This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Anthropic has accused three Chinese AI labs—DeepSeek, Moonshot, and MiniMax—of conducting industrial-scale 'distillation' attacks against its Claude models. By using over 24,000 fraudulent accounts and proxy services, these labs allegedly extracted model capabilities to improve their own products, violating Anthropic's terms of service. Anthropic warns that these illicitly distilled models lack necessary safety guardrails, posing significant national security risks by potentially enabling offensive cyber operations, disinformation, and mass surveillance.
Anthropic said it identified large-scale campaigns that used fraudulent accounts and proxy services to generate high volumes of Claude interactions to extract model capabilities for competitor training ("distillation"). Anthropic attributed the activity to DeepSeek, Moonshot, and MiniMax and said it involved millions of exchanges across thousands of accounts, violating its terms and access restrictions. Anthropic described detection measures, account controls, and indicator-sharing in response.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The labs utilized 24,000 fraudulent accounts and proxy services to systematically evade detection and illicitly extract intellectual property for competitive advantage.
The distillation campaigns are driven by geopolitical and commercial competition to bypass export controls and rapidly advance Chinese AI capabilities at the expense of safety guardrails.
The incident involves Chinese AI labs exploiting API access vulnerabilities through proxy networks and fraudulent accounts to conduct large-scale distillation attacks, extracting proprietary model capabilities.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human actors at Chinese AI labs intentionally executing coordinated distillation campaigns against Anthropic's deployed Claude models.
Coordinated, industrial-scale distillation campaigns by Chinese AI labs targeted Anthropic's Claude models, successfully extracting advanced capabilities. This represents a substantial technological security challenge, enabling foreign entities to bypass export controls and accelerate their own AI development using stolen US intellectual property.
The report describes Claude as a frontier AI model providing capabilities like agentic reasoning, tool use, and coding to users, acting as an Assistant that responds to prompts. The Chinese labs queried Claude to extract these capabilities to train their own models.
Limited Risk: The Claude models and the distilled Chinese models are general-purpose AI systems and chatbots. Under the EU AI Act, chatbots and AI systems generating content are classified as Limited Risk (Level 3), requiring transparency obligations.
Claude is a general-purpose large language model primarily used for question answering, writing assistance, and code generation, which were the specific capabilities targeted for extraction.
The reports from multiple sources provide highly detailed, consistent, and specific technical details about the distillation campaigns, including the number of accounts (24,000), exchanges (16 million), and the specific labs involved. There is little ambiguity about the facts of the accusations, though the accused Chinese labs have not publicly commented.
The Chinese labs might argue that distillation is a standard, legitimate industry practice and does not constitute 'theft' or 'attacks' as characterized by Anthropic.
Response or counter-arguments from DeepSeek, Moonshot, and MiniMax regarding the allegations.
Technology
Proxy Hydra Cluster Architectures
Sprawling proxy networks bypassed single-point API bans.
Vulnerable Account Creation Pathways
Exploitation of educational and startup verification processes.
Lack of Output Distillation Defenses
API returned raw reasoning traces without obfuscation or degradation.
Data Inputs
Chain-of-Thought Elicitation Prompts
Prompts forced the model to output step-by-step reasoning data.
Censorship-Safe Query Generation
Prompts generated politically safe data to train foreign models.
Targeted High-Volume API Queries
16 million queries focused on agentic reasoning and coding.
Human Factors
Deliberate Terms of Service Evasion
Researchers knowingly used fake accounts to bypass restrictions.
Hiding Traffic in Normal Usage
Actors mixed distillation requests with benign customer traffic.
Bypassing Regional Access Bans
Users in restricted markets actively sought unauthorized access.
Process and Methods
Weak Initial Account Verification
Verification steps failed to identify coordinated fraudulent setups.
Delayed Detection of API Abuse
System failed to identify coordinated hydra networks in real-time.
Absence of Industry Intel Sharing
Lack of early threat sharing enabled cross-platform exploitation.
Management
Prioritizing Cheap Capability Growth
Labs used distillation as a shortcut instead of independent training.
Underestimating API Abuse Scale
Management failed to anticipate coordinated multi-account campaigns.
Delayed Countermeasure Deployment
Defensive classifiers were built after massive extraction occurred.
Regulatory Environment
Unenforceable Terms of Service
Legal terms carry little weight against foreign state-backed labs.
API Gaps in Export Controls
Physical chip restrictions did not prevent remote API exploitation.
Lack of Global AI Governance
No international framework exists to penalize model capability theft.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
No population impact data reported.
