Anthropic Alleges Large-Scale Distillation Attacks by Chinese AI Firms
AI-generated image · Bay Street Wire
A new report details efforts to extract chain-of-thought reasoning from Claude to train smaller models, including a massive campaign linked to Alibaba.
Anthropic has released a report alleging that China-based AI companies are conducting persistent and increasingly sophisticated "distillation attacks" to harvest capabilities from U.S. frontier models. According to reporting from TechCrunch, these attacks aim to extract a model's internal chain of thought to train smaller models on general reasoning through supervised fine-tuning.
Anthropic identified five separate campaigns totaling nearly 200 million exchanges. The largest effort was attributed to Alibaba, which TechCrunch reports as the biggest wholesale distillation campaign the company has ever seen. Between May and July 2026, Anthropic observed 151 million exchanges—peaking at nearly three million per day—across 3,500 accounts. These efforts were reportedly intended to produce training material for Alibaba's Qwen family of models.
Other identified campaigns include efforts by Moonshot AI, the manufacturer of Kimi. Anthropic alleges that some Moonshot AI requests appeared to route directly from the Chinese military, including one query asking Claude to analyze surveillance footage for abnormal behavior. Over a 10-day window, Anthropic says nearly 300,000 requests were routed through 5,000 accounts, primarily targeting the Opus model.
To bypass defenses, attackers used techniques to trick the model into revealing thinking traces. In one instance, a query was framed as a translation request asking the model to translate its working memory into katakana-only Japanese. TechCrunch notes that OpenAI has reported similar activity, which it specifically attributed to DeepSeek.