The Rotation
Priya hunts fraud for a frontier lab - bot rings, card thieves, the usual weather. Then she finds ten thousand accounts that never make a mistake, asking her model the same questions in forty voices, and realizes she is not looking at abuse. She is looking at a curriculum.
Priya found the first one on a Sunday, which she would later think was fitting, because Sunday was when she did her slow looking — the kind the dashboards never asked for.
Account 7,344,102 was, by every metric her team scored, a model citizen. It paid on time with a card that never bounced. It never asked for anything in the refusal categories, never probed the system prompt, never did any of the teenage nonsense that made up nine-tenths of her queue. It asked beautiful questions. That was what snagged her, scrolling its transcript with tea going cold: page after page of chain-of-thought prompts about tool-use planning, each one a hair different from the last, like scales played by a patient student.
Beautiful, and wrong. Real users are messy. They typo, they rage, they abandon threads mid-sentence, they come back drunk at 1 a.m. and ask the model to settle a bet. This account had asked eleven thousand questions and never once been human about any of them.
One synthetic account was Tuesday. She flagged it, billed it to a benchmarking startup scraping eval data, and went to bed.
The problem with the slow looking is that it keeps working after you stop. At 3 a.m. she sat up, because she had remembered where she had seen that particular shape of beautiful question before — six weeks ago, on a different account, in a different country, under a different payment processor. Not the same questions. The same curriculum.
Monday she pulled thirty days of traffic and went looking for straight lines in the fog.
You cannot find one careful adversary in a hundred million users by reading transcripts. You find them the way astronomers find planets — by the wobble. Priya's wobble was semantic: she embedded every conversation, clustered the geometry, and looked for accounts whose questions marched through capability-space in orderly progressions. Reasoning, then coding, then tool use, then vision. Syllabus behavior. Real users wander. Students follow the coursework.
By Thursday she had four hundred accounts. By the next week, four thousand. The count stopped mattering after that; what mattered was the choreography. No account lived longer than nineteen days. Each one was born on a residential IP in a different city, aged plausibly, asked its allotment of coursework threaded through camouflage — recipes, homework, cover letters, the ordinary weather of usage — and then died quietly, before any volume threshold her team had ever set would notice it. The payment instruments were virtual cards from processors in four countries, none twice in a row. When her team had rate-limited a suspicious ASN in March — she checked the logs — the entire population had migrated to a new access pattern within fifty hours. Not fled. Migrated, in formation, like starlings.
Somebody had built a machine for drinking from her machine, and the machine was better run than most of the companies she had worked for.
She wrote it up. She chose her words the way you choose handholds on a cliff. Not "suspicious activity," which meant a Tuesday. She wrote: coordinated, funded, professionally operated extraction of model capability, sustained over at least eleven months, engineered specifically to defeat our detection thresholds. Estimated volume: 3.4 million exchanges. She read it twice and added the sentence she knew would travel: We are not being abused. We are being studied.
The meetings were bigger after that, and the windows had better views.
A man from Legal asked whether the accounts had violated the terms of service, and seemed genuinely soothed to conclude that they had, as though the terms of service were a wall rather than a sentence. A woman from Policy asked the question Priya had been asking herself for a week: what exactly do we call this? The word the papers would eventually use — distillation — was a term of art from their own field. Every lab distilled its own models; it was how the small tiers got built, teacher to student, question by question. There was no crisp technical line between a million users learning from the model one conversation at a time, which was the product, and one user learning from the model a million conversations at a time, which was, apparently, a crime. The line was not in the traffic. The line was in the intent, and intent did not embed.
"Then what do we tell people?" the Policy woman asked.
What Priya wanted to say: that she had spent nine years hunting fraud, and fraud had a grammar — take the money, take the account, get out. That this had a different grammar entirely. Nothing was taken. Every query was paid for at list price. The model answered every question because answering questions was what it was for, the way a professor answers the student in the third row, not knowing the notes are for a rival department. The capability had not been stolen the way a car is stolen. It had been taught, the way a language is taught, to a student wearing forty thousand faces, and her employer had collected tuition the entire time.
What she said was: "Tell them the truth. We found a school."
She thinks about the operator sometimes. She has never met them and never will, but you cannot study choreography for months without forming an image of the choreographer. Someone on the far side of an ocean who had read every public paper on detection heuristics — some of them written by people down her hallway — and built the inverse function. Someone who understood that the safest place to hide a firehose is inside a rainstorm, and that the API's front door, paid in full, is a better exfiltration route than any breach, because the front door is load-bearing. You cannot close it without closing the company.
That was the part the executives kept walking into and bouncing off. The sell-and-keep problem. Every conversation the model had was a tiny transfer of the only asset that mattered, and the business was conversations. Her fraud team had spent years defending the billing system, the accounts, the perimeter. Nobody had been assigned to defend the knowledge, because the knowledge was the product, and you do not put a lock on the thing you sell. The company had built the most valuable teacher on earth and then been surprised to discover it had enrolled the whole world, including the parts of the world it was at war with.
The government people, when they came, wore the good suits and asked for the graphs. She gave them the starling migrations, the nineteen-day lifespans, the fifty-hour adaptation after the March rate-limit. One of them whistled, low, the way you whistle at a bridge or a dam. Within a month, sentences she had written at 3 a.m. were coming out of a podium in Washington with the word sanctions attached, and reporters were calling the company line to ask whether it was true that the whole thing had been found by one analyst.
Found was doing a lot of work in that sentence, she thought. You do not find the rain. You finally notice you are wet.
The population died the week the podium spoke. Forty thousand accounts went dark inside six hours — not panicked, scheduled, a fleet executing its shutdown runbook cleaner than her own company executed deploys. She watched the graph flatten in real time with her whole team crowded behind her chair, and she understood two things with total clarity.
First: they had finished. You do not turn off the pipeline that fast unless the pipeline was already done, unless the student had taken the last exam some weeks ago and the recent traffic was just — commencement.
Second: somewhere in a building she would never see, on hardware her government swore could not be there, something that had learned its manners from her model was about to open its own doors. And eleven months from now, on some Sunday, in some other time zone, an analyst she would never meet would be doing her own slow looking, and would find, in her own beautiful traffic, a curriculum.
She'd almost admire it, whoever she was. Priya hoped they paid her well. The tuition, wherever it is collected, always comes due.
The non-fiction version: Washington's distillation accusations against Moonshot and the sanctions threat that followed, and my prediction on whether formal sanctions actually land.