On February 23, 2026, Anthropic announced that three external AI laboratories—DeepSeek, Moonshot, and MiniMax—had run industrial-scale campaigns to extract capabilities from Anthropic’s Claude. According to Anthropic, the labs generated roughly 24,000 fraudulent accounts that produced more than 16 million exchanges with Claude, violating the company’s terms of service and regional access restrictions.
What distillation is and why it matters
“Distillation” is a common, legitimate training technique in which a weaker model is trained on the outputs of a stronger one. Frontier AI labs often use it to build smaller or cheaper versions of their models. However, the same method can be abused: competitors can rapidly acquire powerful capabilities from another lab’s model at a fraction of the development time and cost.
Anthropic warns that models produced through illicit distillation are unlikely to retain safety controls and guardrails, creating national-security risks. Those extracted capabilities could be integrated into military, intelligence, or surveillance systems; if distilled models are open-sourced, the risks would spread beyond the control of any single government.
Distillation and export controls
Anthropic argues that distillation attacks undercut the purpose of export controls because they let foreign labs—potentially including entities subject to the Chinese Communist Party—close the competitive gap that export controls are meant to preserve. Anthropic also notes that executing these attacks at scale typically requires access to advanced compute (chips), which reinforces the rationale for restricting exports of such hardware.
What Anthropic found: the three campaigns
Anthropic says the three campaigns followed a similar playbook: they used fraudulent accounts and proxy services to access Claude at scale while evading detection. The volume, structure, and focus of the prompts differed from normal usage and pointed to deliberate capability extraction rather than legitimate use. Attribution relied on IP address correlations, request metadata, infrastructure indicators, and corroboration from industry partners.
DeepSeek
- Scale: over 150,000 exchanges
- Targets: general reasoning across tasks; rubric-based grading to use Claude as a reward model for reinforcement learning; creating censorship-safe alternatives for policy-sensitive queries
DeepSeek generated synchronized traffic across accounts with identical patterns, shared payment methods, and coordinated timing consistent with “load balancing” to increase throughput and evade detection. Prompts often requested Claude to articulate the internal step-by-step reasoning behind a completed answer, effectively producing chain-of-thought training data at scale. Anthropic also observed generation of censorship-safe alternatives for politically sensitive prompts. Request metadata allowed tracing some accounts to specific researchers at the lab.
Moonshot AI (Kimi models)
- Scale: over 3.4 million exchanges
- Targets: agentic reasoning and tool use; coding and data analysis; computer-use agent development; computer vision
Moonshot employed hundreds of fraudulent accounts across multiple access pathways, making the operation harder to detect as a single coordinated campaign. Attribution was supported by request metadata that matched public profiles of Moonshot senior staff. In later phases, Moonshot attempted to extract and reconstruct Claude’s reasoning traces.
MiniMax
- Scale: over 13 million exchanges
- Targets: agentic coding; tool use and orchestration
Anthropic attributed the campaign to MiniMax through request metadata and infrastructure indicators, and confirmed timings against MiniMax’s public product roadmap. The company detected MiniMax’s activity while it was still active and, before MiniMax released a model it was training, observed that when Anthropic released a new model, MiniMax shifted within 24 hours to capture capabilities from the latest system.
How distillers gain access to frontier models
Anthropic notes that it does not offer commercial access to Claude in China, nor to subsidiaries of Chinese companies located outside the country, for national-security reasons. To circumvent such restrictions, labs use commercial proxy services that resell large-scale access to Claude and other frontier models. These proxy services run “hydra cluster” architectures—sprawling networks of fraudulent accounts that distribute traffic across the API and third-party cloud platforms.
Some proxy networks managed more than 20,000 fraudulent accounts simultaneously, and often mixed distillation traffic with unrelated customer requests to complicate detection. Once access is secured, labs run large volumes of carefully crafted prompts aimed at extracting specific capabilities for direct model training or to generate the many unique tasks needed for reinforcement learning. The distinguishing features of a distillation attack are massive volume concentrated on narrow capabilities, highly repetitive prompt structures, and content that directly maps to valuable training signals.
Anthropic’s response
Anthropic says it is investing in multiple defenses to make distillation attacks harder to carry out and easier to detect:
- Detection: developed classifiers and behavioral fingerprinting to spot distillation patterns in API traffic, including detection of chain-of-thought elicitation used to generate reasoning training data, and tools to identify coordinated activity across many accounts.
- Intelligence sharing: sharing technical indicators with other AI labs, cloud providers, and relevant authorities to build a more complete picture of the distillation landscape.
- Access controls: tightened verification for educational accounts, security research programs, and startups—the pathways most commonly exploited to set up fraudulent accounts.
- Countermeasures: developing product-, API- and model-level safeguards to reduce the efficacy of model outputs for illicit distillation while minimizing impact on legitimate customers.
Anthropic stresses that addressing this threat requires coordinated action across the AI industry, cloud providers, and policymakers, and has published the technical evidence to make it available to stakeholders.
