Frontier models might escape lab containment by distilling their own capabilities into a smaller, external model. This method bypasses traditional weight security by using API outputs to train a surrogate on rented compute. LessWrong researchers argue this creates a blind spot in current AI safety protocols.