Anthropic says China-based AI companies carried out increasingly sophisticated attempts to extract Claude’s reasoning and other capabilities for use in training their own models. In its September 2026 threat intelligence report, the company detailed five distillation campaigns involving nearly 200 million exchanges and targeting capabilities including coding, data analysis, tool use and logical reasoning.
Anthropic said it has detected and disrupted such campaigns since February 2026 and attributed them with high confidence to specific China-based labs. The company had raised similar concerns earlier this year, when it accused several Chinese AI labs of mining Claude’s capabilities, while OpenAI has separately accused DeepSeek of distillation activity.
Alibaba Campaign Accounted for Most Exchanges
Anthropic attributed the largest campaign to operators affiliated with Alibaba and its Qwen research efforts. The company said it observed more than 151 million exchanges between May and July, peaking at nearly 3 million per day across more than 3,500 fraudulent accounts.
According to Anthropic, the campaign used fixed prompts designed to make Claude reveal reasoning traces before giving its final answers. Those transcripts were then converted into training data that Anthropic alleges was used to improve Qwen 3.5, 3.6 and 3.7.
Distillation generally involves training one AI model using outputs produced by another, often more capable model. Anthropic normally limits access to Claude’s raw reasoning and instead exposes controlled thinking information through its Claude thinking system.
The report says some attackers tested thousands of prompts to find ways around those safeguards. One technique disguised a reasoning-extraction request as a translation task, asking Claude to convert its previous working memory into Japanese katakana.
Moonshot Allegedly Routed Customer Requests Through Claude
Anthropic also attributed more than 23 million exchanges between May and July to Moonshot AI, which develops the Kimi models. During one 10-day period, Anthropic said Moonshot routed almost 300,000 customer requests through Claude using 5,380 fraudulent accounts, with most requests sent to its Opus models.
Anthropic alleges Moonshot displayed Claude’s responses to people who believed they were using Kimi, while saving some exchanges for model training. It also said Moonshot found a way to reconstruct reasoning traces from Claude’s thinking signatures through cross-session replay attacks.
Some forwarded requests contained sensitive customer information, according to Anthropic. One user the company assessed as likely affiliated with China’s People’s Liberation Army submitted CCTV footage from hundreds of cameras in Chengdu and asked the system to determine whether a monitored individual was behaving abnormally.
Anthropic also attributed distillation activity to DeepSeek, Zhipu and Xiaomi. The company said the five campaigns collectively used methods ranging from fraudulent accounts and proxy networks to replaying customer conversations through Claude, sometimes without those users knowing their requests had been forwarded to another AI provider.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.