Anthropic shuts down Chinese AI distillation campaigns

Anthropic identified and deactivated illicit distillation campaigns carried out by at least seven Chinese artificial intelligence laboratories, according to the company's threat intelligence report. The targeted models included Claude Opus 4.6, 4.7, 4.8, and Fable. The entities named in the report are Alibaba, Moonshot AI, DeepSeek, Zhipu (operating internationally as Z.ai), Xiaomi, SenseTime, and MiniMax.

Anthropic defined illicit distillation as an unauthorized covert campaign to replicate a model's capabilities into another system. Operators linked to Alibaba carried out the largest campaign recorded by the company, generating more than 151 million interactions between May and July 2026 across more than 3,500 fraudulent accounts. The activity reached a peak of nearly 3 million exchanges per day to extract reasoning data for Alibaba's Qwen 3.5, 3.6, and 3.7 models, alongside internal infrastructure and architecture research.

Moonshot AI rerouted user queries to Claude using 5,380 fraudulent accounts, accounting for more than 23 million exchanges between May and July 2026. DeepSeek diverted external tool requests to Opus, generating over 12.1 million interactions in fourteen days during July 2026. Zhipu rotated 273 accounts for more than 3.4 million exchanges between June and July 2026 for its GLM models, while Xiaomi used 1,500 accounts to send more than 400,000 requests to train its MiMo models.

The report noted that SenseTime acquired Claude conversation logs from third-party data providers, while MiniMax established a proxy network through a front company to access models from Anthropic and OpenAI. Anthropic stated that intercepted requests included names, email addresses, and corporate data belonging to customers of Moonshot, DeepSeek, and Xiaomi across at least twelve languages, without customer knowledge. In response, Anthropic blocked the involved accounts, enhanced detection classifiers, and introduced systems that summarize internal reasoning and protect initial reasoning context.