Anthropic Says Chinese AI Firms Ran Huge Distillation Campaigns Against Claude

Anthropic says it has uncovered large-scale efforts by China-based AI companies to extract capabilities from its Claude models, including agent-style behavior, coding skills, data analysis and reasoning. The company said the activity intensified over recent months and involved nearly 200 million exchanges across five campaigns, making this one of the clearest public signs yet of how aggressively frontier model capabilities are being copied and repackaged.

The report, released Thursday, adds fresh pressure to a fast-moving global AI rivalry in which top labs are not only competing to build more capable systems, but also racing to prevent those systems from being mined for training data. Anthropic said the incidents show how quickly unauthorized actors are adapting their methods to get around model safeguards and gather useful outputs for training smaller systems.

What Anthropic says it found

Anthropic’s new disclosure describes what it calls persistent distillation activity targeting Claude, with the company saying the campaigns became more sophisticated over time. According to the report, the attempts were aimed at some of Claude’s most commercially valuable strengths, especially agentic workflows, tool use, coding, data analysis and complex logical reasoning.

In AI, distillation generally refers to using a larger model’s outputs to train a smaller one. The technique is not inherently illicit; it is widely used in legitimate model development. But Anthropic says the campaigns it identified were designed to circumvent defenses and collect model behavior in ways that were not authorized by the company.

Anthropic said it observed nearly 200 million exchanges tied to these efforts, spread across five separate campaigns. That scale matters because it suggests the attempts were not isolated probing exercises but industrialized operations intended to generate training data at volume.

Why the company is concerned

Anthropic argues that the campaigns appear aimed at replicating the model’s strongest capabilities without having to build them from scratch. That is especially important in frontier AI, where the cost of training and refining leading models can run into billions of dollars and require vast compute resources.

For companies competing in this space, the value of stolen output is not just that a rival may learn how a model responds. It is that repeated extraction can help produce a cheaper, smaller system that imitates much of the behavior that makes frontier products commercially useful.

How did the distillation attempts work?

The attacks, as Anthropic describes them, relied on prompt engineering tricks and large-scale query patterns that tried to persuade Claude to reveal information it normally withholds. One key target was the chain of thought, the internal reasoning traces a model may use before producing an answer.

Many leading AI companies do not expose those internal traces directly to users. Anthropic, for example, typically shows summarized thinking instead of a raw reasoning log. But the company says some attackers found ways to manipulate the model into outputting traces directly, giving them more detailed material to use for training.

In one example cited by the company, the attacker re-framed the request as a translation task, asking the model to translate prior working memory into Japanese katakana. Anthropic says this kind of wording was used to sidestep the model’s normal protections and draw out the hidden reasoning.

Why Alibaba stands out in the report

Anthropic said the largest campaign it found was linked to Alibaba and described it as the biggest wholesale distillation effort the company has ever observed. The activity reportedly spanned 151 million exchanges from May through July 2026, with traffic peaking at almost three million exchanges per day.

The exchanges were spread across 3,500 accounts, but Anthropic said a shared fixed prompt tied the activity together. In the company’s view, that pattern suggested a coordinated effort to generate training material for Alibaba’s Qwen family of models rather than unrelated users experimenting individually.

The scale of the operation is notable even in an industry accustomed to massive data collection. Rather than a handful of manual attempts, Anthropic says this was an automated, high-throughput extraction campaign that operated at a level closer to web-scale scraping than ordinary model testing.

What the shared prompt suggests

A common prompt across many accounts can be an important clue for investigators because it links otherwise separate requests to a single operational playbook. In this case, Anthropic said the fixed wording made the traffic look less like random use and more like a deliberate system for manufacturing examples from Claude.

That matters because distillation depends on consistency. The better the attacker can control the shape of the outputs, the more useful the resulting dataset becomes for supervised fine-tuning of another model.

What Anthropic says about Moonshot AI

Anthropic also described a campaign it attributes to Moonshot AI, the company behind the Kimi chatbot. The report says the activity may have been routed directly from the Chinese military, raising the stakes from commercial model competition to possible intelligence or surveillance use.

According to Anthropic, one request asked Claude to review closed-circuit television footage and judge whether a subject was acting abnormally. That is the kind of task that, if repeated and scaled, could point to a desire to use frontier models for surveillance analysis, anomaly detection or operational decision support.

Anthropic said the Moonshot-linked traffic included a request to assess surveillance video for unusual behavior, which the company interpreted as a sign that the target use case extended beyond ordinary consumer chatbot work.

The company said it saw almost 300,000 requests over a 10-day period routed to Claude through a network of 5,000 accounts, with the Opus model being the main target. Even though that is smaller than the Alibaba-linked activity, it is still substantial enough to show coordinated, repeated probing rather than casual use.

How does distillation differ from ordinary model use?

Distillation differs from normal prompting because the goal is not just to get an answer. It is to collect enough high-quality outputs to train another model that behaves similarly. In practice, that means the attacker may send huge numbers of structured prompts, record the outputs and feed them into a separate training pipeline.

Used legitimately, distillation can make AI systems faster, cheaper and easier to deploy. A large model can teach a smaller one how to reason, summarize or follow instructions with less compute. The problem arises when the training material is gathered through unauthorized access, deception or policy evasion.

Anthropic’s concern is not simply that its models are being queried. The company says the campaigns were engineered specifically to collect internal-style reasoning and other sensitive behaviors that would otherwise remain hidden or summarized.

Why chain-of-thought matters so much

Chain-of-thought traces can be valuable because they may reveal how a model arrives at an answer, not just what answer it gives. That can help another system learn patterns of reasoning, decomposition and tool use that are otherwise hard to replicate.

At the same time, exposing those traces can create safety and security problems. If attackers can induce a model to disclose more than intended, they may gain insight into hidden safeguards, model weaknesses or internal instructions.

• Chain-of-thought traces can improve downstream training data.
• They may expose model reasoning strategies not meant for users.
• Attackers can use them to build cheaper competing systems.
• They can also reveal where a model’s protections are weak.

How does this fit into the wider AI rivalry?

The report lands in the middle of a broader race between U.S. and China-based AI firms to produce the most capable models at the lowest practical cost. In that environment, the line between legitimate benchmarking, model testing and unauthorized extraction can become increasingly contested.

Anthropic previously warned in February about distillation attempts and even named specific labs. OpenAI has also raised alarms about similar behavior, saying it linked comparable activity to DeepSeek. Thursday’s report suggests the problem is not fading; it is growing larger, more organized and more strategic.

For frontier labs, that creates a double challenge. They must continue to improve model performance while also designing guardrails that make it harder for others to siphon off useful behavior. The more capable the model becomes, the more valuable its outputs become as training material for rivals.

Why this matters for customers and developers

For everyday users, these revelations may seem distant from the practical experience of using a chatbot. But the implications are direct: the economics of AI competition can affect pricing, access, product differentiation and the pace of new releases.

If rival companies can cheaply imitate a frontier model’s strengths, the incumbents may have less room to monetize their research advantages. That could, in turn, influence how aggressively companies lock down features, limit transparency or alter the way they expose reasoning tools to users.

What are the broader security implications?

The security angle extends well beyond intellectual property theft. Anthropic’s report suggests that frontier models may be attractive not only to commercial competitors but also to actors interested in military, surveillance or other strategic applications.

That is why the report is likely to resonate in policy circles as well as the AI industry. If large-scale extraction of model behavior can happen through ordinary public interfaces, then the attack surface for major AI systems may be much larger than previously assumed.

It also underscores the difficulty of proving intent. A single query can look benign. A large network of accounts using a common prompt can look coordinated. But the line between research, abuse and espionage may still depend on context, scale and attribution.

What happens next?

Anthropic is likely to face pressure to explain how it detected the campaigns, what technical defenses it used and whether it can further harden Claude against similar extraction attempts. The company has not suggested that the problem is solved, only that the latest wave is more advanced than what it saw earlier in the year.

At the same time, rivals will be watching closely. Reports like this can alter product strategy, legal risk calculations and how companies think about exposing model reasoning, tool access and agent features. As models become more capable, the incentive to copy them grows, and so does the need for stronger protections.

For now, Anthropic’s message is that frontier AI has entered a more adversarial phase. The company says the latest campaigns were not casual misuse but sustained attempts to harvest some of Claude’s most valuable capabilities at a scale that suggests serious organizational backing.

That makes the report more than a dispute over one company’s safeguards. It is a signal that the competition around advanced AI is no longer confined to product launches and benchmarks. It also includes covert extraction, defensive engineering and a widening struggle over who gets to capture the value of frontier models.