Anthropic details massive model distillation campaigns by Alibaba and Moonshot AI
A threat intelligence report alleges that Chinese laboratories harvested Claude's core capabilities through 200 million sophisticated prompt exchanges.
Original cover art, generated for this story. THE VISSION does not republish third-party press imagery.
- Anthropic's threat intelligence team identified multiple large-scale campaigns involving nearly 200 million exchanges aimed at harvesting Claude's reasoning and coding capabilities.
- Alibaba allegedly conducted the largest campaign, executing 151 million exchanges across 3,500 accounts to train its Qwen models.
- Moonshot AI ran a campaign of 300,000 requests, including military-linked queries analyzing surveillance footage, primarily targeting Claude Opus.
Anthropic's Threat Intelligence team has published a landmark transparency report disclosing five separate, highly sophisticated 'distillation campaigns' conducted by Chinese artificial intelligence companies to harvest the capabilities of its Claude models. According to the report, malicious actors and rival labs executed nearly 200 million exchanges over an eight-month period, systematically bypassing safety filters to extract the proprietary reasoning, coding, and tool-use capabilities of Claude. The attacks reflect a sharp escalation in unauthorized 'distillation'—where models are used to generate high-quality supervised fine-tuning data to train rival architectures.
The largest campaign detailed in the report was attributed to e-commerce giant Alibaba. Between May and July 2026, Alibaba allegedly conducted 151 million exchanges, peaking at over three million requests per day, across approximately 3,500 distinct accounts. The targeted campaign focused heavily on extracting Claude’s multi-step planning and logical deduction traces to train Alibaba's open-weight Qwen model family. Attackers used complex 'jailbreak' prompts designed to trick the model into outputting its internal 'chain of thought' (CoT) reasoning. In one case, an attacker requested Claude to translate its active working memory into katakana-only Japanese, exposing its raw reasoning traces.
A second, highly sensitive campaign was linked to Moonshot AI, the Chinese unicorn behind the Kimi assistant. Anthropic's report alleges that Moonshot routing servers directed over 300,000 highly targeted requests toward Claude Opus over a ten-day period. Crucially, a subset of these queries was traced back to servers with links to the Chinese military, containing requests for Claude to analyze aerial surveillance and drone footage for 'abnormal behavior.' Other campaigns involved DeepSeek and several unvetted state-backed research institutes, highlighting an organized, industry-wide strategy to use leading U.S. models as 'teachers' to close the capability gap.
This systematic extraction shows that the competitive barrier for frontier models is rapidly eroding. As unauthorized distillation becomes highly automated, raw model intelligence is transforming into a public commons. For U.S. policymakers and security agencies, this report will likely trigger aggressive new restrictions on API access and export controls, as general-purpose commercial endpoints are demonstrated to be active conduits for military-grade capability transfers.
Will the U.S. Department of Commerce implement mandatory hardware-level API screening or entity-list restrictions on foreign developers accessing U.S. frontier model endpoints?
Still open. When the paper finds out, it will say so here and on the open questions page — including if it got this wrong.