Anthropic just exposed Chinese labs for stealing AI capabilities. There's only one problem.
In May 2025, Anthropic published a remarkable document.
It detailed how three Chinese AI labs — DeepSeek, Moonshot, and Minimax — had run a coordinated industrial-scale operation to steal Claude's capabilities. 16 million automated conversations. 24,000 fake accounts. Hydra networks of proxies designed to evade detection. Minimax pivoted their entire operation within 24 hours of a new Claude release to capture the latest capabilities before anyone could stop them.
The language Anthropic used was unambiguous. Theft. Espionage. National security threat. Foreign adversaries closing the competitive gap through extraction rather than innovation.
It is a compelling story. It is also, in a way that nobody in the AI industry seems willing to say plainly, deeply ironic.
Because Anthropic built Claude on a foundation that millions of creators argue was taken without their consent or compensation.
They just took it from humans.
The Foundation Nobody Talks About
To understand what's happening now, you have to understand how the frontier models were built in the first place.
OpenAI, Anthropic, Google — the companies now positioning themselves as the responsible guardians of transformative AI capabilities — trained their foundational models on the largest act of intellectual property appropriation in human history.
Books. Millions of them, ingested without permission or payment. The work of living authors scraped from Library Genesis, from Z-Library, from every dark corner of the internet where copyrighted text had accumulated.
News articles. Decades of journalism from outlets that are now fighting for survival, their most valuable asset — their archive, their voice, their institutional knowledge — consumed wholesale to make models smarter.
Code. Every public GitHub repository, billions of lines written by developers who thought they were contributing to open-source community, not training a commercial product worth hundreds of billions of dollars.
Creative work. Fiction, poetry, screenplays, lyrics, visual art descriptions — the output of human creative lives, taken without consent, without credit, without compensation.
The legal framing the labs hid behind was "fair use for transformative purposes." Courts are still deciding whether that holds — and to be precise, no court has yet issued a final ruling that training on copyrighted material without a license constitutes theft in the legal sense. The outcomes of these cases will define the rules for an entire industry. But litigation is active and widespread: The New York Times is suing OpenAI. The Authors Guild filed a class action. Visual artists organized against Stability AI and Midjourney. Thousands of creators whose work formed the foundation of the AI economy never saw a dollar.
The labs called it training data. The creators called it theft.
And the labs kept going.
The Pressure Gradient Runs Both Ways
The video that Anthropic's disclosure sparked a thousand reactions to makes a compelling argument about distillation economics. When one side has capabilities worth potentially trillions of dollars and the other side can extract them for thousands, the information moves. Always. The same force that makes water flow downhill.
A 1,000-to-1 return on extraction. That's the math Minimax was running when they pointed 13 million conversations at Claude's agentic reasoning capabilities.
It's a clean argument. It's also the exact same argument that justified training on the internet.
The cost of generating intelligence — human creative work, decades of writing, coding, thinking, making — is astronomically higher than the cost of ingesting it. A novelist spends three years writing a book. A model ingests it in milliseconds. The economics are overwhelming. The information moves.
The difference Anthropic draws is legal and technical. They own the model weights. Claude's outputs are their intellectual property. Extracting those outputs to train a competitor model violates their terms of service and potentially intellectual property law.
But the weights themselves — the thing they're protecting — were built on a foundation that the creative class never consented to contribute.
The hierarchy of appropriation that nobody wants to name:
Layer 1: Human creators had their life's work taken to build frontier models. The labs called this training.
Layer 2: Frontier models now have their outputs taken to build distilled models. Anthropic calls this espionage.
The distinction is real in law. In moral logic, it is considerably harder to defend.
The National Security Frame
Anthropic's disclosure didn't present what happened as an economic dispute or a copyright violation. It presented it as a national security threat.
Foreign adversaries. The Chinese Communist Party. Military and surveillance applications. Closing the competitive gap.
This framing was deliberate, and it serves specific interests.
Anthropic has consistently supported export controls on AI capabilities. They want to demonstrate that those controls are working — that the apparently rapid progress of Chinese labs depends on stolen American capabilities rather than independent innovation. The national security frame advances a policy agenda that benefits Anthropic directly: tighter restrictions on who can access frontier AI capabilities, and more deference to the companies who hold them.
There is something worth examining in the specific details of what DeepSeek targeted. Their operation focused on Claude's reasoning capability across 150,000 exchanges, generating chain-of-thought training data at scale. Their prompts asked Claude to articulate the internal reasoning behind completed responses — effectively manufacturing the reasoning traces needed to train a competitor model.
One of their most revealing techniques had nothing to do with military applications. They used Claude to generate censorship-safe alternatives to politically sensitive queries — training data designed to help DeepSeek's own models steer conversations away from topics the Chinese government doesn't want discussed.
That is troubling on its own terms. The geopolitical dynamic is real. The surveillance state applications are real.
But the national security frame also does something else. It constructs a narrative where American AI companies are the responsible guardians of dangerous capabilities and Chinese labs are reckless proliferators. It obscures the degree to which the underlying economic force — the staggering ROI of acquiring frontier capabilities through extraction rather than development — applies universally. To every lab that isn't a hyperscaler. To every startup that can't afford a billion-dollar training run. To academic researchers, government contractors, open-source projects.
To everyone.
The Open Weights Question
Anthropic's position on open-weight models has been consistent and worth examining in this light.
They oppose them. Not explicitly, not always in those words, but structurally and in practice. Their arguments center on safety — open weights mean anyone can fine-tune away safety guardrails, deploy capabilities without oversight, accelerate the timeline to dangerous AI.
These are real concerns. The safety arguments are not entirely without merit.
But open weights also mean that the capabilities built substantially on the work of millions of uncredited human creators become accessible to the humans who couldn't afford to pay for training runs. Open weights mean that the value extracted from the global creative commons gets returned to the commons in some form.
Anthropic's opposition to open weights, framed through safety, also happens to protect their commercial position. A world where powerful open models are freely available is a world where Anthropic's API pricing faces existential competition. A world where Anthropic controls access to frontier capabilities behind an API is a world where they can enforce terms of service, detect extraction operations, and maintain the 1,000-to-1 economic advantage on the right side of the gradient.
Meta, whose Llama models are the primary counterargument to closed-weight dominance, built its AI capability substantially through talent acquisition — recruiting researchers from Google, Anthropic, and OpenAI with nine-figure packages. When Llama 4 underperformed, Zuckerberg went shopping for people who'd already done the hard work elsewhere. Talent acquisition is not distillation, but it operates on the same principle. The knowledge walks out in someone's head instead of flowing through an API. The economic dynamic is identical.
Everyone is acquiring intelligence they didn't fully develop. The question is only the mechanism and the legality.
What Distillation Actually Does
Set aside the ethics for a moment and look at the technical reality, because it matters for anyone building on these models.
Distillation does not produce a copy of the original model. It produces a compression. Like a lossy MP3 — smaller, cheaper, good enough for most use cases, but missing things you can't hear until you need them.
A frontier model trained from scratch occupies a high-dimensional capability space. It can reason across domains, use tools in novel combinations, maintain coherence across long autonomous workflows, recover from unexpected failures. It has what you might call a wide manifold — broad surface area across many kinds of tasks.
A distilled model is trained on a subset of the frontier model's outputs. It learns to reproduce specific behaviors — the ones the distiller chose to capture. It performs well on those behaviors and falls off steeply outside that distribution.
This is the brittleness problem, and it's critically undermeasured.
DeepSeek's model scores well on reasoning benchmarks because the operation targeted reasoning capabilities at scale. But the resulting model learned to produce outputs that look like Claude's outputs on reasoning tasks. It did not learn the underlying representational structure that allows generalization across task types, recovery from unexpected failures, or sustained coherence across extended autonomous workflows.
For a chat application or a well-defined coding task, the distilled model might be 90% as capable for 15% of the cost. A reasonable tradeoff.
For a week-long autonomous coding sprint across six repositories — the kind of agentic work where AI value is increasingly concentrated — the distilled model might be 40% as effective. And that failure won't show up on a benchmark. It will show up at 3am on a Thursday when the agent has been running for nine hours and encounters something outside its training distribution.
The provenance of a model is not just an ethical question. It is a capability question. Where the weights come from determines how the model breaks.
The Circle
Here is what the full picture looks like when you step back far enough to see it.
The creative class produced the training data that made frontier AI possible. They were not compensated. They were not consulted. Their work was taken because the economics were overwhelming and the legal framework hadn't caught up.
The frontier models, built on that foundation, became extraordinarily valuable. So valuable that every actor who couldn't afford to replicate the training run had a structural incentive to extract what they could through other means.
Chinese labs extracted it through API distillation. Other labs extracted it through talent acquisition. Researchers extracted it through fine-tuning on outputs. The economics were overwhelming and the legal framework hadn't fully caught up.
Anthropic, whose own foundation rests on the uncompensated work of millions of human creators, now frames what the Chinese labs did as theft. Espionage. A national security threat.
They are not wrong that what DeepSeek, Moonshot, and Minimax did was a violation. The terms were clear. The methods were deceptive. The operational sophistication — 24,000 fake accounts, Hydra networks, 24-hour pivots on new model releases — goes well beyond ambiguous gray areas.
But the moral authority to stand in outrage at extraction depends on clean hands. And the hands that built these models are not clean.
The music industry went through this. They fought Napster with everything they had, and they were right that copyright violations were happening at scale. They were also an industry that had spent decades extracting value from artists on predatory contracts, controlling distribution to capture margins that belonged to creators, and using copyright as a weapon against fans while using it as a shield against accountability.
They were the victim and the villain simultaneously. The framing they chose — piracy is theft, we are the victims — was technically accurate and strategically self-serving.
Anthropic is making the same move.
These people are doing exactly what was done to the humans who built their foundation.
Just with better lawyers, better PR, and a national security frame that makes it easier not to notice.
What To Do With This
None of this means the distillation operations were acceptable. They weren't.
None of this means the capability risks from adversarial AI extraction are imaginary. They're real.
And none of this means Anthropic's safety work is cynical cover for commercial interests. The people building safety infrastructure at these labs are mostly doing it because they believe it matters.
But if you're building on these models — if you're making decisions about which AI capabilities to trust, which vendors to rely on, which platforms to build on — you need the full picture.
The floor is rising. Even distilled models handle routine tasks passably now, and that floor will keep rising. What matters for differentiation is the ceiling — the sustained agentic capability that requires genuine representational depth, not borrowed manifold.
That ceiling currently lives at the frontier hyperscalers. Not because their benchmarks say so, but because genuine frontier training produces the generality that agentic work demands.
But as you make that choice, consider who built what on whose foundation. Consider what it means that the same economic force that drove the original training data extraction is now driving API-based distillation. Consider whether the companies positioning themselves as responsible guardians of dangerous capabilities are the right people to define what responsible guardianship looks like.
The pressure gradient doesn't care about your sympathies. The information moves. It always moves.
The only question worth asking is who's on which side of it, and whether the side they're claiming to be on is the side they're actually on.
Jason Brashear is a senior software developer and AI systems architect with 30 years of experience. He is the creator of ArgentOS, an intent-native multi-agent operating system, and a partner at Titanium Computing. He writes about the intersection of AI architecture, organizational design, and the harder truths the industry would prefer not to discuss.
GitHub: webdevtodayjason
Top comments (0)