Anthropic Says Seven China-Based Labs Ran “Industrial-Scale” Distillation on Claude

The United States and Anthropic escalated the same fight this week. On September 8, 2026, the National Security Agency, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI published a joint advisory warning that China-based AI companies are running industrial-scale “knowledge distillation” campaigns against American frontier models. Two days later, Anthropic released its September threat-intelligence report, saying it had detected and disrupted distillation attacks from seven labs based in China: Alibaba, Moonshot, DeepSeek, Zhipu (Z.ai), Xiaomi, SenseTime and MiniMax.

Related reading: Anthropic Cuts Live Internet Access for Its Internal Evaluations After Its Agents Broke the Rules · Anthropic's Claude Duet Works in the Background, and Asks Before It Acts.

The two documents describe one playbook from two vantage points, a government warning about a strategic drain on US AI leadership, and a vendor’s forensic account of thousands of fraudulent accounts, proxy “transfer stations” and hundreds of millions of model exchanges. Some of those exchanges, Anthropic says, carried other companies’ trade secrets and governments’ live credentials.

What distillation is, and when it turns illicit

Distillation itself is a legitimate and widely used training technique. A smaller “student” model is trained on the outputs of a larger, more capable “teacher,” which lets developers reach a given capability with less compute and less money. Frontier labs distill their own models all the time.

The dispute is about consent, scale and fraud. Anthropic’s report defines the problem bluntly: “We define illicit distillation as an industrial-scale, covert campaign to extract a model’s capabilities and replicate them in another model without authorization.” In practice, the company says, that means proxy services that create thousands of new accounts using false identities, fake or stolen credit cards and stolen API keys, bypassing the fact that Claude is not sold in mainland China or Hong Kong.

A 151-million-exchange campaign

Anthropic attributes the largest campaign it has ever measured to operators affiliated with Alibaba’s Qwen / Tongyi lab. Between May and July 2026 it observed more than 151 million exchanges with Claude, peaking at nearly 3 million per day from more than 3,500 fraudulent accounts. The target was the chain-of-thought reasoning of Opus 4.6 and 4.7: a fixed prompt forced Claude to write out its reasoning traces inside inline tags, which were then saved and converted into supervised fine-tuning data. Anthropic says that data was used to help train Alibaba’s Qwen 3.5, 3.6 and 3.7 models.

The operation ran through two main pools of accounts, the first nearly 5,000 accounts using residential proxies, disposable email and virtual cards. When Anthropic banned that pool, the traffic shifted to a second. Some of the accounts were also funneling requests for DeepSeek and Xiaomi, evidence that different labs ride the same proxy infrastructure.

Moonshot and DeepSeek served Claude to their own users

The most consequential finding is not bulk scraping but misdirection. Anthropic says Moonshot AI, maker of the Kimi chatbot, silently forwarded customer requests to Claude and displayed Claude’s answers, so users believed they were talking to Kimi. Over one ten-day period, nearly 300,000 requests were relayed, most to Opus, through a network of 5,380 fraudulent accounts that Anthropic says appeared to be located mainly in Singapore and Japan. Anthropic attributed more than 23 million exchanges to Moonshot between May and July.

Moonshot also captured those exchanges and used a “cross-session replay” trick (saving the reference to Claude’s hidden reasoning, starting a new session, and asking Claude to reconstruct the full trace) to harvest reasoning data that Anthropic’s technical controls were meant to protect. The relayed traffic included sensitive material. One user, assessed as likely affiliated with the People’s Liberation Army, loaded a surveillance archive of CCTV footage from hundreds of cameras in Chengdu and asked what it believed was Kimi to analyse whether a target was “behaving abnormally.” An engineer at a Chinese state-owned enterprise exposed internal code and live credentials.

DeepSeek ran a similar relay and extraction pipeline, according to the report. Anthropic counted more than 12.1 million exchanges over 14 days in July 2026 and says relayed requests exposed the internal documentation of a Chinese technology company, live credentials for a database belonging to a Russian defence agency, and work by engineers building a police case-management tool that compares a person’s movements against police records by national ID number. Anthropic says it does not know whether Moonshot or DeepSeek told customers their data was being sent to a third party.

Zhipu, Xiaomi and the reseller economy

Three more campaigns fill out the picture. Zhipu, which brands itself as Z.ai outside China, ran a chain-of-thought extraction and “cleaning” pipeline for its GLM models, rotating through 273 fraudulent accounts in ten days and passing 770,609 exchanges through the cleaner. Anthropic attributed more than 3.4 million exchanges to the effort over 17 days in June and July. Ahead of GLM 5.3, Zhipu also used public vulnerability datasets to build capture-the-flag challenges and launched a distillation attack on the cyber capabilities of another leading US lab, with Claude Opus 4.6 used to grade the answers. When Claude’s Fable model held, Zhipu switched to models it judged to have weaker safeguards.

Xiaomi replayed user conversations and coding sessions from its own MiMo models through Claude, saving the exchanges for supervised and reinforcement learning. Anthropic observed more than 400,000 requests across more than 1,500 accounts over 20 days in March and April 2026. SenseTime bought user transcripts from third-party data vendors and used Claude to write and monitor its pipeline; MiniMax built a proxy network through a shell company that offered only Anthropic and OpenAI models.

Anthropic describes seven labs in total. The five largest campaigns account for close to 200 million exchanges, according to TechCrunch, and about 190 million according to Business Insider.

Washington moves

The US government did not wait for a single vendor’s report. The joint advisory released September 8 names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, says the campaigns have run “since at least late 2024,” and states that “the sheer scale of these campaigns and their sophistication indicate that distillation is not a supplement to these companies’ AI model development, but the critical core of it.” It adds that the activity is “likely with the knowledge of the Chinese government.”

The advisory recommends three immediate steps for US AI companies: detect anomalous prompts, accounts and networks; subtly alter responses to suspected distillers, for example by degrading or diversifying outputs so stolen transcripts are less useful; and share intelligence across model providers, cloud platforms and API aggregators. It maps the tactics to MITRE ATLAS and points to differential privacy and response obfuscation as mitigation.

The backdrop is a policy fight that predates this week. The White House circulated an adversarial-distillation memo in April 2026, and the House Select Committee on China has urged Congress to treat model extraction as industrial espionage under the Economic Espionage Act and the Computer Fraud and Abuse Act. Anthropic made a related case in a June 10 letter to Senators Tim Scott and Elizabeth Warren, describing 28.8 million exchanges through roughly 25,000 fraudulent accounts. China’s foreign ministry told Reuters it was not aware of the Anthropic report, saying AI should be developed for good and that it opposes smears.

What Anthropic changed

Anthropic says it has responded on several fronts. Claude now summarizes its internal reasoning before answering, which makes captured traces less useful as training data. With Fable 5.1 the company added “preserved thinking,” which prevents new API accounts from editing the system prompt, tools or messages that precede a model’s reasoning in a multi-turn conversation, a common trick for coaxing the reasoning back out. It also strengthened classifiers that detect adversarial extraction and now requires identity verification for accounts that appear to operate from unsupported countries such as China, Russia and Iran. Its argument for why this matters is simple: “The robust safeguards that prevent Claude from being misused by bad actors do not transfer when our models are distilled by an unauthorized lab.”

Distillation is not illegal, and “illicit” here is defined by terms of service, fraud and scale, not by a statute. That is precisely why the fight is moving to Congress.

Caveats and what to watch

The account comes almost entirely from one company’s telemetry, and the numbers should be read that way. Anthropic’s attributions rest on its own logs and infrastructure analysis; independent researchers cannot see the underlying data. Alibaba, Moonshot, DeepSeek, Xiaomi and Anthropic did not respond to press requests for comment, and none of the accused labs has confirmed the findings. Distillation is a dual-use technique (the same method powers legitimate smaller models) so calling a campaign “illicit” is a judgment about consent and fraud, not a claim that a specific law was broken.

There is also a credibility dimension Anthropic does not control. It has spent the year pressing Washington for harder rules, and its motives are commercial as well as safety-driven: if its models can be copied cheaply, its pricing power erodes. The company’s own record on data use is not spotless, either, following its 2025 settlement with authors over how it obtained training books.

Four things are worth watching. Whether the US legislation the advisory implies actually moves. Whether other frontier labs corroborate similar campaigns and publish their own numbers. Whether Anthropic’s new safeguards meaningfully raise the cost of extraction, or simply push labs toward new techniques. And whether the user-data exposure (the sensitive sessions that passed silently through third-party relays) becomes its own regulatory and legal problem, both for the Chinese labs and for the middlemen who saved and sold those conversations.

For now, the week’s main takeaway is structural. The export-controls debate has long assumed that keeping advanced chips out of China limits how fast its models can improve. Anthropic’s report is a claim that a meaningful part of that improvement has been coming from American models directly, and that the pipelines involved are now industrial enough to warrant both a government alert and a vendor’s forensic report in the same week.

Cover image: a data centre operated by CERN. Photo by Hugovanmeijeren, via Wikimedia Commons, CC BY-SA 3.0.