Chinese AI Labs Launch Massive Distillation Attacks on Anthropic Claude, Tracking 13M Exchanges

Anthropic has identified large-scale data extraction operations conducted by three Chinese AI laboratories: DeepSeek, Moonshot, and MiniMax. These organizations utilized approximately 24,000 fraudulent accounts to carry out over 16 million interactions with Anthropic’s Claude models.

The primary goal of these campaigns was "distillation," a process where a less capable AI model is trained using the high-quality outputs of a more advanced model. Although distillation is a recognized method for developing efficient models, these unauthorized campaigns breached terms of service and circumvented regional access restrictions to acquire advanced capabilities at reduced cost and time.

Industrial-Scale Distillation Campaigns

An investigation by Anthropic revealed that these were not random scraping incidents but coordinated efforts aimed at extracting specific cognitive abilities from Claude, such as coding, complex reasoning, and tool use. By analyzing IP correlations, request metadata, and infrastructure indicators, researchers attributed the attacks to specific labs with high confidence.

DeepSeek focused on extracting reasoning patterns and generating "chain-of-thought" data. Moonshot targeted agentic reasoning and computer vision capabilities, while MiniMax, responsible for the largest volume of traffic, concentrated on coding and tool orchestration.

The scale of these operations was significant, with MiniMax alone accounting for over 13 million exchanges. In one instance, when Anthropic released a new model, MiniMax redirected nearly half of its traffic within 24 hours to target the updated system.

Lab Name Exchange Volume Targeted Capabilities Attribution Method

DeepSeek 150,000+ Reasoning tasks, censorship-safe query generation, rubric grading IP correlation, shared payment patterns

Moonshot AI 3.4 Million+ Agentic reasoning, coding, data analysis, computer vision Request metadata matching senior staff profiles

MiniMax 13 Million+ Agentic coding, tool use, orchestration Infrastructure indicators, product roadmap timing

Evasion Tactics and Security Implications

To execute these attacks, the labs employed commercial proxy services known as "hydra clusters." These networks of fraudulent accounts distribute traffic across various cloud platforms, ensuring no single point of failure; if one account is banned, another takes its place. This infrastructure allowed the labs to bypass the fact that Claude is not commercially available in China.

The illicitly distilled models resulting from these attacks pose national security risks as they often strip away the safety guardrails built into the original models. This absence of safety measures means foreign actors could use these powerful AI systems for offensive cyber operations, disinformation campaigns, or mass surveillance without the ethical restrictions inherent in the original models.

In response, Anthropic is deploying new behavioral fingerprinting systems to detect distillation patterns and is tightening verification processes for educational and startup accounts. The company emphasizes the need for coordinated action across the global AI community and policymakers to maintain the integrity of export controls and prevent the proliferation of unguarded AI capabilities.

Based on reporting by GBHackers.