Anthropic Says Alibaba, Moonshot and DeepSeek Targeted Claude in Distillation Campaigns

Anthropic says it has detected increasingly sophisticated efforts by China-based AI companies to extract capabilities from Claude, identifying campaigns linked to Alibaba, Moonshot AI, and DeepSeek that collectively generated nearly 200 million exchanges.

In its September threat intelligence report, Anthropic said the campaigns targeted some of Claude’s most valuable capabilities, including coding, data analysis, logical reasoning, tool use and agentic behaviour.

The company described five separate campaigns and said the activity had intensified in recent months as competition among frontier AI developers increased. Anthropic had previously raised concerns about unauthorised model distillation, while OpenAI has also reported suspected distillation activity involving DeepSeek.

Attackers tried to extract Claude’s reasoning

Model distillation can involve using outputs from a more capable AI system to improve another model through additional training. Anthropic said the campaigns went further by developing prompts intended to expose reasoning traces that normally would not be available to users.

Claude generally presents users with summarised descriptions of its reasoning rather than exposing unrestricted internal thinking. Anthropic’s documentation explains how extended thinking can be controlled and displayed, including the distinction between model reasoning and what it ultimately shows users.

Anthropic said attackers discovered techniques that could sometimes prompt Claude to reveal more detailed reasoning. One example framed the request as a translation task, asking the model to translate previous working memory into katakana-only Japanese.

Alibaba-linked campaign generated 151 million exchanges

Anthropic attributed the largest campaign to Alibaba. The company said it recorded about 151 million exchanges between May and July 2026, with activity reaching nearly 3 million exchanges per day at its peak.

The requests spanned roughly 3,500 accounts. Anthropic said the accounts repeatedly used the same prompt designed to extract reasoning traces, leading the company to attribute the activity to a coordinated effort to produce training material for Alibaba’s Qwen models.

Anthropic also attributed another large campaign to Moonshot AI, the developer of Kimi. During one 10-day period, the company said almost 300,000 requests were routed through approximately 5,000 accounts, with much of the activity targeting Claude Opus.

One Moonshot-linked request appeared to involve analysis of closed-circuit surveillance footage and asked Claude to determine whether a subject was behaving abnormally. Anthropic said some requests appeared to have been routed from entities connected to the Chinese military.

Distillation becomes a frontier AI security issue

Anthropic’s findings illustrate how model providers increasingly have to defend not only against conventional abuse but also against attempts by rival developers to extract capabilities for training purposes systematically.

The company said the campaigns used thousands of accounts and evolving prompting techniques to bypass safeguards and gather high-value outputs at scale. Anthropic characterised the activity as unauthorised and said protecting frontier-model capabilities has become an increasingly important part of AI security as competition intensifies.