Anthropic Accuses Chinese AI Labs of Massive "Distillation Attacks" to Siphon Claude’s Intelligence

Anthropic has sounded the alarm on a sophisticated, industrial-scale campaign by prominent Chinese AI labs, including DeepSeek, Moonshot, and MiniMax to illicitly extract the core capabilities of its "Claude" models.

According to a report released on February 23, 2026, these labs allegedly deployed a "hydra" network of approximately 24,000 fraudulent accounts to generate over 16 million exchanges. The goal? To "distill" Claude’s advanced reasoning and coding powers into their own models at a fraction of the original development cost.

What Is a "Distillation Attack"?

In AI development, distillation is the process of training a smaller, more efficient model (the "student") using the outputs of a larger, more powerful one (the "teacher"). While labs often distill their own models to save customers money, a "distillation attack" happens when a competitor effectively "kidnaps" the teacher.

By prompting Claude millions of times and analyzing its step-by-step logic, these labs can reverse-engineer the high-level reasoning and "internal thought" patterns that Anthropic spent billions of dollars to develop.

The Major Players and Their Targets

Anthropic identified three specific campaigns with "high confidence" through metadata and IP correlation:

• DeepSeek: Targeted "Chain-of-Thought" data, asking Claude to explain its internal reasoning. They also used Claude to generate "censorship-safe" versions of politically sensitive queries to train their own models on how to steer conversations away from taboo topics.
• Moonshot AI (Kimi): Focused on agentic reasoning and "computer-use" capabilities. Metadata from the attack reportedly matched the public profiles of senior Moonshot staff.
• MiniMax: The largest operation, with 13 million exchanges. When Anthropic released a new model, MiniMax shifted half its traffic to the new system within 24 hours to begin extracting its updated capabilities immediately.

A National Security Blind Spot

The implications go far beyond corporate IP theft. Anthropic warns that illicitly distilled models bypass the rigorous safety safeguards built into American AI.

"Models built through illicit distillation are unlikely to retain those safeguards," the company stated. This means high-level capabilities—such as assistance in cyber warfare or bioweapon development—could proliferate without the "brakes" that Anthropic installs, potentially being integrated into foreign military and surveillance systems.

Breaking the "Export Control" Narrative

The report also challenges the idea that Chinese AI labs are rapidly innovating past U.S. export controls on chips. Anthropic argues that these labs’ "breakthroughs" are, in many cases, actually stolen capabilities extracted from American models. This reinforces the need for strict chip controls, as high-scale distillation itself requires massive computing power.