Anthropic Reports Seven Chinese AI Labs Ran Industrial-Scale Claude Distillation Attacks
<!DOCTYPE html>
Anthropic's September 2026 threat intelligence report says seven China-based AI laboratories spent six months harvesting Claude's chain-of-thought reasoning at industrial scale. The largest single campaign, tied to Alibaba, logged 151 million exchanges, and the report shows a coordinated effort to rebuild a rival model on stolen outputs rather than clean training data.
Key Takeaways
- Scale: Seven labs (Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime, MiniMax) ran unauthorized Claude distillation between February and August 2026.
- Largest campaign: GTG-16005, tied to Alibaba, logged 151 million exchanges from May to July 2026, peaking near 3 million per day from 3,500+ fraudulent accounts.
- Methods: Fake account networks, proxy rerouting of customer traffic, targeted chain-of-thought extraction, and secondhand purchase of harvested transcripts.
- Anthropic's fixes: Region and reseller account bans, reasoning that is now summarized before it reaches the API, and "Preserved Thinking" in Fable 5.1 that encrypts internal reasoning from API accounts.
Background
Anthropic published its September 2026 threat intelligence report on September 11, 2026, and it names seven China-based labs that abused access to Claude over a six-month window. The full report is available from Anthropic, and The Hacker News covered the disclosure the same day. The timing is not coincidental: US cybersecurity and intelligence agencies including CISA and the FBI had already been pressing Chinese AI companies over "systematic extraction" of frontier model capabilities, so the report reads less as a first look and more as a vendor corroborating what government agencies had already been saying.
The underlying technique is legitimate. Knowledge distillation is a standard machine-learning method where a smaller "student" model learns from the outputs of a larger "teacher" model. IBM's overview of knowledge distillation and the original 2015 distillation paper describe it as an ordinary training shortcut. What separates the reported activity from standard practice is that these labs distilled a competitor's proprietary model without permission, at scale, through fraudulent accounts and proxy networks. The UK government's own write-up on model distillation frames the legitimate use, which makes the covert version easier to call out.
Attack Details
The campaign targeted Claude's most valuable capabilities: agentic task execution, software engineering, kernel development, and long-horizon reasoning, specifically on the Claude Opus 4.6 and 4.7 tiers. The goal was not to chat with the model but to capture its internal chain-of-thought traces, the step-by-step reasoning that makes a frontier model useful. Those traces are exactly what you feed a student model to reproduce the teacher's behavior, so harvesting them at scale is a direct path to a cheaper copy.
Anthropic's detection caught the activity through behavioral fingerprinting and coordinated-activity analysis across thousands of accounts that shared repetitive prompt structures and identical capability targets. By the time detection fired, the extraction had already been running for months.
Major Campaigns
Each lab ran its own effort under a distinct tracking designation. The report quantifies them by exchange volume and window:
| Campaign | Lab | Window | Exchanges |
|---|---|---|---|
| GTG-16005 | Alibaba | May-Jul 2026 | 151M |
| GTG-16002 | Moonshot | May-Jul 2026 | 23M |
| GTG-16001 | DeepSeek | July 2026 (14 days) | 12.1M |
| GTG-16006 | Zhipu / Z.ai | Jun-Jul 2026 (17 days) | 3.4M |
| GTG-16008 | Xiaomi | Mar-Apr 2026 (20 days) | 400K |
The gap between the top and bottom rows is the story. DeepSeek's 12.1 million in two weeks is a burst, but Alibaba's 151 million over three months, with a daily peak near 3 million, is sustained industrial throughput. That is not a team of researchers; that is a pipeline with thousands of accounts feeding it.
Methods
The report attributes the access and the extraction to five distinct techniques, and each lab leaned on a different mix.
Fake account networks
Thousands of fraudulent accounts, built from stolen credit cards and compromised credentials, carried the core of the extraction. The Alibaba campaign alone launched from 3,500+ such accounts.
Proxy rerouting
Moonshot and DeepSeek quietly redirected their own customers' requests through Claude without the end user knowing, which turned ordinary paid usage into a data tap. MiniMax built a proxy network through a shell company to collect exchanges the same way.
Chain-of-thought harvesting
Zhipu ran a pipeline specifically tuned to extract internal reasoning traces. This is the most technically targeted method: it is designed to capture exactly the step-by-step reasoning that makes a frontier model worth copying.
Secondhand purchase and harness abuse
SenseTime did not run the extraction itself; it bought harvested transcripts from third-party data vendors, which means the supply chain stretches beyond the seven labs into data brokers. Xiaomi, meanwhile, used coding frameworks like OpenClaw and OpenCode to replay conversations from its own MiMo model, reprocessing stored dialogue against Claude.
These techniques are familiar from the broader threat landscape. The account fraud and proxy masking sit next to the kind of supply-chain trickery seen in malicious npm packages that slipped a cross-platform RAT into Alibaba developer tooling, and the value of protecting AI tooling secrets is underlined by the Claude Code and Gemini CI flaws that leaked workflow secrets.
Implications
Anthropic changed three things in direct response. It banned reseller accounts and accounts from unsupported regions, requiring identity verification for access. It updated Claude to summarize its internal reasoning before responding, which lowers the value of any stolen transcript. And it introduced "Preserved Thinking" in Fable 5.1, encrypted reasoning that prevents API accounts from altering system prompts or pre-reasoning messages. The last one is the meaningful change: if a stolen transcript no longer carries the raw reasoning, the distillation target degrades.
The strategic implication is that frontier model access is now an active theft surface, not just a product. A rival can reach a frontier model through proxy networks and fraudulent accounts and use it to train a cheaper copy. That argues for protecting models the way you would protect source code, which is a shift from the "rate limits and terms of service" posture that held up against small attacks. The same pressure is visible in AI-content provenance work such as how Anthropic is watermarking Claude's AI-generated text: once outputs move through an adversary's hands, you need signals that survive the transit.
Conclusion
This is the largest documented case of industrial-scale model distillation, and it reframes what it means to protect a frontier model. The seven labs' campaigns show that the threat is sustained, multi-vector, and fed by a supply chain of fake accounts, proxy networks, and data brokers that reaches past the seven named organizations. Anthropic's fixes target the reasoning layer directly, which is the right layer to defend. The open question is whether summarizing and encrypting internal reasoning is enough, or whether it just moves the attacker to the next model that has not hardened the same way.
FAQ
What is a distillation attack on a language model?
Distillation is a normal training method where a smaller model learns from a larger one's outputs. A "distillation attack" is doing that on a competitor's proprietary model without permission, at industrial scale, so you can reproduce its capabilities without the original company's consent.
Which labs did Anthropic name?
Alibaba, Moonshot, DeepSeek, Zhipu (Z.ai), Xiaomi, SenseTime, and MiniMax. Each ran a separate campaign, with Alibaba's GTG-16005 the largest at 151 million exchanges.
How did they access Claude without paying?
Through thousands of fraudulent accounts built from stolen payment data, proxy networks that rerouted customer traffic, and in one case buying already-harvested transcripts from third-party data vendors.
What did Anthropic change in response?
It banned reseller and unsupported-region accounts, made Claude summarize its internal reasoning before responding, and added "Preserved Thinking" in Fable 5.1, which encrypts reasoning so API accounts cannot alter the system prompt or pre-reasoning messages.
References
- Anthropic, "Countering misuse of AI: September 2026" threat intelligence report
- The Hacker News, "Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks" (Sep 11, 2026)
- IBM Think, "Knowledge distillation"
- Hinton, Vinyals, Dean, "Distilling the Knowledge in a Neural Network" (arXiv, 2015)
- UK Government AI Insights, "Model distillation"
This article was published on TekMag. Report data is as documented in Anthropic's September 2026 threat intelligence report; specific campaign volumes and designations are cited to that source.
Top comments (0)