1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:T17d1,

Anthropic published a threat intelligence report on Thursday accusing several China-based AI labs of running sustained, industrial-scale campaigns to copy the reasoning abilities of its Claude models. The company says it counted close to 200 million exchanges tied to five distinct operations, and it named Alibaba, Moonshot AI and DeepSeek as the parties behind the largest of them. A summary of the findings was first reported by TechCrunch.

Key takeaways

Anthropic attributes roughly 200 million Claude exchanges to five separate unauthorized distillation campaigns run between December 2025 and August 2026.
The Alibaba operation alone accounted for more than 151 million exchanges from over 3,500 fraudulent accounts, peaking near three million exchanges a day.
Moonshot AI and DeepSeek allegedly forwarded live customer traffic from their own products to Claude without telling users, then kept the responses as training data.

What an illicit distillation campaign actually looks like

Distillation is a standard technique: a smaller student model learns from a larger teacher model's outputs and inherits much of its behavior at a fraction of the serving cost. What Anthropic describes is the unauthorized version of that process, aimed specifically at the step-by-step reasoning traces that make frontier models good at agentic work.

Anthropic does not normally expose raw chain-of-thought output to users, showing condensed "summarized thinking" blocks instead. According to the report, the campaigns found prompt patterns that coaxed the model into emitting its working memory verbatim. One attacker reframed the request as a translation job, instructing Claude to render its previous working memory into katakana-only Japanese. Harvested traces can then be fed into supervised fine-tuning for a competing model.

The report says the targets were Claude's most commercially valuable capabilities: tool use and agentic behavior, coding and data analysis, and logical reasoning.

Why the Alibaba campaign is the biggest one measured

Anthropic logged more than 151 million exchanges attributed to Alibaba between May and July 2026, traffic that at its peak approached three million exchanges per day. The volume was spread across more than 3,500 accounts the company classifies as fraudulent, but all of them leaned on a single fixed extraction prompt, which is what let Anthropic tie them to one coordinated effort to generate training material for the Qwen model family. The report adds that the same operators used Claude for broader research work, including reinforcement learning and model architecture questions.

Routing paying customers through a rival's model

The Moonshot AI allegation is different in kind. Anthropic says Moonshot quietly relayed some requests meant for its Kimi products to Claude, showed users Claude's answers as though they came from Kimi, and retained the exchanges to train its own systems. In one ten-day window that amounted to nearly 300,000 relayed customer requests, routed through 5,380 accounts based mostly in Singapore and Japan and aimed overwhelmingly at Claude Opus. More than 23 million exchanges were attributed to Moonshot across May to July.

Anthropic reports a similar pattern at DeepSeek, with more than 12 million distillation attacks observed over 14 days in July 2026. CNBC reported that some of the relayed traffic carried sensitive material from individual users, multinational companies and state-affiliated actors, which the report argues is likely inconsistent with privacy law as well as the labs' own terms of service.

What changes for the industry

This is not Anthropic's first public complaint. The company called out specific labs in February, and OpenAI has made comparable claims about DeepSeek. What is new is the scale and the specificity, alongside a claim that the relaying tactic touched real end users who had no idea which model was answering them. The distillation section sits inside a wider misuse report covering seven categories, from cyber operations to surveillance and fraud.

None of the named companies responded to press requests for comment. For Anthropic, the practical question is enforcement: account bans are cheap to route around, and the economics plainly favor the copier. That tension runs through the company's other recent security disclosures, including its decision to release a withheld model to defenders.

FAQ

What is model distillation?

Distillation trains a smaller model on the outputs of a larger one, so the smaller model reproduces much of the teacher's behavior far more cheaply. It is routine when a lab distills its own models. It becomes a dispute when one company harvests a competitor's outputs at scale without permission.

Which companies did Anthropic name?

The report names Alibaba, Moonshot AI and DeepSeek as being behind the largest campaigns, and references several other Chinese AI firms. Anthropic attributes about 200 million exchanges in total to five separate distillation operations.

Did Anthropic say user data was exposed?

Anthropic says some of the relayed exchanges contained sensitive information, including material from individual users, large multinational companies and state-affiliated actors. It says it does not know whether Moonshot told its customers that their requests were being sent to a third-party model.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#model-distillation\",\"item\":\"https://ainewsway.com/tag/model-distillation\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/model-distillation#itemlist\",\"name\":\"#model-distillation Articles\",\"numberOfItems\":1,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/anthropic-names-alibaba-moonshot-and-deepseek-in-200m-exchange-distillation-report-mtw9g3us\",\"name\":\"Anthropic Names Alibaba, Moonshot and DeepSeek in 200M-Exchange Distillation Report\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# model-distillation"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","model-distillation"]}],[["$","$L1e",null,{"articles":[{"id":"17eba3ef-5c0c-45f1-96e2-afe1bd51fbcb","slug":"anthropic-names-alibaba-moonshot-and-deepseek-in-200m-exchange-distillation-report-mtw9g3us","title":"Anthropic Names Alibaba, Moonshot and DeepSeek in 200M-Exchange Distillation Report","subtitle":"A threat intelligence report says rival labs harvested Claude's reasoning traces, and routed their own customers through it","content":"$1f","excerpt":"Anthropic says five campaigns ran nearly 200 million Claude exchanges to copy its reasoning, with Moonshot and DeepSeek relaying live customer traffic.","coverImage":"https://cdn.ainewsway.com/uploads/2026/09/9d06d232-8ff3-4b8f-b925-ba503ccb00dc.webp","coverImageCaption":"Network cabling inside a server rack — Anthropic traced the distillation traffic to thousands of fraudulent API accounts funneling Claude responses abroad.","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-09-11T01:12:22.642Z","viewCount":3,"likeCount":0,"readingTime":5,"isFeatured":false,"isBreakingNews":false,"metaTitle":"Anthropic Details Chinese AI Distillation Campaigns","metaDescription":"Anthropic says Alibaba, Moonshot AI and DeepSeek ran distillation campaigns totaling nearly 200 million Claude exchanges. Here is what the report found.","metaKeywords":["Anthropic distillation report","Claude model distillation","Alibaba Qwen training data","Moonshot AI Kimi","DeepSeek distillation","AI threat intelligence","chain of thought extraction"],"ogImage":null,"aiSummary":"Anthropic's threat intelligence report, published September 10, 2026, attributes nearly 200 million Claude exchanges to five unauthorized distillation campaigns run by China-based AI labs. Alibaba accounted for more than 151 million exchanges, while Moonshot AI and DeepSeek allegedly relayed live customer requests to Claude without telling users. The disclosure sharpens an enforcement problem frontier labs have no clean answer to, since account bans are cheap to evade.","aiTags":[],"sentiment":null,"articleType":"NEWS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-09-11T01:11:23.527Z","updatedAt":"2026-09-15T11:36:37.232Z","contentUpdatedAt":"2026-09-15T11:36:37.231Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"e2b5fffc-de32-42aa-86fe-c75f219d6b4b","name":"AI & Machine Learning","slug":"ai-ml"}],"tags":[{"id":"271605bb-d9d6-40ee-a396-c816dba07c07","name":"Anthropic","slug":"anthropic"},{"id":"7d146f87-ebfe-45c8-91d1-8214f0782462","name":"Claude","slug":"claude"},{"id":"74addb18-d7c7-4ba7-ae4f-1a126b642c5f","name":"Model Distillation","slug":"model-distillation"},{"id":"cf2e9572-0e76-4b82-8b40-69cf7ebc8af5","name":"Alibaba","slug":"alibaba"},{"id":"a29858a6-9ef9-4eb4-a7c1-749ecbd09380","name":"DeepSeek","slug":"deepseek"},{"id":"a73db6d4-a509-47ed-85bc-99a56b8f5db7","name":"China AI","slug":"china-ai"},{"id":"448e3150-2b4b-40d5-b66f-6316c17487ad","name":"AI Safety","slug":"ai-safety"}],"translations":[{"id":"03045745-bc27-4d1c-8201-3ee517a94cb2","language":"ko","title":"Anthropic, 2억 건 규모 증류 보고서에서 Alibaba·Moonshot·DeepSeek 지목","subtitle":"위협 인텔리전스 보고서는 경쟁 연구소들이 Claude의 추론 흔적을 빼냈고, 자사 고객 트래픽까지 Claude로 우회시켰다고 밝혔다","excerpt":"Anthropic은 다섯 갈래 작전이 추론 능력을 베끼려 약 2억 건의 Claude 대화를 소모했고, Moonshot과 DeepSeek은 실제 고객 트래픽까지 넘겼다고 밝혔다.","metaTitle":"Anthropic, 중국 AI 연구소 증류 공작 실태 공개","metaDescription":"Anthropic은 Alibaba, Moonshot AI, DeepSeek이 약 2억 건의 Claude 대화를 동원해 증류 공작을 벌였다고 밝혔다. 보고서가 짚은 내용을 정리했다."},{"id":"7410b39e-3a59-4174-a5a7-b280bc14b041","language":"ja","title":"Anthropic、2億回規模の蒸留リポートでアリババ・Moonshot・DeepSeekを名指し","subtitle":"脅威インテリジェンス報告書は、競合ラボがClaudeの推論過程を抜き取り、自社顧客のリクエストまでClaudeに迂回させていたと指摘しています","excerpt":"Anthropicは、5つの作戦が推論能力を模倣するため約2億回のClaudeとのやり取りを費やし、MoonshotとDeepSeekは実際の顧客リクエストまで中継していたと指摘しました。","metaTitle":"Anthropic、中国AIラボの蒸留活動を詳細に報告","metaDescription":"Anthropicは、アリババ、Moonshot AI、DeepSeekが合計約2億回のClaudeとのやり取りを使って蒸留を行っていたと指摘しました。報告書の中身を整理します。"},{"id":"ba16b515-4c27-43bd-803e-a61b959135f4","language":"zh","title":"Anthropic報告點名阿里巴巴、月之暗面與DeepSeek，涉近2億次蒸餾互動","subtitle":"這份威脅情報報告稱，競爭對手實驗室大量抓取Claude的推理過程，並把自家使用者的請求轉發給Claude","excerpt":"Anthropic稱，五起行動為複製其推理能力消耗了近2億次Claude互動，月之暗面與DeepSeek還把真實客戶流量轉發給了Claude。","metaTitle":"Anthropic詳述中國AI實驗室的蒸餾行動","metaDescription":"Anthropic稱阿里巴巴、月之暗面和DeepSeek開展蒸餾行動，合計約2億次Claude互動。本文梳理這份報告的主要發現。"},{"id":"45535f4c-0f84-4d8c-9b7f-d4f1c796e8d1","language":"es","title":"Anthropic señala a Alibaba, Moonshot y DeepSeek en un informe sobre 200 millones de interacciones","subtitle":"Un informe de inteligencia de amenazas sostiene que laboratorios rivales extrajeron los rastros de razonamiento de Claude y desviaron hacia él las consultas de sus propios clientes","excerpt":"Anthropic afirma que cinco campañas consumieron casi 200 millones de interacciones con Claude para copiar su razonamiento, y que Moonshot y DeepSeek reenviaron tráfico real de clientes.","metaTitle":"Anthropic detalla la destilación de laboratorios chinos","metaDescription":"Anthropic afirma que Alibaba, Moonshot AI y DeepSeek hicieron destilación con casi 200 millones de interacciones con Claude. Esto dice el informe."}],"celebrities":[{"id":"0632936d-a299-490f-b5e5-dfa87ba3eaa0","nameKo":"Anthropic","nameEn":"Anthropic","slug":"anthropic","profileImage":"https://ui-avatars.com/api/?name=Anthropic&size=400&background=84CC16&color=fff&bold=true"},{"id":"6d1d1c33-100a-4031-b41f-3e68f59006cc","nameKo":"알리바바 큐원","nameEn":"Alibaba Qwen","slug":"alibaba-qwen","profileImage":null},{"id":"1829636e-4136-46e9-b226-e1f9e580f7f9","nameKo":"딥시크","nameEn":"DeepSeek","slug":"deepseek","profileImage":null},{"id":"497c3ea2-a3a6-464f-930e-acb3c26831d5","nameKo":"문샷 AI","nameEn":"Moonshot AI","slug":"moonshot-ai","profileImage":null}]}]}],"$L20"]]}]

#model-distillation

Anthropic、2億回規模の蒸留リポートでアリババ・Moonshot・DeepSeekを名指し

ニュースレター購読

#model-distillation

Anthropic、2億回規模の蒸留リポートでアリババ・Moonshot・DeepSeekを名指し