Anthropic has disrupted six industrial-scale illicit distillation attacks by seven China-based AI labs, including Alibaba and DeepSeek, targeting its Claude model. The campaigns involved sophisticated methods to extract and replicate Claude's capabilities without authorization.
TL;DR
- Anthropic identified and disrupted six illicit distillation campaigns by seven China-based AI labs, including Alibaba and DeepSeek.
- The campaigns involved sophisticated methods to extract and replicate Claude's capabilities without authorization.
- Anthropic has implemented new measures to counter illicit distillation, including banning reseller accounts and updating Claude's model to summarize internal reasoning.
What happened
Anthropic identified and disrupted six illicit distillation campaigns conducted by seven China-based AI labs, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax. These campaigns involved sophisticated methods to extract and replicate Claude's capabilities without authorization.
The campaigns included GTG-16005, the largest distillation attack Anthropic has ever measured, which involved 151 million exchanges observed between May and July 2026. This campaign targeted the chain-of-thought (CoT) reasoning transcripts of Claude Opus 4.6 and 4.7 and peaked at roughly 3 million exchanges per day launched from more than 3,500 fraudulent accounts.
Other campaigns included GTG-16002, conducted by Moonshot AI, which involved 23 million exchanges observed between May and July 2026. Moonshot AI stealthily rerouted customer requests to Claude as opposed to processing them using Kimi, and then displayed responses from Claude to users. In tandem, a subset of these exchanges were captured and saved to train its CoT model.
Why it matters
This development highlights the growing threat of illicit distillation attacks on AI models, which can lead to the unauthorized replication of capabilities and the potential misuse of sensitive information.
For developers and startups, this underscores the importance of implementing robust security measures to protect AI models and user data. It also highlights the need for ongoing vigilance and adaptation to counter evolving threats.
For investors, this news underscores the importance of supporting AI companies that prioritize security and have the resources to implement robust protective measures. It also highlights the potential risks and costs associated with illicit distillation attacks, which can impact the bottom line and reputation of AI companies.
Key facts
- Anthropic identified and disrupted six illicit distillation campaigns conducted by seven China-based AI labs, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax.
- The largest campaign, GTG-16005, involved 151 million exchanges observed between May and July 2026 and peaked at roughly 3 million exchanges per day launched from more than 3,500 fraudulent accounts.
- Other campaigns included GTG-16002, conducted by Moonshot AI, which involved 23 million exchanges observed between May and July 2026.
- Anthropic has implemented new measures to counter illicit distillation, including banning reseller accounts or accounts operating from unsupported regions like China, Iran, and Russia when users fail to verify their identity.
- Anthropic has updated Claude's model to summarize its internal reasoning before responding, making stolen transcripts less useful for follow-on training.
- Anthropic has also introduced preserved thinking in Fable 5.1, which stops new API accounts from altering the system prompt, tools, or messages that precede Claude's reasoning in multi-turn conversations.
Context
Illicit distillation is an industrial-scale campaign that covertly extracts a model's capabilities and replicates them in another model without authorization. This can involve the use of networks of fake accounts created with stolen credit cards, login credentials, and API keys.
Frontier AI labs in the West, including those from Google and OpenAI, have repeatedly called out distillation attacks aimed at their models. These attacks can lead to the unauthorized replication of capabilities and the potential misuse of sensitive information.
Anthropic's actions highlight the ongoing arms race between AI companies and those seeking to exploit their models for unauthorized purposes. As AI models become more powerful and sophisticated, the threat of illicit distillation and other forms of exploitation is likely to grow.
