Anthropic details distillation attacks from Chinese AI labs

Anthropic released a report Thursday alleging persistent distillation attacks by China-based AI companies, which it says have escalated in recent months as competition in the space has intensified.

“Over the last several months, unauthorized labs have developed increasingly sophisticated methods to circumvent our defenses and harvest the capabilities of US frontier models,” the report reads. “The campaigns we identified targeted some of Claude’s most valuable capabilities, including agentic capabilities and tool use, coding and data analysis, and logical reasoning.”

Anthropic previously spoke out about distillation attacks in February, naming specific labs at the time. OpenAI has reported similar activity, which it attributed specifically to DeepSeek. But the campaigns detailed in Anthropic’s new report are both larger and more aggressive: the company says it observed nearly 200 million exchanges linked to distillation attacks, attributed to five separate campaigns.

Broadly, distillation attacks focus on extracting a model’s chain of thought from its responses to various queries; that chain of thought can then be used to train a smaller model on general reasoning ability through supervised fine-tuning. Anthropic typically doesn’t make Claude’s internal chain of thought available to users, showing “summarized thinking” blocks instead — but the campaigns found specific techniques to trick the model into revealing its thinking traces directly, including one case where an attacker framed the request as a translation task asking the model to render its prior working memory into natural Japanese using only katakana script.

The bulk of the distillation attempts came from a campaign Anthropic attributes to Alibaba, which it describes as the largest wholesale distillation effort the company has observed. Anthropic recorded 151 million exchanges between May and July 2026 tied to the campaign, peaking at nearly three million exchanges a day and spread across 3,500 different accounts; because the accounts shared a single fixed prompt used to extract the chain of thought, Anthropic attributed them to a single effort to produce training material for Alibaba’s Qwen family of models.

Another campaign, which Anthropic attributes to Moonshot AI, maker of the Kimi models, appeared to route requests directly from the Chinese military. According to the report, one request asked Claude to review closed-circuit surveillance footage to assess whether a subject was behaving abnormally. Over one 10-day period, Anthropic says nearly 300,000 requests were routed to Claude through a network of 5,000 accounts, primarily targeting the company’s Opus model.

Why it matters

The scale Anthropic describes — nearly 200 million exchanges across five campaigns — suggests distillation has become a systematic strategy for closing the capability gap with US frontier labs, not an isolated workaround, and puts pressure on AI labs to harden chain-of-thought exposure as a competitive-security issue, not just a safety one.