Anthropic has published its September 2026 Threat Intelligence report, accusing seven Chinese AI labs of conducting illicit distillation campaigns targeting Claude. This represents the largest-scale accusation ever publicly made by a frontier AI company.
Alibaba leads distillation campaigns
The largest campaign was attributed to Alibaba, targeting the chain-of-thought (CoT) reasoning capabilities of the Opus 4.6 and 4.7 models. From May to July 2026, Anthropic observed more than 151 million exchanges originating from over 3,500 fraudulent accounts, peaking at nearly 3 million interactions per day.
The objective was to extract Claude’s internal reasoning chains and turn them into supervised fine-tuning (SFT) training data for the Qwen 3.5, 3.6, and 3.7 models. Alibaba also used Claude to develop internal AI infrastructure, including reinforcement learning environments and model architecture research.
The fraudulent accounts used residential proxies, disposable emails, and virtual credit cards to conceal their identities. When Anthropic banned one batch of accounts, Alibaba quickly shifted traffic to another. Some accounts were even discovered forwarding requests from DeepSeek and Xiaomi.
Moonshot AI covertly forwards user prompts to Claude
Moonshot AI, the company behind the Kimi model, was accused of quietly forwarding customer requests to Claude models instead of processing them with Kimi. Users thought they were using Kimi, but were actually receiving responses from Claude. Over a 10-day period, Moonshot forwarded nearly 300,000 requests through a network of 5,380 fraudulent accounts, primarily located in Singapore and Japan.
Moonshot also logged conversations and built a CoT extraction pipeline to train its own models. They bypassed Anthropic’s “thinking signature” mechanism by storing reasoning signatures from Claude’s responses, then opening new sessions to have Claude convert those signatures back into full reasoning chains.
Alarmingly, the forwarded requests contained sensitive information belonging to Moonshot’s customers, including data from multinational corporations and state-affiliated actors. Anthropic stated that it is unclear whether Moonshot ever notified its customers about this.
SenseTime buys third-party transcripts, MiniMax sets up shell company
SenseTime built a distillation pipeline by acquiring conversation transcripts between users and Claude from third-party data providers. These transcripts were harvested without user consent from people accessing Claude through intermediary apps or services. SenseTime also used Claude to write the distillation pipeline itself and launch training runs.
MiniMax went a step further by establishing a shell company that offered proxy services. This entity had no apparent public links to MiniMax and exclusively provided API access to Anthropic and OpenAI models, offering no Chinese models at all—not even MiniMax’s own. Evidence indicates the goal was to harvest exchanges between users and American frontier models.
Xiaomi was also accused of replaying user chat and coding sessions to augment training data for future models.
The bigger picture
In total, Anthropic logged nearly 200 million exchanges tied to distillation campaigns. The techniques grew increasingly sophisticated, ranging from simple prompts instructing the model “not to flag reasoning extraction” to “translation” workarounds that forced Claude to output its reasoning chains formatted as Japanese katakana translations.
The most concerning aspect is that when a model is illicitly distilled, Claude’s safety guardrails do not transfer to the new model. This means the distilled model could acquire dangerous biological or cyber capabilities without any corresponding safety barriers.
For its part, Anthropic has deployed multiple layers of defense, including classifiers to detect adversarial extraction, mechanisms to summarize reasoning prior to outputting responses, and a “preserved thinking” system that prevents new API accounts from modifying system prompts. The company has also shared intelligence with authorities and industry partners.
Alibaba, Moonshot, and the other accused labs have not yet issued official responses. If confirmed, these allegations would represent the clearest evidence to date regarding the scale of model distillation in the US-China AI race.