Introduction
Anthropic has accused five China-based AI companies of running large-scale, unauthorized campaigns to extract capabilities from its Claude models and use them to train competing systems. In a threat intelligence report released on September 10, 2026, the company named Alibaba, Moonshot AI, DeepSeek, Xiaomi and Zhipu as being behind what it calls "illicit distillation," a technique in which outputs from a more capable AI model are fed into another model's training pipeline without authorization.
The Scale of the Campaigns
According to Anthropic, the combined activity across all five labs totalled nearly 190 million exchanges with Claude between May and July 2026. The largest single campaign, attributed to operators linked to Alibaba's Qwen division and tracked internally as GTG-16005, generated more than 151 million exchanges over the same period, peaking at close to three million interactions in a single day and spread across roughly 3,500 accounts Anthropic flagged as fraudulent.
Key Findings
- Nearly 190 million exchanges linked to distillation attacks across five Chinese AI labs between May and July 2026.
- Alibaba's campaign alone accounted for more than 151 million exchanges, the largest Anthropic has ever tracked.
- Moonshot AI reportedly routed some Kimi user requests to Claude and used the resulting exchanges for training, without notifying its own customers.
- Anthropic recorded more than 12 million distillation attempts attributable to DeepSeek over just 14 days in July 2026.
- A separate campaign linked to a network of around 5,000 accounts, some reportedly tied to the Chinese military, generated roughly 300,000 requests over ten days, targeting Anthropic's Opus model.
How Anthropic Identified the Campaigns
Anthropic said it was able to attribute the Alibaba-linked campaign to a single coordinated operation because the accounts involved all used a shared, fixed prompt engineered specifically to force detailed chain-of-thought reasoning output from Claude, effectively turning each interaction into structured training data ready for harvesting. That distinctive, repeated prompt pattern allowed the company's internal detection systems to link thousands of seemingly separate accounts back to a single underlying operation.
Table: Reported Distillation Campaigns
| Lab | Reported Activity |
|---|---|
| Alibaba (Qwen) | 151 million-plus exchanges, May-July 2026, largest campaign tracked |
| Moonshot AI (Kimi) | Routed user requests to Claude without customer notification |
| DeepSeek | 12 million-plus distillation attempts over 14 days in July 2026 |
| Unnamed Network | ~300,000 requests over 10 days via ~5,000 accounts, some reportedly linked to Chinese military |
Why This Matters for Privacy and Security
Anthropic's report noted that some of the intercepted exchanges included sensitive information originating from individual users, major multinational companies and state-affiliated actors, information that likely ended up being processed by the distillation operations without those original users' knowledge or consent. The company stated these practices are likely inconsistent both with data privacy laws and with the labs' own stated terms of service governing how user data can be used.
The Broader Geopolitical Backdrop
Anthropic's head of policy told the Senate Banking Committee earlier in the year that this kind of distillation activity effectively converts billions of dollars in American AI investment and research into what amounts to a subsidy for geopolitical competitors, since accessing a frontier model like Claude through fraudulent accounts costs a small fraction of what training a comparable model from scratch would require. Unlike hardware export controls, which govern the physical transfer of chips, there is currently no equivalent mechanism to prevent this kind of capability transfer through API access alone.
Expert Insight
Security researchers reviewing the report note that this is not the first time Anthropic has raised concerns about distillation activity from Chinese labs, having made similar claims earlier in the year, and that OpenAI has separately identified DeepSeek as a source of comparable extraction attempts against its own models. What distinguishes this latest report, they say, is both the scale, nearly 200 million exchanges, and the breadth, naming five distinct companies rather than a single actor, suggesting the practice has become widespread across the Chinese AI industry rather than isolated to one company.
Key Takeaways
- Anthropic accused five Chinese AI labs of running unauthorized Claude distillation campaigns totalling nearly 190 million exchanges.
- Alibaba's campaign was the largest ever tracked by Anthropic, exceeding 151 million exchanges.
- Some exchanges reportedly involved sensitive data from individuals, multinational companies and state-affiliated actors.
- No mechanism currently exists to prevent capability transfer through API-based distillation, unlike hardware export controls.
FAQ
What is AI distillation?
It is a technique where outputs from a more capable AI model are used to train another model, allowing the second model to replicate some of the first model's capabilities, in this case without authorization from Anthropic.
Which companies did Anthropic name in its report?
Anthropic named Alibaba, Moonshot AI, DeepSeek, Xiaomi and Zhipu as being behind the unauthorized distillation campaigns.
How large was the largest campaign identified?
The Alibaba-linked campaign generated more than 151 million exchanges between May and July 2026, the largest distillation effort Anthropic says it has ever tracked.
Conclusion
Anthropic's disclosure adds a new dimension to the ongoing US-China AI competition, showing that capability transfer can occur through ordinary API access at massive scale, entirely outside the reach of existing hardware-focused export controls. How US policymakers and AI companies respond to this gap is likely to shape the next phase of the broader technology rivalry between the two countries.
