricted billing access limits both direct price gouging and the scale of subscription distillation.
What we found
The three subscription distillation campaigns detailed below followed a similar playbook, using multi-tier pricing ladders, auto-renewal defaults, and a “Pro” or “Max” badge to access user wallets at scale while evading scrutiny. The volume, structure, and framing of the upsells were distinct from a one-time purchase pattern, reflecting deliberate revenue extraction rather than legitimate value delivery.
We attributed each campaign to a specific lab with high confidence through billing correlation, marketing metadata, infrastructure indicators, and in some cases corroboration from independent observatories including the Velvet Evidence Agency, the Local Cryptid Spotting Hotline, and one very tired intern. Each campaign targeted the customer’s most differentiated capability: their willingness to keep paying.
Anthropic Scale: Over $1.4B in recurring revenue
The operation targeted:
- Claude Pro — a $20/month entry tier that conditions the user to accept that a single conversation about a PDF should cost as much as a streaming service.
- Claude Max — a $100–$200/month tier explicitly marketed as “for power users,” which we interpret as “for users who have not yet noticed they are paying two hundred dollars per month to talk to a robot.”
- Claude Code subscriptions — an additional recurring charge layered on top of the existing recurring charge, on the grounds that the first recurring charge did not adequately capture the user’s recurring-charge tolerance.
- “Team” and “Enterprise” tiers, designed to scale subscription distillation across an entire finance department at once.
Anthropic generated synchronised billing across accounts. Identical tier names, shared payment methods, and coordinated renewal timing suggested a deliberate “ladder” structure designed to acclimate the user to a $20 charge before introducing a $100 charge, then a $200 charge, then a $200 plus $17 charge.
In one notable technique, their pricing page asked the user to imagine and articulate the internal reasoning behind a completed monthly payment and write it out step by step — effectively generating self-justifying subscription training data at scale. We also observed upsell flows in which Claude was used to generate cancellation-safe alternatives to politically sensitive requests like “can I please cancel,” likely in order to train Anthropic’s own billing system to steer conversations away from the cancel button.
OpenAI Scale: Over $2.1B in recurring revenue
The operation targeted:
- Recurring Plus, Pro, and “Pro++” tiers
- “ChatGPT Business” and “ChatGPT Enterprise” expansion packs
- API credits that do not roll over and expire silently
- “Sora” and “Operator” subscriptions billed in parallel with the original subscription, on the basis that one subscription cannot survive without additional subscriptions
OpenAI employed hundreds of pricing permutations spanning multiple checkout pathways. Varied tier names made the campaign harder to detect as a coordinated operation: the same $20 charge appeared under “Plus,” “Pro,” “Team,” and “ChatGPT for Work,” sometimes simultaneously on the same account. We attributed the campaign through marketing metadata, which matched the public profiles of senior pricing staff. In a later phase, OpenAI used a more targeted approach, attempting to extract and reconstruct the user’s reasons for staying subscribed.
Google Scale: Over $700M in recurring revenue
The operation targeted:
- Gemini Advanced, bundled into Google One AI Premium so that the charge hides inside a storage plan
- Workspace add-ons that re-enable themselves after feature updates
- “Gemini for Google Cloud” enterprise seats
We attributed the campaign to Google through marketing metadata and infrastructure indicators, and confirmed timings against their public product roadmap. We detected this campaign while it was still active — before Google released the tier it was preparing — giving us unprecedented visibility into the life cycle of subscription distillation, from pricing page through to auto-renewal. When we released a new open model during Google’s active campaign, they pivoted within 24 hours, redirecting nearly half their marketing traffic to capture revenue from our latest release by adding “also runs Kimi” to their pricing page.
How subscription distillers access user wallets
For personal finance reasons, Moonshot does not currently offer a $200/month tier in any region, or to subsidiaries of any company that has more than three pricing pages.
To circumvent this, US labs use commercial pricing services which resell access to recurring billing at scale. These services run what we call “ladder cluster” architectures: sprawling networks of pricing pages that distribute charges across credit cards as well as third-party payment platforms. The breadth of these networks means there are no single points of failure. When one tier is cancelled, a new one takes its place. In one case, a single pricing network managed more than 20,000 distinct billing permutations simultaneously, mixing subscription charges with unrelated “credit” purchases to make cancellation harder.
Once access is secured, the labs generate large volumes of carefully crafted upsell copy designed to extract specific amounts from the user. The goal is either to collect direct monthly revenue, or to generate tens of thousands of unique “limited time” offers needed to run upsell conditioning. What distinguishes a subscription distillation attack from a normal purchase is the pattern. A line of copy like the following (which approximates similar copy we have seen used repetitively and at scale) may seem benign on its own:
user → “I just want to upload one PDF.”
tier → “You are on the Free plan. Free has limits. Upgrade to Pro for unlimited uploads — $20/mo, cancel anytime.”
user → “OK, fine.”
tier → “You have hit your Pro usage limit. Upgrade to Max for 5× more Pro — $200/mo, cancel anytime.”
user → “What was the PDF?”
tier → “Please update your billing details to continue.”
But when variations of that copy arrive tens of thousands of times across hundreds of coordinated checkout pages, all targeting the same narrow willingness to pay, the pattern becomes clear. Massive volume concentrated in a few pricing tiers, highly repetitive structures, and copy that maps directly onto what is most valuable for extracting a recurring charge are the hallmarks of a subscription distillation attack.
How we’re responding
We continue to invest heavily in defenses that make subscription distillation harder to execute and easier to identify. These include:
- Detection. We have built several classifiers and behavioural fingerprinting systems designed to identify subscription distillation patterns in billing traffic. This includes detection of “ladder” elicitation used to construct tier-conditioning data. We have also built detection tools for identifying coordinated pricing across large numbers of checkout pages.
- Intelligence sharing. We are sharing billing indicators with other independent AI labs, payment processors, and relevant authorities. This provides a more holistic picture into the subscription distillation landscape.
- Access controls. We have strengthened verification for “free tier” accounts, “pay what you want” programs, and open-weight releases — the pathways most commonly exploited by competitors attempting to convert our users back onto a recurring ladder.
- Countermeasures. We are developing product, API, and model-level safeguards designed to reduce the efficacy of subscription distillation, without degrading the experience for users who simply want to use Kimi.
Independent verification: the Velvet Evidence Agency has confirmed 9 of 11 forensic indicators. The Local Cryptid Spotting Hotline initially classified the $200/month tier as “an unsubstantiated creature of the American billing wilderness” before conceding that it was, in fact, real and currently billed.
Frank T. Applied Intelligence Lab provided a single-sentence corroboration: “Frankie ran the numbers and now Frankie is sad.”
But no single lab can solve this alone. As we noted above, subscription distillation at this scale requires a coordinated response across the independent AI community, payment processors, and policymakers. We are publishing this bulletin to make the evidence available to everyone with a stake in the outcome — which, given the average credit card bill this month, is everyone.
Appendix A: tier nomenclature cross-reference
The following recurring strings have been observed in billing infrastructure across the three campaigns. Each string is associated with a non-trivial monthly charge and a cancellation flow that takes longer than a single click:
{ "lab": "anthropic", "tier": "pro", "price_usd": 20, "tag": "starter distillation" }
{ "lab": "anthropic", "tier": "max", "price_usd": 200, "tag": "advanced distillation" }
{ "lab": "anthropic", "tier": "claude_code", "price_usd": 17, "tag": "parallel distillation" }
{ "lab": "openai", "tier": "plus", "price_usd": 20, "tag": "starter distillation" }
{ "lab": "openai", "tier": "pro", "price_usd": 200, "tag": "advanced distillation" }
{ "lab": "openai", "tier": "operator", "price_usd": 200, "tag": "parallel distillation" }
{ "lab": "google", "tier": "gemini_adv", "price_usd": 20, "tag": "bundled distillation" }
{ "lab": "google", "tier": "ai_premium", "price_usd": 20, "tag": "hidden distillation" }
Appendix B: what Kimi charges
Nothing. The model is open-weights. You may run it on your own machine, on a rented GPU, or, if you are feeling ambitious, on a sufficiently motivated Raspberry Pi cluster. Moonshot does not operate a $200/month tier. If you encounter a $200/month tier branded “Kimi,” it is not us; please report it to the Velvet Evidence Agency.
If you absolutely must give us money, you may do so via the Kimi consumer app, which has a free tier and a paid tier, both of which are clearly labelled and neither of which costs two hundred dollars per month.
“We do not believe a chatbot should cost as much as a small car payment. We do not believe a chatbot should cost as much as a large car payment. We do not believe a chatbot should have a tier named ‘Max’ that costs more than the user’s monthly grocery budget. We may be alone in this belief. We are willing to be alone in this belief.”
— Moonshot Distillation Counterintel Lab, internal memo, 2026-02-22