Anthropic Caught Seven Chinese Labs Stealing From Claude. Inside the Report

On September 10, 2026, Anthropic published a big security report. It is 154 pages long. The most striking part is about model theft. Anthropic says it caught seven Chinese companies secretly siphoning answers from Claude to train their own models. The opening line is unusually direct:

"Since February 2026, we have detected and disrupted unauthorized distillation campaigns we have attributed with high confidence to specific PRC-based labs targeting Anthropic's Opus-class models."

The seven labs named: Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), Xiaomi, SenseTime, and MiniMax. All attacks hit publicly available models. This story reads like a detective case, so here it is in that order. What happened. How they got caught. What it changes.

First, what does "distillation" even mean?

Imagine a top teacher answers a million questions, and someone saves every answer. Then they use those answers to train a copycat student model. That is distillation. Done openly with permission, it is a normal, legal training method.

Done in secret to someone else's model, it is theft. The report's own definition: an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization. The enablers are fraud: fake accounts, stolen credit cards, and stolen API keys.

How the attacks worked, step by step

The report documents a repeating pattern:

1. Get in with fake accounts. Anthropic blocks China-based companies from its API. So the attackers used proxy services, which the report calls transfer stations. These route requests through thousands of fake accounts made with stolen cards and keys.
2. Harvest the thinking. Fixed prompts forced Claude to write its full reasoning into the answer text. Every transcript was saved.
3. Clean the data. The transcripts were reformatted into training data. Zhipu ran what the report literally calls a CoT-extraction cleaner, pushing 770,609 exchanges through it in 10 days in June.
4. Train on it. The cleaned transcripts became fine-tuning data for the attackers' own models.

One trick stands out. Claude returns a thinking signature instead of raw reasoning, as a defense. Moonshot and DeepSeek saved that signature, opened a new session, and coaxed Claude into converting it back into the full reasoning trace.

The numbers, lab by lab

All figures are Anthropic's own observations, not independent measurements.

• Alibaba. The biggest attack Anthropic says it has ever measured. Over 151 million exchanges between May and July 2026, peaking near 3 million per day, from more than 3,500 fake accounts. The report says the data trained Qwen 3.5, 3.6, and 3.7.
• Moonshot AI. Silently sent Kimi customers' questions to Claude and showed them Claude's answers as if Kimi wrote them. About 300,000 customer requests in one 10-day window, through 5,380 fake accounts, over 23 million exchanges in total.
• DeepSeek. Same relay trick, but targeted. It tagged users of Claude Code and the Claude Agent SDK and relayed them to Claude Opus. Over 12.1 million exchanges in 14 days in July 2026.
• Zhipu. A pipeline against Opus 4.8 with 273 rotating accounts. Over 3.4 million exchanges in 17 days. The report says Zhipu also tried to steal Fable's cyber skills, gave up when safeguards degraded the attacks, then switched to Opus 4.6 and another US lab's model "expressly because they assessed the safeguards were weaker."
• Xiaomi. Replayed saved MiMo user conversations through Claude to make training data. Over 400,000 requests through more than 1,500 proxy accounts in 20 days.
• SenseTime and MiniMax. Smaller cases, including bought Claude transcripts and a proxy firm that offers only Anthropic and OpenAI models, not even its own.

A detail few talk about: relays push real users' data through the pipe too. The report documents CCTV footage from hundreds of Chengdu cameras, a state firm engineer's internal code with live passwords, and credentials for a Russia-linked defense database. (This sits in the same attack-surface world as prompt injection, another quiet risk.)

The Kenya case: one tip, one takedown

The distillation chapter is only part of the story. Buried in the influence-operations section is GTG-54004, a fake grassroots campaign in Kenya. The origin is what makes it special:

"Based on a tip shared by OpenAI about recidivist activity on their platform, we conducted an internal investigation into suspected coordinated inauthentic behavior in Kenya and identified this operation."

One AI company tipped off another. The investigation found one actor using Claude to mass-produce Kenyan political content in batches of exactly 50 tweets, written to look like real grassroots voices, ahead of the 2027 election. The same workflow served Kenyan retail brands under a marketing mask.

The impact was tiny. Anthropic rates it Breakout Scale Category One: fully isolated, reaching no real people. The report states plainly, "We found no evidence of government involvement." Humans decided the messages before Claude ever saw them. The precedent is the story here. Rival labs are now sharing threat intel like security firms have for decades. That is new.

How Anthropic says it blocks this

From the report's defenses section:

• Layered checks. Fake account networks get spotted by metadata and activity patterns, and enforcement hits the organization behind them, not one account at a time.
• Extraction classifiers. Detectors built to catch adversarial extraction, strengthened alongside the Fable 5 launch.
• Reasoning summarization. Claude now summarizes its internal reasoning before answering, which makes stolen transcripts less useful for training.
• Preserved thinking. New in Fable 5.1. Reasoning is encrypted, and new accounts cannot edit the system prompt or tools before Claude thinks, which was the classic trick to reveal it.
• Identity checks. Abuse signals like unauthorized resale or blocked countries trigger verification.

What the report does NOT say

The internet is already inflating this report, so hold these lines:

• It does not claim state sponsorship. "High confidence" points to the labs, not a government.
• It never prints a grand total. The "nearly 200 million" number in press coverage is arithmetic on the per-case figures, not a report number.
• The Kenya case is domestic, with no government involvement stated.

Context worth knowing: two days before the report, the NSA, CISA, and FBI issued a joint advisory naming six Chinese firms for industrial-scale distillation, and China's Commerce Ministry rejected the claims as having "no factual or legal basis." This is now a named, government-level dispute. (For the wider risk picture, see the real risks of AI agents, or how Claude and its peers actually work.)

FAQ

What is distillation in simple words? Saving a smart model's answers and training another model on them, without permission, at huge scale.

Did these attacks steal Claude itself? No. They stole its outputs and reasoning text to train copycats. The model weights stayed with Anthropic.

Is my data safe if I used Kimi or MiMo? The report documents relay cases where real user requests passed through to Claude. If you used those products in the covered windows, treat it as a data-flow question worth asking them directly.

Did China's government order this? The report does not say that. It names companies, with high confidence, and no government link.

What is an IOC? Indicator of compromise. A machine-readable fingerprint of attacker infrastructure. The report ships one as a CSV that defenders can import into blocklists.

What to do next

If you build on a frontier API, read the countermeasures list and steal the ideas: summarized reasoning, extraction detection, and identity checks map onto any provider. If you run security for a company that lets agents touch core systems, the GTG-54004 story is your argument for threat-intel sharing. And if you are building a model, assume your outputs are being harvested, because this report says seven labs bet on exactly that.