# Chinese AI Labs Were Quietly Milking Claude for Its Brain. Anthropic Just Named Names.
Knowledge distillation is supposed to be a training trick. Seven Chinese AI labs turned it into something closer to a heist.
Anthropic disclosed Thursday that it identified and disrupted what it calls "industrial-scale illicit distillation attacks" against Claude — coordinated operations where external actors systematically query a frontier model to extract knowledge and use those outputs to train their own competing systems. Among those named: Alibaba, Moonshot AI, DeepSeek, Z.ai (also known as Zhipu), and MiniMax.
The disclosure is significant not just for what it reveals about the specific actors, but for what it confirms about a threat the AI industry has been whispering about for over a year.
## What Distillation Actually Means — and Why "Illicit" Is Doing Heavy Lifting Here
In its legitimate form, knowledge distillation is mundane ML engineering. A large "teacher" model generates outputs — predictions, embeddings, probability distributions — and a smaller "student" model trains to mimic those outputs rather than learning from scratch on raw data. The result is a smaller, faster, cheaper model that punches above its weight.
OpenAI has used it. Google has used it. Anthropic has used it. Everyone has used it.
The line between legitimate use and theft is, technically, a terms of service violation. Anthropic's usage policies prohibit using Claude's outputs to train competing AI models. What the seven labs allegedly did was use Claude's API — at industrial scale, meaning millions of queries, not casual exploration — specifically to generate training data that would flow into their own model development pipelines.
That's not a gray area. That's a deliberate, systematic program to extract Anthropic's competitive advantage without paying for the R&D that created it.
## The DeepSeek Thread
This story doesn't arrive in a vacuum. DeepSeek was already under scrutiny earlier this year after researchers noticed striking similarities between DeepSeek-R1's chain-of-thought patterns and OpenAI's o1. OpenAI confirmed it was investigating. That investigation's findings were never fully made public — but the suspicion was enough to rattle the AI industry and briefly make "distillation attack" part of mainstream tech vocabulary.
Now Anthropic is putting names to what previously existed only as suspicion. And the list includes DeepSeek again.
The inclusion of Alibaba is notable for different reasons. Alibaba's Qwen series has made serious competitive inroads, particularly at the open-weights tier where Qwen models have consistently impressed benchmark observers. If Alibaba was supplementing its training pipeline with Claude outputs, that would be a meaningful advantage — Anthropic's Constitutional AI methodology and RLHF-refined reasoning capabilities don't come cheap to replicate organically.
MiniMax and Moonshot AI are less globally prominent but significant players in China's domestic AI ecosystem. Their alleged participation suggests this wasn't a rogue operation by a few engineers — it looks like an industry-wide practice.
## How You Catch a Distillation Attack
Anthropic hasn't released the full technical details of how it detected these campaigns, and that's probably deliberate. But the detection challenge is worth understanding.
At small scale, API abuse is invisible — it looks like a heavy developer or an overzealous researcher. At industrial scale, the signatures become more legible. Unusually high query volumes, patterns consistent with systematic coverage of a topic space, timing correlations, account clustering, and — perhaps most tellingly — the nature of the queries themselves. If someone is trying to elicit Claude's reasoning on thousands of edge cases across domains in a structured way, that doesn't look like a developer building a product. It looks like data harvesting.
There's also the possibility that Anthropic has more sophisticated detection: behavioral fingerprinting of Claude's distinctive outputs, monitoring for those signatures appearing downstream in other models' responses, or intelligence from the broader AI safety research community. The company hasn't said. But the confidence to name seven specific companies suggests the evidence isn't just statistical inference — it's something more.
## The Legal and Geopolitical Terrain Ahead
This is where the story gets complicated. Anthropic is alleging TOS violations, not crimes. There's no AI-specific IP law that cleanly covers distillation attacks. Copyright law's application to model training data and outputs remains deeply unsettled — courts are still working through first-generation cases about whether training on copyrighted data constitutes infringement.
What Anthropic has right now is a breach of contract claim against API users who violated their terms. Pursuing that against entities headquartered in China — where, practically speaking, U.S. civil judgments are unenforceable — is a different matter. The disclosure may be as much about public attribution and reputational pressure as it is about any legal strategy.
The geopolitical dimension is impossible to ignore. U.S. export controls have been progressively tightening access to advanced AI chips for Chinese firms. If distillation attacks can partially substitute for that restricted compute — using American models' outputs to bootstrap training that would otherwise require frontier hardware — then this is a national security question, not just a corporate one. Don't be surprised if this disclosure ends up in front of congressional staff by October.
---
## HackWire Analysis
What Anthropic did Thursday was rare in the AI industry: it named names. Companies generally prefer to describe threats in the passive voice, citing "threat actors" and "unauthorized access" without attribution. Anthropic's decision to publicly identify Alibaba, DeepSeek, and others represents a deliberate escalation — and probably signals that internal attempts to shut down the campaigns through account termination weren't producing lasting results.
But the more important story here is what this reveals about the competitive dynamics of the AI race. These distillation operations were apparently running at "industrial scale" for long enough that Anthropic built detection capabilities sophisticated enough to attribute them to specific organizations. That means this wasn't a one-off — it was a sustained, systematic program. And if seven named labs were running it, how many unnamed ones were doing something similar at smaller scale?
The AI industry's core IP — the reasoning patterns, the alignment training, the careful RLHF work that makes frontier models more useful and safer — is increasingly exposed to systematic extraction through the very APIs that generate revenue. Anthropic needs developers to use the API. That same access is the attack surface.
Defenders here aren't network security teams — they're model behavior researchers and ML engineers looking for statistical signatures of systematic extraction. The tooling for this is nascent. Anthropic is ahead of most of the industry in building it, but the disclosure also implies a cat-and-mouse game that isn't over.
For the broader AI ecosystem, the lesson is that competitive intelligence operations in this space have evolved well past human researchers reading papers and poaching engineers. The model weights themselves — or a functional approximation of them — can be extracted through the product interface. That's a threat model most AI companies haven't fully priced in.
One more thing most coverage is glossing over: Anthropic's Constitutional AI and its distinctive approach to reasoning are supposed to represent safety advantages, not just capability advantages. If those properties are being transferred to less safety-conscious competitors through distillation, the harm isn't just commercial. — *HackWire Editorial.*
---
## Related Coverage