Anthropic Says Chinese AI Labs Have Been Systematically Stealing Its Model's Brain

Anthropic has published a report this week making a serious allegation: Alibaba, Moonshot AI, and DeepSeek have been running what the company calls distillation campaigns against its Claude models, systematically extracting knowledge from Claude to improve their own AI systems. And Anthropic says these campaigns have escalated significantly in recent months.

Distillation, in this context, is a technique where you use one model's outputs to train another, cheaper or more focused model. It is a legitimate and widely used method in AI development. The controversy here is not the technique itself but the scale and intent: using a competitor's commercial model as an undisclosed training teacher, without authorisation, potentially in violation of terms of service, and with the explicit goal of closing a capability gap.

How Distillation Attacks Work

The mechanics are more sophisticated than simply copying responses. An attacker running a distillation campaign typically creates a large number of accounts, sometimes using automated systems, and runs enormous volumes of carefully crafted queries through the target model. The responses are logged, filtered, and used as training data for a new model. Done at scale, this can transfer a significant portion of a model's reasoning patterns, its factual knowledge retrieval, and its response style into a new model that the attacker controls and can iterate on freely.

Anthroptic's report says the campaigns it identified involved persistent, coordinated access over extended periods, not opportunistic scraping. The company alleges that the entities involved used techniques to avoid detection, including rotating accounts and varying query patterns. This is not a grey-area academic exercise. It describes deliberate, sustained extraction of a commercial AI system's capabilities.

Why This Matters Beyond Corporate Competition

The obvious framing here is a trade dispute between AI companies. But the implications are wider. Claude is used by businesses and governments for sensitive tasks, including legal work, financial analysis, and in some cases national security applications. If its outputs are being systematically harvested and used to train models operated by entities with different governance frameworks and no commitments to the same safety standards, that creates risks that extend well beyond Anthropic's revenue.

The safety angle is the one that does not get enough attention in these stories. Anthropic has invested heavily in alignment research and has built Claude with specific behaviours around refusing harmful requests, being transparent about its limitations, and avoiding certain categories of output. A model distilled from Claude's responses does not inherit those commitments. It inherits the surface-level output patterns without the underlying training process that produced the safety behaviours. The result could be a model that sounds like Claude but acts differently in adversarial conditions.

The Industry-Wide Problem

Anthroptic is not the only company that has faced this. OpenAI alleged similar behaviour from DeepSeek earlier in 2026, citing statistical patterns in DeepSeek's outputs that suggested Claude and GPT-4 lineage. Meta's open models have been used more openly as training material, though Meta has taken a different philosophical position on this given its open release strategy.

What makes Anthropic's report notable is the specificity. Naming Alibaba, Moonshot AI, and DeepSeek directly is a significant escalation. It moves from general concern about model extraction to a formal public accusation with documentation attached. The question now is what happens next. Anthropic has limited legal recourse across jurisdictions, and its terms of service, while clearly violated according to its own analysis, are difficult to enforce against entities operating primarily in China.

For the broader industry, this report is likely to accelerate work on watermarking and fingerprinting model outputs, techniques that would make it easier to detect when a model's training data has been derived from another model's responses. Several research teams are already working on this. Anthropic's public disclosure makes the case for urgency.

This is a genuinely complicated story with geopolitical dimensions that go well beyond the AI industry. But at its core, it is a reminder that the race to build the most capable AI is not always happening within the rules.