Chinese firms used distillation attacks to copy Claude, Anthropic says

‘Attacks at this scale require a coordinated response’

Anthropic has accused three Chinese AI firms of attempting to copy its flagship Claude model through what it describes as large-scale "distillation attacks."

The US-based genAI company says Chinese companies DeepSeek, Moonshot AI and MiniMax generated more than 16 million exchanges with its Claude LLM using around 24,000 fraudulent accounts.

Anthropic said the activity breached its terms of service and regional access restrictions.

The company does not offer commercial access to Claude in China, nor to overseas subsidiaries of Chinese companies, citing security concerns.

Model distillation is an AI training method. It involves using a powerful model to generate outputs that are then used to train a smaller or less capable model.

While the process is common inside organisations, Anthropic warned it can also be misused to "rapidly and inexpensively" replicate advanced capabilities developed by competitors, avoiding the time and expense of building models independently.

OpenAI notably already accused DeepSeek of the exact same thing last year.

Beyond commercial implications, Anthropic says there are potential security risks with distillation.

Illicitly distilled models, it argued, could be stripped of safety guardrails designed to prevent harmful use, such as the development of biological weapons or malicious cyber tools.

Anthropic wrote that foreign labs distilling American AI models could embed "unprotected capabilities" into military, intelligence and surveillance systems, potentially supporting offensive cyberattacks, disinformation efforts and widescale state monitoring.

Millions of queries

According to Anthropic, the three campaigns it tracked pursued different technical goals but followed a similar approach: creating large numbers of fake accounts and using proxy services to access Claude at scale while attempting to evade detection.

The company said the volume, structure and focus of the prompts differed from normal user behaviour and appeared to reflect deliberate capability extraction.

Attribution was based on IP address correlations, request metadata, infrastructure indicators and reports from industry partners.

DeepSeek's operation focused on extracting reasoning capabilities across varied tasks, including rubric-based grading exercises.

In one technique, prompts asked Claude to explain its internal reasoning step by step after providing an answer, generating what is known in AI development as "chain-of-thought" data. The company said this could help train rival systems to mimic advanced reasoning processes.

Moonshot AI, known for its Kimi models, allegedly used hundreds of fraudulent accounts across multiple access routes. Request metadata matched the public profiles of senior Moonshot staff.

In a later stage, Moonshot attempted to reconstruct Claude's reasoning traces more directly.

MiniMax's campaign was said to focus on agentic coding capabilities and tool orchestration. Anthropic said it detected this effort before MiniMax released the model it was training, giving Anthropic "unprecedented visibility" into the lifecycle of a distillation attack.

Anthropic has introduced new safeguards to counter such activity, including systems to detect suspicious API traffic patterns, tools to identify coordinated account behaviour and chain-of-thought extraction attempts, and stronger verification requirements for high-risk accounts such as educational, research and start-up users.

It has also implemented additional product- and model-level protections aimed at reducing misuse. However, the company warned that technical measures alone would not be sufficient.

"No company can solve this alone," Anthropic said.

"Distillation attacks at this scale require a coordinated response across the AI industry, cloud providers, and policymakers," it added.