Contents
Training a frontier model from scratch costs hundreds of millions of dollars and years of research. Copying one’s behavior by watching it answer questions costs the price of an API key. That gap is why Anthropic’s latest threat intelligence report matters: it names five China-based AI companies, Alibaba, Moonshot AI, DeepSeek, Xiaomi, and Zhipu, as running large-scale campaigns that funneled Claude’s outputs into their own training pipelines, totaling close to 200 million flagged exchanges. This is the first time a frontier lab has put hard numbers on how much of its own capability is being siphoned off by competitors, and the mechanics behind it say as much about how models get built in 2026 as any new release does.
What illicit distillation actually is
Distillation itself is a legitimate technique, a smaller “student” model learns by matching a larger “teacher” model’s outputs, and every major lab uses it internally to compress capability into cheaper models. What Anthropic is describing is the same idea run without permission and at industrial scale against someone else’s product: route real user traffic to Claude, capture the responses, and replay them as training signal, all while telling nobody it happened.
The campaigns didn’t all use the same playbook. Anthropic’s largest single case, tracked as GTG-16005, attributed more than 151 million Claude interactions between May and July to Alibaba, spread across roughly 3,500 accounts flagged as fraudulent, with daily volume peaking near 3 million requests. Moonshot AI took a quieter route: it silently relayed customer requests for its Kimi models to Claude, then served Claude’s answers back to its own users as if Kimi had generated them, funneling nearly 300,000 requests through more than 5,000 fraudulent accounts in a single ten-day window. DeepSeek ran the same silent-relay pattern, and Zhipu specifically targeted chain-of-thought traces, replaying Claude’s reasoning steps to train its own models on how Claude thinks, not just what it says.
What actually gave these campaigns away was the shape of the traffic, not any single request. No individual API call looks malicious. A distillation campaign only becomes visible in aggregate: request volume from a cluster of accounts far exceeding any plausible individual use, structurally similar prompts fired in bulk to sweep capability areas like agentic coding and multi-step reasoning, and output patterns replayed back through the same or related accounts. That’s a fraud-detection problem wearing an AI-safety costume, and it’s exactly why the response looked like account banning and network mapping rather than a model-side patch.
Try it: what makes traffic look like a distillation campaign
Flip the signals below to see how they combine into the kind of composite score a threat-intel team would use to escalate an account cluster from “high usage” to “investigate.”
Toggle chain-of-thought extraction on with volume and fan-out already checked, roughly Zhipu’s profile, and the score alone is enough to justify a network takedown, before anyone has looked at what the extracted reasoning was used to train.
What I’d watch next
The interesting fork here isn’t whether these five labs stop, it’s whether this becomes routine disclosure. Anthropic quantifying its own exposure sets a precedent other frontier labs will feel pressure to match, and once threat reports become a normal quarterly artifact alongside model cards, distillation defense turns into the same kind of arms race as prompt injection or jailbreak resistance: rate limiting, account verification, and output watermarking racing against ever cheaper ways to harvest a teacher model’s behavior through its API. If you’re running an API-fronted model at any scale, the lesson isn’t about geopolitics, it’s that your abuse-detection pipeline needs the same aggregate-pattern thinking Anthropic just published a case study on.