Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks

Anthropic disrupted covert operations that allegedly used fake accounts and proxy networks to harvest Claude's outputs for training rival models — and separately flagged a suspected Russia-linked espionage campaign.

What Anthropic disclosed

On Thursday, September 11, 2026, Anthropic said it had identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, naming Alibaba, Moonshot, DeepSeek, Z.ai (also known as Zhipu), and MiniMax among the operators involved.[1] Separate reporting on the same disclosure also named Xiaomi as one of the seven.[2]

The company frames this as part of a broader threat-intelligence report. In the same disclosure, Anthropic said it had also disrupted a suspected Russia-linked cyber espionage campaign that used Claude, alongside the distillation activity.[3] The two campaigns are distinct: one involves alleged capability theft by commercial AI labs, the other alleged use of Claude to support state-linked espionage work.

What "illicit distillation" actually means

Knowledge distillation, on its own, is a completely normal and legal machine-learning technique. A large "teacher" model's outputs are used to train a smaller, faster "student" model to mimic its behavior. Plenty of legitimate AI labs do this with their own models.

What Anthropic is describing is different. The company defines illicit distillation as an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization, typically carried out through networks of fake accounts set up with stolen credit cards, login credentials, and API keys.[4] The distinction matters. Training on your own model's outputs is standard practice. Systematically querying someone else's paid API through disguised accounts to copy its behavior is a different thing entirely — both in scale and in how it evades detection.

How the labs allegedly did it

Anthropic described several distinct methods. In one pattern, according to the company, DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and their users into Claude, then used Claude's responses as training data to distill its capabilities.[5] Some of those routed exchanges reportedly included sensitive information — from individual users, multinational companies, and state-affiliated actors.[5]

Anthropic also said unauthorized labs used prompt manipulation tricks to pull specific capabilities out of Claude — things like agentic tool use, coding and data analysis, and multi-step logical reasoning — rather than just generic text generation.[1] One tracked cluster, labeled GTG-16005, reportedly involved 151 million exchanges observed between May and July 2026.[1] Separately, operators linked to Alibaba were described as running what Anthropic called the largest single illicit distillation effort, allegedly aimed at improving Alibaba's Qwen model family.[6]

Why this matters beyond the named companies

Frontier labs elsewhere have raised similar complaints before. Google and OpenAI have both previously called out distillation attempts against their own models, so this isn't a new category of concern — what's notable here is the scale and the specificity of the naming. Anthropic didn't describe this in the abstract; it named five to seven identifiable companies and attached a tracked cluster with an exchange count in the hundreds of millions.

There's also a broader policy backdrop. Earlier the same week, U.S. cybersecurity and intelligence agencies accused China-based AI companies of "systematic extraction" of proprietary capabilities from American frontier models through distillation.[1] Anthropic's disclosure lands in the middle of that debate, and it's reasonable to read the timing as at least partly deliberate — a private company's threat-intel report reinforcing a government allegation made days earlier.

It's worth being precise about what's actually established here versus what's alleged. Anthropic is the source making these claims about its own platform; independent, third-party technical verification of the specific attribution to each named lab (as opposed to Anthropic's internal detection systems) has not been published in the sources reviewed for this article. That doesn't make the claims unlikely to be true — Anthropic has direct visibility into its own API traffic that outside researchers don't — but readers should treat "Anthropic says" and "independently confirmed" as different things.

What this means for defenders and API operators

For teams running commercial AI APIs, the practical takeaways from this disclosure are less about any single company and more about the pattern:

• Fake-account networks funded with stolen payment credentials remain a viable, at-scale way to abuse metered API access.
• Prompt manipulation can be used specifically to extract a model's higher-value capabilities (agentic behavior, tool use, reasoning chains) rather than just bulk text.
• Routing real user conversations through a third-party model — even unintentionally, as part of a product pipeline — can expose those users' data to that third party's logging and detection systems.

Security takeaway

This isn't a vulnerability disclosure in the CVE sense — there's no patch to apply. It's a threat-intelligence report about how commercial AI capabilities are being targeted for extraction, and it's a useful reminder that API abuse detection (fake accounts, proxy traffic, anomalous query patterns) is now squarely a frontier-AI-lab security problem, not just a traditional SaaS one. Whether the named labs respond publicly, and whether independent researchers corroborate the specific attributions, is worth watching in the coming weeks.

Sources & References

• [1] The Hacker News — "Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks" — Sep 11, 2026 — View source
• [2] NTD — "Anthropic Disrupts Russian, Chinese AI Campaigns Targeting Its Claude Models" — Sep 11, 2026 — View source
• [3] Rappler (Reuters) — "Anthropic disrupts Russian, Chinese AI campaigns targeting its Claude models" — Sep 11, 2026 — View source
• [4] NetmanageIT — "Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks" — Sep 11, 2026 — View source
• [5] Nuclear Coffee — "Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks" — Sep 11, 2026 — View source
• [6] NTD (Reuters) — Alibaba/Qwen distillation claim — Sep 11, 2026 — View source