Anthropic's latest threat report has turned a normally technical machine-learning technique into the center of a much bigger fight over AI competition, access and intellectual property.
The company says it identified and disrupted large-scale campaigns in which several China-based AI labs used Claude's outputs to improve their own models. Anthropic says the activity involved millions of exchanges, fraudulent accounts, third-party routing services and, in several cases, user conversations that were allegedly passed to Claude without users knowing.
That sounds like another case of one AI company accusing competitors of copying its technology. But the underlying issue is more complicated.
AI distillation itself is not a form of cheating. It is a legitimate machine-learning technique used throughout the industry. The controversy is about how the technique is being used, how models are accessed, whether users' data is being redirected without their knowledge, and whether a competitor can systematically extract valuable capabilities from a closed frontier model without authorization.
What Actually Happened With Claude?
Anthropic says its latest investigation identified additional distillation campaigns involving seven China-based AI labs. The company's September 2026 report describes activity involving Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax, although the evidence and activity described for each organization differ.
The most striking case involved Alibaba.
According to Anthropic, operators associated with Alibaba ran a campaign that generated more than 151 million exchanges with Claude between May and July 2026. Anthropic says the campaign peaked at nearly three million exchanges per day and used thousands of fraudulent accounts. The company says the collected reasoning transcripts were used to help train Alibaba's Qwen models.
Anthropic also says Moonshot AI routed more than 23 million exchanges to Claude during the period it examined, while DeepSeek was associated with more than 12.1 million exchanges over 14 days in July. Xiaomi was associated with more than 400,000 requests over a separate period.
These numbers are important, but there is a major qualification: they are Anthropic's findings and attribution, not independently audited measurements published by the accused companies.
The companies named in the report have not publicly accepted Anthropic's characterization of these activities in the sources reviewed for this article.
China's Commerce Ministry has rejected the broader U.S. accusations surrounding AI distillation, calling them unsupported and arguing that distillation is a normal, neutral technique used across the industry.
That disagreement matters because the technical technique and the alleged conduct are two different things.
What Is AI Distillation?
AI distillation is best understood as a teacher-and-student model.
A more capable AI acts as the teacher. Developers give it a large collection of questions or tasks and collect its answers. Those examples can then be used to train another model — the student — to reproduce some of the teacher's useful behavior.
The student does not necessarily receive the teacher's internal model weights.
Instead, it learns from the teacher's outputs.
That can make training considerably more efficient. A smaller model may learn useful reasoning, coding, instruction-following or other capabilities from a stronger model without requiring the same amount of compute or development work.
This is not inherently suspicious.
Anthropic itself explicitly says that distillation is a legitimate training method and that frontier AI developers use it to create smaller or more efficient models.
The controversy begins when the teacher model belongs to another company and the model owner has not authorized the activity.
Normal Distillation vs. the Current Dispute
| Situation | What is happening |
|---|---|
| Legitimate distillation | A developer uses an authorized teacher model to train another model |
| Internal distillation | A company distills its own larger model into a smaller version |
| Normal API use | A customer uses an AI model to perform a task |
| Large-scale output harvesting | Huge volumes of model responses are collected as potential training data |
| Alleged illicit distillation | Anthropic says competitors systematically extracted Claude capabilities without authorization |
The dispute concerns the combination of scale, intent, access methods, authorization and how the resulting data was used.
How Can One AI Model Teach Another?
The basic process is surprisingly simple.
A developer can create many tasks designed to test particular abilities of a powerful model.
The teacher model answers those tasks.
The responses become training examples.
The student model learns from them.
Repeated at enormous scale, this can give the student model access to a very large collection of high-quality examples covering areas such as coding, mathematics, reasoning, tool use and long-horizon tasks.
Anthropic argues that this matters because reasoning capability is not limited to the exact questions used during distillation. Its own research suggests that distilled reasoning capabilities can improve performance across multiple tasks and domains.
That is one reason frontier AI companies increasingly treat their model outputs as something that needs protection.
The valuable asset is not simply the chatbot interface. It is the capability behind the interface.
What Anthropic Says the Chinese AI Labs Did
Anthropic describes several different approaches rather than one universal method.
One involved fraudulent account networks and proxy services used to obtain access to Claude in regions where Anthropic does not offer the service.
Another involved collecting model conversations and feeding them back into training pipelines.
In the cases involving Moonshot and DeepSeek, Anthropic says requests that users believed were being processed by those companies' own models were sometimes routed to Claude instead. The company says those exchanges could then be captured and used for distillation.
That introduces a second issue beyond model copying:
user consent.
If a person believes they are sending confidential information to one AI provider, but the request is silently routed to another provider, the data-handling question becomes much more serious.
Anthropic says some of the conversations it identified contained corporate information, credentials, contact details and other sensitive material. It also says some requests came through third-party model-routing services commonly used by users in the United States and Europe.
Those are Anthropic's findings and interpretations. They should not be treated as a finding by a court or regulator.
But even without resolving the larger geopolitical dispute, the scenario illustrates a genuine privacy problem: users cannot make informed decisions about where their AI data goes if the application does not accurately disclose the model receiving it.
The Alibaba Case Shows Why the Scale Matters
The Alibaba allegation is particularly significant because of its reported size.
Anthropic says Alibaba-associated operators generated more than 151 million exchanges with Claude over roughly three months and targeted capabilities including software engineering, kernel development, agentic tasks and long-horizon work.
This is very different from an engineer occasionally asking another AI model for help during research.
At that scale, the activity begins to look less like ordinary model use and more like the systematic creation of a training dataset.
Anthropic says the harvested reasoning transcripts were converted into supervised fine-tuning data and used to improve Qwen models.
That distinction is central to understanding the controversy.
The argument is not simply:
“Chinese companies used Claude.”
It is:
“A competitor allegedly used a closed frontier model at industrial scale as a source of training data for another model.”
That is a much more consequential claim.
Why Model Distillation Has Become Such a Big Deal
Frontier AI development is expensive.
Companies spend enormous amounts on compute, data, researchers, infrastructure and model training. If another organization can obtain some of the resulting capability through large-scale access to the finished model, the economics of AI development change.
A successful distillation pipeline could potentially reduce:
- Training time
- Compute requirements
- Data-generation costs
- Engineering effort
- The time needed to reproduce particular capabilities
Anthropic says illicit distillation can transfer valuable capabilities at a fraction of the time, computing power and cost required to develop them independently.
That does not mean a distilled model becomes an identical copy.
A model trained from another model's outputs will still have its own architecture, training data, weights and behavior.
But it can potentially narrow the performance gap in specific areas.
That is the strategic concern.
This Is Also an Access-Control Problem
The controversy reveals something important about the modern AI business.
For years, developers have treated APIs as the normal way to distribute AI capability.
A user sends a request.
The model processes it.
The user receives an answer.
But when model outputs themselves become valuable training data, every API call can potentially become part of an extraction strategy.
That gives AI companies a new security problem.
Anthropic says it has responded by using account metadata, behavioral signals and specialized classifiers to detect suspected distillation activity. It has also introduced additional safeguards around reasoning outputs and can require identity verification when it detects potential abuse.
This creates an uncomfortable trade-off.
The more capable a model becomes, the more valuable its outputs become.
But restricting those outputs can also make the service less useful for legitimate developers.
The industry therefore has to solve two problems at once:
Give customers enough access to make the model useful while preventing systematic extraction of its most valuable capabilities.
The Privacy Issue May Be Bigger for Users Than the Model-Copying Fight
The model-security debate is mostly a concern for AI companies.
The data-routing issue can affect ordinary users directly.
Anthropic says it found cases where DeepSeek, Moonshot and Xiaomi routed conversations involving their own users through Claude. The company says some of those exchanges contained sensitive personal, corporate or government-related information.
For users, the practical lesson is straightforward:
Do not assume that the brand name on the interface tells you exactly which model processes your data.
Third-party AI aggregators, model routers, coding tools and applications can place additional services between the user and the underlying model.
That does not make these services inherently unsafe.
But users should know:
- Which company actually processes their prompt
- Whether third-party models are involved
- Whether conversations are stored
- Whether data is used for training
- Whether retention can be disabled
- Whether the application sends data to external providers
This becomes particularly important for source code, credentials, customer information, internal business documents and confidential research.
Is AI Distillation Illegal?
This is where the story becomes more complicated than the headlines suggest.
Distillation itself is not illegal.
It is a standard machine-learning technique.
The legal question depends on how the model is accessed, what agreements apply, whether access was authorized, how data was obtained, and what intellectual-property or other laws may have been violated.
U.S. officials have described the alleged Chinese activity as malicious and targeted. China has rejected those accusations and argues that distillation is a normal industry practice.
There is also an important difference between violating a company's terms of service and committing a form of intellectual-property theft recognized by a court.
Those are not automatically the same thing.
That distinction will matter if AI companies attempt to pursue legal action against organizations accused of large-scale distillation.
It may also explain why the industry debate is increasingly focused on targeted enforcement rather than simply trying to ban distillation as a technique.
This Is Not Only an Anthropic Problem
Anthropic is not the only major AI company concerned about model distillation.
Anthropic's February 2026 disclosure said it had already identified large-scale campaigns involving DeepSeek, Moonshot and MiniMax and more than 16 million exchanges through approximately 24,000 fraudulent accounts.
OpenAI has separately told U.S. lawmakers that it has observed patterns associated with adversarial distillation, including activity linked to Chinese AI providers and attempts to circumvent access restrictions.
Anthropic also says Google has published research on adversarial distillation.
So the underlying issue is broader than China versus Anthropic.
It is becoming a structural problem for any company operating a highly capable closed model.
What This Could Change for AI Users
Users are unlikely to notice a dramatic change overnight, but the industry response could affect how AI services are accessed.
Expect stronger pressure around:
- Identity verification
- Geographic access restrictions
- API monitoring
- Automated abuse detection
- Limits on high-volume querying
- Restrictions around model outputs
- Third-party model routing
- Developer account controls
Anthropic already says it can require identity verification for suspicious access patterns and block accounts associated with unauthorized use.
The downside is obvious: stronger controls can also create friction for legitimate developers.
A researcher working with a large number of model calls can resemble an abusive automated user.
That means future AI providers will have to become better at distinguishing legitimate high-volume usage from systematic capability extraction.
The Bigger AI Competition Is No Longer Just About Building the Best Model
The most interesting part of this story is not the accusation itself.
It is what the accusation reveals about where the AI industry is heading.
For years, the central competition was about who could train the strongest model.
Now another layer is becoming just as important:
Who can protect that capability after releasing it to customers?
A frontier model exposed through an API is no longer sitting safely behind a research lab's walls. Developers can interact with it thousands or millions of times. Its behavior can be studied. Its outputs can become training data. And third-party services can create additional paths between the model and the eventual user.
That makes model security increasingly similar to software security.
The challenge is not simply preventing someone from stealing a model file.
It is preventing the capability itself from being systematically extracted through legitimate-looking interactions.
That is a much harder problem.
And it is unlikely to disappear as models become more capable.
The next phase of the AI race may therefore be measured not only by benchmark scores and training budgets, but by how effectively companies can control access to the capabilities those models already have.
0 Comments
Have a question, feedback, or something to add? Share your thoughts below.