# Anthropic says Chinese AI labs have been systematically stealing its model's brain

> Anthropic has published a report this week alleging that Alibaba, Moonshot AI and DeepSeek ran coordinated distillation campaigns against its Claude models, systematically extracting knowledge from Claude to improve their own AI systems.

- Published: 2026-09-11
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/anthropic-chinese-ai-distillation-attacks/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- Anthropic directly named Alibaba, Moonshot AI, and DeepSeek as entities running distillation campaigns against Claude
- The campaigns involved persistent, coordinated access with rotating accounts to avoid detection
- Distilled models inherit Claude's output patterns but not its safety training commitments
- Anthropic has limited legal recourse across international jurisdictions

## Article

Anthropic has published a report this week alleging that Alibaba, Moonshot AI and DeepSeek ran coordinated distillation campaigns against its Claude models, systematically extracting knowledge from Claude to improve their own AI systems. The company says the campaigns have escalated significantly in recent months. The report was covered by TechCrunch on 10 September 2026.

Distillation is a technique where the outputs of one model are used to train another, cheaper or more focused model. It is a legitimate and widely used method in AI development. The controversy here is not the technique itself but the scale and intent: using a competitor's commercial model as an undisclosed training teacher, without authorisation, potentially in violation of its terms of service, and with the explicit goal of closing a capability gap.

## What did Anthropic actually allege?

Anthropic directly named three organisations: Alibaba, Moonshot AI and DeepSeek. It says each ran distillation campaigns against Claude, and that the access was persistent and coordinated rather than opportunistic scraping.

The company alleges the entities used techniques to avoid detection, including rotating accounts and varying query patterns. That is not a grey-area academic exercise. It describes deliberate, sustained extraction of a commercial AI system's capabilities.

| Detail | What Anthropic's report says |
|---|---|
| Organisations named | Alibaba, Moonshot AI, DeepSeek |
| Target | Claude models |
| Method | Large volumes of crafted queries, logged and reused as training data |
| Evasion | Rotating accounts and varying query patterns |
| Pattern of access | Persistent and coordinated over extended periods |
| Trend | Escalating significantly in recent months |

## How do distillation attacks work?

The mechanics are more sophisticated than simply copying responses. An attacker typically creates a large number of accounts, sometimes using automated systems, and runs enormous volumes of carefully crafted queries through the target model. The responses are logged, filtered and used as training data for a new model.

Done at scale, this can transfer a significant portion of a model's reasoning patterns, its factual knowledge retrieval and its response style into a model that the attacker controls and can iterate on freely. The attacker skips the expensive part, which is the original research, data collection and training run.

The crafted queries matter. Rather than asking everyday questions, an attacker designs prompts to cover the tasks they want the new model to master, so that each answer is useful training material. Rotating accounts and varying the wording of queries make the traffic look like many unrelated customers instead of one organised effort.

## Why does this matter beyond corporate competition?

The obvious framing is a trade dispute between AI companies. The implications are wider. Claude is used by businesses and governments for sensitive tasks, including legal work, financial analysis and, in some cases, national security applications. If its outputs are being harvested and used to train models operated by entities with different governance frameworks and no commitment to the same safety standards, that creates risks that extend well beyond Anthropic's revenue.

The safety angle is the one that gets the least attention in these stories. Anthropic has invested heavily in alignment research and built Claude with specific behaviours: refusing harmful requests, being transparent about its limitations and avoiding certain categories of output.

A model distilled from Claude's responses does not inherit those commitments. It inherits the surface-level output patterns without the underlying training process that produced the safety behaviours. The result could be a model that sounds like Claude but acts differently in adversarial conditions.

## Is this the first time a lab has made this accusation?

No. OpenAI alleged similar behaviour from DeepSeek earlier in 2026, citing statistical patterns in DeepSeek's outputs that suggested Claude and GPT-4 lineage. Meta's open models have been used more openly as training material, though Meta has taken a different philosophical position given its open release strategy.

Alibaba is already a sensitive name in Claude's story. The company has banned employees from using Claude Code, which [Future Technology covered in its report on Alibaba's Claude Code ban](/alibaba-bans-employees-claude-code/). Anthropic's new allegations add a second layer to that relationship.

What makes this report notable is the specificity. Naming Alibaba, Moonshot AI and DeepSeek directly is a significant escalation. It moves from general concern about model extraction to a formal public accusation with documentation attached.

## What can Anthropic do about it?

Technical defences are the first line. Anthropic has been tightening who can use Claude, and [its biometric ID checks for Claude](/anthropic-biometric-id-verification-claude-july-2026/) make it harder to spin up large numbers of throwaway accounts, which is exactly the tactic the report describes.

Legal options are weaker. Anthropic has limited legal recourse across jurisdictions, and its terms of service, while clearly violated according to its own analysis, are difficult to enforce against entities operating primarily in China. A contract breach is hard to pursue when the other party sits outside the courts that would hear the case.

## What does this mean for everyday users?

Most people will never see a distillation campaign directly. The effect shows up indirectly, in which AI tools are available and how they behave. A model trained on another lab's outputs can arrive quickly and cheaply, which puts pressure on the prices and release schedules of the labs that paid for the original research.

It also raises a trust question. If you use an assistant built on a distilled model, you may be relying on something that copies the tone and confidence of a carefully trained system without the checks that shaped it. That is hard to see from the outside, because the answers can look equally polished.

For businesses choosing an AI supplier, the report is a prompt to ask where a model's training data came from and what safety testing sits behind it.

## What happens next for the industry?

For the broader industry, this report is likely to accelerate work on watermarking and fingerprinting model outputs, techniques that would make it easier to detect when a model's training data has been derived from another model's responses. Several research teams are already working on this. Anthropic's public disclosure makes the case for urgency, and it has already moved in that direction with its plan to [watermark all text generated by Claude](/article/anthropic-claude-text-watermark/).

Watermarking would not stop extraction, but it could provide evidence. If a rival's model reproduces a hidden statistical signature, a lab would have something concrete to put in front of a regulator or a court, rather than relying on resemblance in style.

This is a genuinely complicated story with geopolitical dimensions that go well beyond the AI industry. At its core, it is a reminder that the race to build the most capable AI is not always happening within the rules. Readers should treat the claims as Anthropic's allegations, based on its own analysis, rather than findings tested in a court.

## Key takeaways

- Anthropic directly named Alibaba, Moonshot AI and DeepSeek as entities running distillation campaigns against its Claude models.
- The campaigns involved persistent, coordinated access with rotating accounts and varied query patterns to avoid detection.
- Distilled models inherit Claude's output patterns but not the safety training commitments behind them.
- Anthropic has limited legal recourse across international jurisdictions, so watermarking and fingerprinting of outputs are likely to gain urgency.

## Sources

- [TechCrunch](https://techcrunch.com/2026/09/10/anthropic-details-distillation-campaigns-from-alibaba-moonshot-ai-and-deepseek/)
- [cnbc.com](https://www.cnbc.com/2026/09/11/chinese-ai-labs-moonshot-deepseek-alibaba-anthropic.html)