Anthropic's AI Distillation Report: What It Alleges

Anthropic just published a report accusing several China-based AI labs of using its Claude models to train their own competing systems without permission. It's a serious, detailed set of claims, and it's also a set of claims from one interested party about named rivals, wrapped in real geopolitical tension. This piece lays out what the report alleges, keeps every claim attributed, includes the pushback, and pulls out the one lesson that applies to everyone regardless of who's right.

Key Takeaways

• Anthropic's September 2026 threat report alleges several China-based AI labs used Claude to train competing models without authorization, which it calls illicit distillation.
• Anthropic says it detected roughly 200 million Claude exchanges across about five distillation campaigns, naming Alibaba, DeepSeek, Moonshot AI, and others.
• These are Anthropic's own findings; the named companies did not respond to media requests, and China's government rejected the framing, calling distillation a neutral technique.
• Anthropic also says some labs routed their own users' prompts, including credentials and source code, to Claude through intermediaries without the users' knowledge.
• The lesson that survives the dispute: when you use AI through a reseller, you may not know where your prompt goes, so use official providers and guard your API keys.

What Is AI Distillation, and What Did Anthropic Report?

Anthropic's AI distillation report, published in September 2026, alleges that several China-based AI labs used its Claude models to train competing systems without authorization. Anthropic says it detected roughly 200 million Claude exchanges across about five distillation campaigns, naming companies including Alibaba, DeepSeek, and Moonshot AI. These are Anthropic's own findings; the named companies didn't comment, and China's government rejected the framing. Here is the measured read, including the security lesson that matters most.

Distillation, in plain terms, is teaching one model to imitate a stronger one. The steps are simple:

• Have the strong model answer a huge number of questions.
• Record all of its outputs.
• Use that record as training data for your own model.

It's a standard, legitimate machine-learning technique in general use. So the technique isn't the problem. What Anthropic alleges is a specific, unauthorized version of it. It says the labs did this at massive scale, against its terms of service, through thousands of fraudulent accounts. The goal, per Anthropic, was to copy Claude's most valuable skills, like agentic reasoning and software engineering, on the cheap.

Think of it like hiring an expert to answer millions of questions, writing down every answer, and then using those notes to train your own staff. It's far faster and cheaper than building the expertise yourself. That's the appeal, and, in Anthropic's telling, the abuse.

This is not a small, one-off finding. The report is part of a broader review of Claude misuse from December 2025 to August 2026, running to many pages of documented activity. It spans seven areas: cyber operations, influence operations, surveillance, scams, biological misuse, weapons, and distillation. Distillation is the one area where Anthropic named companies rather than anonymizing them. That's why it drew the most attention, including from major outlets.

How Big Were the Alleged AI Distillation Campaigns?

Large, by Anthropic's account. Here is what it says it found, company by company. Every figure below is Anthropic's, as reported in coverage of its report, not an independently verified fact.

Company (model)	What Anthropic alleges	Figures Anthropic cites
Alibaba (Qwen)	Largest campaign; extracted chain-of-thought reasoning to train Qwen	~151M exchanges, up to ~3M/day, 3,500+ accounts
Moonshot AI (Kimi)	Routed some Kimi user requests to Claude, shown as Kimi's own	~300k in 10 days, 5,000+ accounts, ~23M total
DeepSeek	Large-scale distillation over a short window	~12.1M exchanges in 14 days (July)
Zhipu (Z.ai)	Used fraudulent accounts; said to have shifted to older models	273 accounts
Xiaomi	Replayed MiMo user conversations through Claude	~400k across 1,500+ accounts
SenseTime / MiniMax	Buying Claude transcripts from brokers; a front-company reseller	Not quantified in reporting

The honest read: the scale is the eye-catching part, but the attribution is the hard part. Anthropic ties this activity to companies through account patterns, prompts, and behavior it flagged as fraudulent, which is its own analysis. That doesn't make it wrong, but it does mean these are inferences by an interested party, not confessions or court findings. Treat the specific numbers as Anthropic's evidence, presented by Anthropic.

What Do the Named Companies and China Say?

Very little directly, which is part of why this stays contested. The absence of a rebuttal isn't the same as an admission, and it's worth being precise about what has and hasn't been said.

According to coverage of the report, Alibaba, DeepSeek, Moonshot, and MiniMax did not respond to media requests for comment. So there is, as yet, no public denial or explanation from the companies themselves. Silence isn't a confession, and it isn't a denial either. It just means the accused side of the story hasn't been told yet, and a fair reader should leave room for it.

At the government level, China's Commerce Ministry rejected the U.S. framing. It described distillation as a widely used and neutral technical method. It accused Washington of interfering with normal commercial activity. And it noted that some U.S. companies have also distilled Chinese models. That last point is worth sitting with, because it reframes the story from "one country's misconduct" to "an industry-wide practice now under dispute."

The honest read: hold both of these in mind. Anthropic presents a large, specific body of evidence; the accused parties haven't publicly answered it; and China's government contests the premise that distillation is illicit at all. A neutral reader can conclude the activity likely happened while still noting that "illicit" is Anthropic's characterization, that terms-of-service violations aren't the same as illegality, and that distillation is a technique many labs, in many countries, use.

Is AI Distillation Illegal, or Just Against the Rules?

Mostly the latter, and the distinction matters. Distillation as a method is legitimate and common; the issue Anthropic raises is doing it without authorization and against its terms.

Major AI providers, Anthropic and OpenAI among them, generally prohibit using their model outputs to train competing models. So distilling Claude at scale through fake accounts can breach those terms, and Anthropic's response, banning accounts and tightening detection, is contract and policy enforcement, not a legal verdict. Whether any of this also violates a law is a separate, genuinely unsettled question that this dispute doesn't answer. It's also worth remembering, as China's ministry pointed out, that outrage over distillation is somewhat industry-wide and not one-directional.

The honest read: the cleanest way to describe what happened, if Anthropic's account holds, is "a large-scale terms-of-service violation," not "a crime," and certainly not "a uniquely Chinese behavior." Distillation debates have swirled around several labs on several continents. Keeping that framing avoids turning a real data-governance story into something it hasn't been established to be.

It's also worth noting why enforcement is so hard here. Terms of service are a contract, not a law. A provider can ban accounts and block traffic, which is what Anthropic did. But it can't easily stop a determined party from spinning up new accounts or buying access through a broker. That's the cat-and-mouse the report describes, and it's a big reason the activity reached the scale Anthropic claims before it was cut off. Detection, not prohibition, is the real lever, and detection is never perfect.

The Security Lesson That Actually Matters

Set the geopolitics aside, and there's a concrete lesson here for anyone who uses or builds with AI, and it has nothing to do with which lab did what. It's about where your data actually goes.

The most alarming detail in the report isn't lab-versus-lab copying; it's that some services allegedly routed their own users' prompts to Claude through intermediaries without telling them. Anthropic says those prompts included names, emails, company data, source code, and in some cases working credentials, from hundreds of people across many languages, and that some requests came through middleman services popular with Western developers. The users had no idea their queries were leaving for a third party.

To make the risk concrete, Anthropic cited specific examples of what ended up in these prompts. Read them as the report's illustrations, attributed to Anthropic:

• An engineer at a state-owned enterprise exposed internal source code and passwords that were still valid.
• A worker handling data for a Russian government defense agency, routing through one of the services, exposed login credentials to a government data store.
• In a surveillance case, imagery from many city cameras was submitted to a model to assess whether a specific person was behaving abnormally.

Whatever you make of the geopolitics in those examples, the mechanism is the same and ordinary: sensitive material left the user's control the moment it entered a prompt, and a third party they never chose could see it. That is the part that should change how you work.

That's a supply-chain problem, and it's one you can act on:

• Know where your prompt is processed. If you access a model through a reseller or aggregator, confirm which provider actually runs it and where the data lands, the same diligence we apply in agentic AI security.
• Avoid cheap access from unknown sources. The report describes sellers offering "cheap Claude" that secretly reroutes prompts elsewhere and, in one case, bundled account-stealing malware for the buyer.
• Guard API keys like credentials. In agentic setups, the API key is often the real target; treat it as a secret with tight scope and rotation, as we cover in governing agentic AI at scale.
• Log and review your own data flow. Know what leaves your systems in a prompt, and keep sensitive data, credentials, and source code out of third-party tools you haven't vetted, part of the discipline in AI agent evaluation and security.

The honest read: whatever you conclude about the accusations, the user-protection point stands on its own. Prompts are data, intermediaries are a supply chain, and a supply chain you can't see is a risk you can't manage. That lesson is true no matter whose model is at the other end.

How Van Data Team Thinks About AI Data Governance

We help teams build AI systems where the flow of data is known, controlled, and defensible, so a story like this is a checklist item rather than a scare. That means using vetted providers, keeping credentials and sensitive data out of prompts to untrusted tools, scoping and rotating API keys, and logging what leaves your environment.

In practice, we start with a simple map: for each AI tool a team uses, which provider actually runs it, what data goes into the prompt, and who could see it along the way. Most teams find at least one path they can't fully account for. That path is the risk. Naming it is usually the fastest fix, because it turns an invisible dependency into a decision you can make on purpose, before a report like this one makes it for you.

The distillation dispute between labs will play out in policy and, perhaps, in court, and we take no side in it. For the teams we work with, the takeaway is narrower and more useful: our work on agentic AI security and AI agent runtime design is about making sure you always know where your data is going and who can see it. Own that, and the headlines become someone else's problem.