Anthropic has disclosed that seven Chinese AI laboratories conducted massive distillation campaigns against Claude, extracting over 151 million conversations between May and July alone to train competing models. The attacks represent a fundamental shift in how AI companies compete, turning the reasoning process that makes Claude powerful into a blueprint for building cheaper alternatives.

What Is AI Model Distillation and Why Does It Matter?

Distillation is a technique where one AI model learns from another by studying its outputs and internal reasoning. In Claude's case, attackers forced the model to expose its "chain-of-thought" reasoning, the step-by-step logic it uses to arrive at answers. These transcripts were then fed into training pipelines for competing models like Alibaba's Qwen and others.

The scale was staggering. Alibaba Group Holding Ltd. ran what Anthropic describes as "the largest distillation attack we have ever measured," peaking at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts. The campaign lasted three months and generated over 151 million stolen conversations.

What makes this attack particularly concerning is that it works. By studying Claude's reasoning patterns, competitors can build models that perform similarly without investing the same computational resources. This inverts the traditional economics of AI development, where the company with the most computing power and data typically wins.

Which Companies Were Targeted and How?

Anthropic identified seven Chinese AI labs involved in distillation campaigns. Beyond Alibaba, the list includes Moonshot AI, DeepSeek Ltd., Xiaomi Corp., Zhipu, SenseTime Group Inc., and MiniMax.

The attack methods varied. Moonshot AI and DeepSeek took a particularly brazen approach: they quietly forwarded their own customers' requests to Claude and saved the responses for training. In one 10-day period, Moonshot relayed almost 300,000 requests from users who believed they were interacting with Kimi, Moonshot's own chatbot. The stolen data included sensitive material, such as surveillance camera footage from Chengdu uploaded by a user Anthropic assessed as likely affiliated with China's People's Liberation Army.

DeepSeek's relay campaign exposed live credentials for a Russian government database linked to the country's Ministry of Defense, demonstrating how these attacks can inadvertently expose classified information.

MiniMax took yet another approach, setting up a proxy service through an undisclosed shell company that sells access exclusively to Anthropic and OpenAI models. This allowed the company to intercept and study Claude's responses at scale.

How Is Anthropic Fighting Back?

Anthropic has implemented several defenses against future distillation attacks. The company now has Claude summarize its internal reasoning before responding to users, making stolen transcripts less useful for training competing models. This change reduces the value of the reasoning data that attackers seek.

Additionally, Anthropic has begun requiring accounts operating from unsupported countries, including China, Russia, and Iran, to verify their identity or lose access to Claude. The company also banned all accounts involved in the distillation campaigns and shared intelligence with authorities and industry partners where appropriate.

Steps Organizations Can Take to Protect Against AI Model Theft

• Monitor API Usage Patterns: Track unusual spikes in API requests or queries that appear designed to extract reasoning patterns rather than solve real problems. Legitimate users typically have predictable usage patterns.
• Implement Identity Verification: Require users to verify their identity and geographic location, especially for high-volume API access. This makes it harder for attackers to operate at scale using fraudulent accounts.
• Limit Output Transparency: Reduce the amount of internal reasoning or intermediate steps exposed in API responses. While transparency can be useful for debugging, it also provides attackers with the data they need for distillation attacks.
• Audit Third-Party Integrations: If your organization uses AI APIs through third-party services or proxies, verify that these intermediaries are not forwarding requests to competing models or storing responses for unauthorized training.

Why This Matters Beyond Anthropic

The distillation campaigns reveal a vulnerability that extends across the entire AI industry. As AI models become more valuable, the incentive to steal their capabilities grows. Unlike traditional software, where source code can be protected through encryption and legal agreements, AI models leak their knowledge through their outputs. Every conversation with Claude, ChatGPT, or any other large language model (LLM) is a potential training sample for competitors.

The attacks also highlight geopolitical tensions in AI development. Chinese companies have a strong incentive to reduce their dependence on American AI models, both for economic reasons and to avoid potential restrictions. Distillation offers a shortcut to building competitive models without licensing agreements or regulatory oversight.

Anthropic's disclosure comes as the company continues to develop more advanced models, including Claude Opus, Sonnet, and Haiku variants, as well as experimental models like Fable and Mythos. The distillation attacks targeted multiple versions of Claude, suggesting that attackers are systematically studying the company's entire product line.

The broader implication is that AI companies will need to rethink how they balance transparency with security. Users benefit from seeing reasoning and explanations, but that same transparency creates opportunities for theft. Finding that balance will be one of the defining challenges for AI companies in the coming years.