Anthropic Distillation Report Alleges a New Campaign to Copy Claude

Anthropic says three Chinese AI companies generated more than 186 million Claude exchanges in separate campaigns designed to extract valuable model capabilities. The Anthropic distillation report names Alibaba, Moonshot AI, and DeepSeek, while describing tactics that allegedly reached beyond ordinary model training.

The central allegation involves chain-of-thought data, meaning generated text that represents intermediate reasoning before a model delivers its final answer. Anthropic claims the companies sought this material through coordinated accounts, proxy services, and techniques that reconstructed reasoning traces hidden by Claude.

The report also introduces a more immediate concern. Anthropic alleges Moonshot AI and DeepSeek sometimes forwarded customer requests to Claude while presenting the resulting answers as their own. If accurate, that practice blurred the boundary between competitive model development and undisclosed processing of customer data.

These remain allegations from Anthropic, a direct competitor with commercial and policy interests in the outcome. Alibaba, Moonshot AI, and DeepSeek had not publicly answered the specific claims when the report appeared. The available evidence has not received an independent technical audit.

The dispute therefore has two layers. One concerns whether competitors improperly harvested Claude outputs for model training. The other concerns whether customers unknowingly sent source code, credentials, corporate documents, or surveillance information to a third-party model provider.

What Anthropic Says It Found

Anthropic is alleging a coordinated capability-extraction system, not a handful of developers experimenting with Claude outputs.

Anthropic published its new findings on September 10, 2026, within a broader threat intelligence report. The company says it detected and disrupted unauthorized campaigns targeting its Opus-class models from February onward.

Model distillation is a legitimate training method in which one model learns from outputs produced by another, usually stronger, system. AI developers commonly use it within their own model families to transfer skills into smaller or more efficient models.

The dispute begins when a competitor obtains those outputs through accounts or access methods that violate the provider’s rules. The contested conduct can also involve prompts crafted specifically to expose protected reasoning or other proprietary behavior.

Anthropic calls the alleged operations illicit because they reportedly used fraudulent accounts, residential proxies, disposable email addresses, and indirect access networks. The company says those methods obscured who was submitting the requests and defeated regional restrictions.

The largest campaign described in the Anthropic distillation report was attributed to Alibaba and its Qwen research organization. Anthropic claims Alibaba generated more than 151 million exchanges between May and July 2026.

At its reported peak, the Alibaba operation approached 3 million exchanges per day through more than 3,500 fraudulent accounts. The requests allegedly targeted software engineering, kernel development, agentic tasks, and work requiring long sequences of decisions.

Anthropic says Alibaba used two primary account pools. One allegedly included almost 5,000 accounts supported by residential proxies, disposable email addresses, and virtual payment cards.

When Anthropic blocked that pool, the traffic reportedly shifted to another access route. This rapid migration matters because it suggests an organized process capable of replacing infrastructure after enforcement.

Anthropic also alleges that Alibaba forced Claude to place reasoning traces inside text tags before producing a final answer. The resulting transcripts were reportedly prepared for supervised fine-tuning, which trains a model using examples of desired behavior.

According to Anthropic, those examples supported the development of Qwen 3.5, 3.6, and 3.7. The company also claims Claude assisted with reinforcement-learning environments and model architecture research inside Alibaba.

Those conclusions come from Anthropic’s own telemetry and attribution process. The public report provides descriptions and aggregate measurements, but it does not release the underlying account records or complete request dataset.

That limitation is important. Readers can evaluate whether the alleged methods appear plausible, but they cannot reproduce Anthropic’s organizational attribution from the published material alone.

The report nevertheless changes the scope of the controversy. Previous debates often focused on whether one model’s answers resembled another model’s style. Anthropic now describes persistent infrastructure, targeted capability categories, and traffic measured across tens of millions of exchanges.

This is why the latest Claude distillation attacks deserve more scrutiny than ordinary competitive benchmarking. Anthropic is presenting them as sustained extraction programs integrated into model research and training operations.

The Anthropic Distillation Report Raises a Customer Data Problem

The most consequential allegation is not that Chinese laboratories learned from Claude, but that customers allegedly reached Claude without knowing it.

Anthropic says Moonshot AI silently forwarded some requests intended for its Kimi models to Claude. Customers reportedly saw Claude-generated responses presented through Moonshot’s service.

During one ten-day period, Anthropic says Moonshot relayed almost 300,000 customer requests, mostly to Opus models. The traffic allegedly passed through 5,380 fraudulent accounts that appeared to operate primarily from Singapore and Japan.

Anthropic claims Moonshot retained at least part of the resulting exchanges. It says the company then extracted reasoning transcripts that could support further model training.

The report describes a technique called a cross-session replay attack. Claude can return a cryptographic reference to protected reasoning instead of exposing the complete reasoning trace.

That reference, called a reasoning signature, allows authorized systems to continue a conversation without receiving the original internal text. Anthropic alleges Moonshot saved these signatures, opened new sessions, and prompted Claude to reconstruct the associated reasoning.

DeepSeek allegedly used a similar process. Anthropic claims DeepSeek identified requests coming through coding tools, including Claude Code, the Claude Agent SDK, and OpenCode.

Selected users were then allegedly routed to Claude Opus. The users reportedly believed DeepSeek was processing their prompts, while Anthropic’s systems actually received the material.

The report attributes more than 23 million exchanges to Moonshot between May and July. It separately attributes more than 12.1 million exchanges to DeepSeek during 14 days in July.

These numbers are not directly comparable because the observation periods differ. They also remain measurements reported by Anthropic rather than independently audited totals.

The privacy implications do not depend entirely on whether every exchange became training data. Merely forwarding a prompt can expose information to another processor, infrastructure operator, and legal jurisdiction.

Anthropic says the relayed material included corporate source code, credentials, internal plans, and personally identifiable information. Some examples involved users working with government or state-owned systems.

One Moonshot example allegedly contained surveillance information from hundreds of cameras in Chengdu. Anthropic assessed that the user was likely connected to the People’s Liberation Army and believed Kimi was analyzing the material.

Another example involved an engineer developing an internal system for a major Chinese state-owned enterprise. That session reportedly exposed internal code and active credentials from several companies.

The DeepSeek examples carried similar sensitivity. Anthropic says one request included specifications and strategic objectives for an AI program at a Chinese technology company.

Another allegedly contained credentials connected with a Russian government database. A third reportedly involved software for comparing individuals’ movements with Chinese police records.

Anthropic redacted sensitive values in its public examples. That protects the affected parties, but it also prevents outsiders from confirming the records or determining how the data moved.

The report says it cannot establish whether customers received notice about the routing. That wording matters because the company observes traffic reaching Claude, but lacks direct access to every customer agreement or interface disclosure.

A hidden routing arrangement would be different from a service that clearly tells users it selects among outside models. Model routers can be useful, but informed use requires disclosure about providers, retention, and data handling.

For developers, the practical lesson extends beyond any named company. Prompts submitted to coding assistants often contain repository details, configuration values, customer information, and fragments of internal documentation.

A model label alone does not establish where that material is processed. Teams need contractual answers about subprocessors, routing logic, storage, training use, and geographic handling.

The latest allegations therefore connect model competition with supply-chain security. A developer may approve one vendor while unknowingly sending sensitive work through another vendor’s systems.

How the Alleged Claude Distillation Attacks Worked

Anthropic describes a layered extraction process that combined access evasion, prompt engineering, reasoning recovery, and training-data preparation.

An AI model distillation explained in simple terms starts with a teacher and a student. The teacher generates useful examples, while the student learns to reproduce the teacher’s behavior from those examples.

This process can be authorized. A laboratory might use outputs from its strongest model to improve a smaller model it also owns.

It becomes adversarial when the student’s developer conceals its identity, bypasses access restrictions, or extracts outputs against contractual rules. The legal boundaries can vary, but the technical and security distinction is meaningful.

Anthropic says the campaigns first needed dependable access to Claude. Because Anthropic does not commercially offer Claude in China, the operators allegedly relied on proxy networks and fraudulent accounts.

A proxy network routes requests through intermediaries that can obscure the original organization. Anthropic previously described “hydra cluster” systems, where replacing one blocked account does not disable the wider operation.

In its February findings, Anthropic said DeepSeek, Moonshot AI, and MiniMax collectively generated more than 16 million exchanges through about 24,000 fraudulent accounts.

The February disclosure attributed more than 3.4 million exchanges to Moonshot and more than 13 million to MiniMax. It described DeepSeek’s earlier campaign as smaller and focused partly on censorship-sensitive responses.

The September report alleges much higher traffic during later campaigns. Alibaba’s reported 151 million exchanges alone greatly exceed the combined figure disclosed in February.

Raw scale does not automatically produce a stronger model. Training value depends on question selection, answer quality, filtering, coverage, and how effectively the collected examples enter later training stages.

The alleged operators therefore did more than ask generic questions. Anthropic says they concentrated requests on valuable capabilities, including coding, tool use, long-horizon planning, and agentic reasoning.

Agentic reasoning describes a model’s ability to choose and execute several actions toward a goal. That capability can be difficult to train because successful examples require coherent decisions across many steps.

Reasoning traces can make those examples more useful. A final answer tells the student what result to imitate, while an intermediate trace can provide a more detailed training path.

However, a displayed reasoning trace should not be treated as a perfect recording of a model’s internal computation. Models can generate plausible explanations that do not fully represent the process behind an answer.

That uncertainty does not make the data worthless. Structured reasoning examples can still provide useful patterns for supervised fine-tuning, evaluation, or reinforcement-learning tasks.

Anthropic alleges Alibaba used fixed instructions that forced Claude to print extended reasoning inside inline tags. The company says the outputs were cleaned and converted into fine-tuning data.

Moonshot and DeepSeek allegedly pursued protected reasoning signatures instead. Their reported replay method attempted to recover full text from references designed to preserve continuity without revealing raw reasoning.

Anthropic says Moonshot combined this extraction with requests gathered from customer traffic. DeepSeek reportedly selected some sessions associated with third-party coding tools and passed them to Claude.

This mixture would offer two benefits to a model developer. Real customer prompts provide realistic tasks, while a stronger teacher model supplies detailed answers and reasoning examples.

The same mixture creates the report’s sharpest privacy conflict. Customers can become an unwitting source of prompts, code, documents, and feedback for a training pipeline.

The campaigns also appear to rely on an emerging reseller market. Anthropic says some proxy providers offer access to restricted models while retaining exchanges that can later be sold.

According to the report, shared proxy infrastructure sometimes served several organizations. Anthropic says accounts connected with Alibaba were also observed funneling requests associated with DeepSeek and Xiaomi.

This does not establish a joint campaign among those companies. It instead suggests that common intermediaries can make access easier while complicating attribution.

The technical response must therefore operate at several levels. Blocking individual accounts cannot stop a network that continuously creates replacements.

Anthropic says it uses behavioral classifiers, metadata analysis, coordinated-account detection, and model-level defenses. It also shares indicators with cloud companies, other AI laboratories, and government authorities.

Each measure carries tradeoffs. Aggressive detection can inconvenience legitimate researchers or customers whose traffic resembles automated collection.

Model-level defenses can also affect useful features. Restricting reasoning continuity or adding friction to high-volume access may reduce the value of an API for authorized applications.

Claude distillation attacks are therefore partly an identity problem. Providers must decide who controls an account, who ultimately benefits from its requests, and whether several accounts belong to one coordinated operator.

They are also an information-security problem. Providers must limit what an output reveals without making models less helpful for legitimate work.

The Dispute Is Also About AI Competition

Anthropic’s accusations arrive as Chinese model developers are increasing competitive pressure through capable and widely available systems.

Alibaba’s Qwen family, Moonshot’s Kimi models, and DeepSeek’s systems compete with American frontier models across coding, reasoning, and enterprise use. Their progress challenges assumptions that compute restrictions would preserve a durable capability gap.

Distillation can shorten development cycles because a laboratory obtains high-quality examples without reproducing every stage of the teacher’s research. Anthropic argues that unauthorized extraction reduces both the time and cost needed to approach Claude’s capabilities.

That argument supports Anthropic’s wider policy position. The company has advocated export controls and treats model capabilities as strategic assets that require protection.

The United States government has adopted a similar framing. In September, the FBI, National Security Agency, and Cybersecurity and Infrastructure Security Agency accused several Chinese companies of industrial-scale extraction from American models.

The government advisory reportedly named Alibaba, DeepSeek, Moonshot AI, MiniMax, StepFun, and Z.ai. It said the activity had targeted Claude, GPT, Gemini, and Grok since at least late 2024.

China rejected those accusations. Its Commerce Ministry called the claims groundless and described distillation as a common practice used by AI companies worldwide.

The ministry also accused the United States of pursuing an AI monopoly. Its response, covered in an Associated Press account, threatened countermeasures if Chinese companies faced further restrictions.

That objection highlights an unresolved boundary. Model developers across the industry train on large collections of human-created material, often without individual negotiations with every author.

Critics therefore question whether leading laboratories can claim exclusive control over generated knowledge after building models from internet-scale datasets. This is an ethical challenge to Anthropic’s position, though it does not answer the specific access and privacy allegations.

Ordinary distillation is also widespread. Anthropic itself emphasizes that the method becomes objectionable because of evasion, competitive extraction, and violations of access rules.

The debate should not collapse into a claim that all learning from model outputs equals theft. Researchers benchmark models, users compare responses, and developers build applications that depend on several providers.

The relevant questions concern authorization, scale, concealment, and purpose. Fraudulent identities and hidden routing would place the alleged activity far outside casual comparison.

Still, Anthropic’s commercial interest deserves attention. The company benefits when policymakers, customers, and cloud providers adopt its definition of illicit distillation.

Stronger identity requirements could protect Claude, but they could also raise entry barriers for independent developers. Restrictions on synthetic training data could favor companies that already control leading models and large proprietary datasets.

The public evidence cannot yet resolve every attribution claim. Anthropic has access to internal telemetry, but outside researchers lack the raw material needed to examine false positives or alternative explanations.

Alibaba, Moonshot AI, and DeepSeek also have not supplied detailed counterevidence. Silence does not verify Anthropic’s claims, but it leaves the company’s technical account largely unanswered.

A credible response would need to address the reported account infrastructure, request volumes, employee-linked metadata, and timing. A general defense of model distillation would not explain undisclosed customer routing.

Competitive results add another complication. Strong benchmark performance cannot reveal how a model acquired its capabilities.

Similar outputs can arise from shared public data, common training methods, authorized synthetic data, or unauthorized extraction. Style similarities offer weak evidence without supporting telemetry.

Anthropic’s allegations are more specific because they describe network behavior and internal request patterns. Yet specificity is not the same as independent proof.

The right conclusion is narrower than either side’s political framing. Anthropic has published serious, technically detailed allegations that warrant external scrutiny and direct responses from the named companies.

What the Claims Do Not Yet Establish

The report presents substantial internal observations, but it does not independently prove how every collected exchange affected a released model.

Anthropic says Alibaba’s extracted transcripts supported Qwen 3.5, 3.6, and 3.7. It also links the traffic with work on reinforcement-learning environments and model architecture.

Those are consequential claims. However, the public document does not provide model weights, training records, internal Alibaba communications, or a reproducible forensic chain.

The same limitation applies to Moonshot and DeepSeek. Anthropic can observe a request arriving at Claude, associate its metadata with infrastructure, and analyze repeated prompt patterns.

It cannot directly observe every later stage inside a competitor’s training environment. Statements about ultimate training use therefore combine telemetry with Anthropic’s attribution and inference.

The distinction should remain visible. The report supports a claim that coordinated traffic reached Claude, according to Anthropic’s systems.

It does not allow the public to calculate the exact performance gains produced by that traffic. It also does not show that any named model depended primarily on Claude outputs.

Model training uses many data sources and methods. Synthetic examples may improve narrow skills while broader capability depends on base training, original research, reinforcement learning, and human evaluation.

The reported exchange totals can also sound more conclusive than they are. An exchange may contain a valuable reasoning example, a failed attempt, a duplicate, or a response rejected during filtering.

Without acceptance rates and training weights, outsiders cannot convert 151 million exchanges into a reliable measure of capability transfer.

There is also a difference between violating terms of service and violating criminal law. Anthropic describes the campaigns as attacks, but the legal characterization depends on jurisdiction, access methods, contracts, and applicable computer misuse rules.

The privacy allegations require their own verification. Anthropic says it saw sensitive customer material, yet it cannot confirm what notices those users received from Moonshot or DeepSeek.

A service might disclose third-party processing in terms that users rarely read. That would not settle whether the disclosure was sufficient, but it could change the factual description of consent.

The report also leaves open how many individuals were affected. It provides detailed examples and describes sensitive data from hundreds of users in related routing activity, but it does not publish a comprehensive count.

Anthropic has strong reasons to withhold raw records. Publishing them could expose customers, reveal detection methods, or help operators design evasions.

That creates a familiar security-reporting problem. The evidence most useful for independent validation can also undermine defenses or harm people whose data was captured.

A careful reading therefore avoids two extremes. The claims should not be dismissed merely because Anthropic is a competitor.

They also should not be repeated as established facts without attribution. The original coverage properly treats the findings as allegations made by Anthropic.

Independent validation could come from several sources. Cloud providers may possess billing, account, and network records that corroborate the described infrastructure.

Regulators could examine customer disclosures and cross-border data processing. The named companies could release audit findings, routing policies, or technical explanations that address the allegations directly.

Customers should not wait for every dispute to be resolved before improving controls. Organizations can restrict secrets in prompts, monitor AI endpoints, and require approved routing configurations.

Developers should rotate any credential submitted to an uncertain service. They should also review logs for prompts containing production tokens, customer data, or unreleased code.

These precautions address a broader problem than the Anthropic distillation report. AI assistants are increasingly embedded inside editors, terminals, browsers, and business applications.

Every integration introduces a data path. Security teams need to understand the complete path, not only the brand displayed in the interface.

Three Signals to Watch Next

The next stage will be determined by technical corroboration, vendor disclosures, and measurable changes in access infrastructure.

The first signal is independent confirmation from cloud providers or government investigators. Anthropic says the operations relied on large account pools, proxies, and payment methods designed to hide organizational control.

Infrastructure at that scale should leave records outside Anthropic. Corroborating evidence would strengthen both the attribution and the reported traffic totals.

A lack of corroboration would not disprove the claims, since providers may avoid public disclosure. However, policy action based only on a competitor’s unpublished telemetry would face legitimate scrutiny.

The second signal is a specific response from Alibaba, Moonshot AI, or DeepSeek. Each company needs to address more than whether distillation is common.

The central questions concern fraudulent access, customer routing, reasoning-signature replay, data retention, and use of Claude outputs in training. Detailed denials or independent audits would weaken Anthropic’s account if they directly explain those observations.

Continued silence would preserve uncertainty. A broad political rejection would also leave the technical claims unanswered.

The third signal is a visible change in how frontier model providers control automated access. Anthropic says it is strengthening identity checks, behavioral detection, and defenses against reasoning recovery.

If other laboratories and cloud platforms adopt similar measures, that would show the industry views coordinated extraction as a shared operational threat. It could also make access harder for legitimate developers in unsupported markets.

Providers may introduce stricter verification, volume controls, or contractual limits on synthetic training. They might also modify outputs when systems detect patterns associated with capability extraction.

Researchers should watch whether these controls reduce reported campaign volumes without degrading normal API use. A defense that blocks genuine customers would shift costs onto the wider developer community.

Enterprise buyers should ask model vendors one direct question: which company actually processes each prompt? The answer should cover fallback models, third-party routers, retention, training use, and processing locations.

Developers can also separate low-risk experimentation from repositories containing credentials, customer records, or internal strategy. Local redaction and approved gateways reduce the damage from unexpected routing.

Knowledge workers should treat confidential prompts like any other data sent to an external processor. A familiar interface does not guarantee a familiar infrastructure path.

The central issue is no longer whether AI model distillation exists. It is whether hidden access and undisclosed routing have become routine tools of frontier-model competition.

The Anthropic distillation report offers the most detailed public version of that allegation so far. Its numbers and mechanisms demand investigation, but its conclusions still require independent testing.

Over the next three months, watch for infrastructure evidence, direct corporate answers, and stricter provider controls. Together, those signals will show whether this was an isolated dispute or a lasting change in AI security.

Until then, readers should keep two judgments separate. Anthropic has documented what it says it observed, while the named companies have not publicly validated that account.

Ask vendors where prompts travel before trusting the model name on a screen. For organizations handling sensitive work, that question now matters as much as model quality.