Affected Systems

Anthropic Claude AI models (Opus 4.6, 4.7, and others). Organizations and individuals using Claude API services globally. Seven China-based AI labs identified: Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), MiniMax, Xiaomi, and SenseTime. Attacks involved 151+ million unauthorized exchanges from February-July 2026 using fraudulent accounts, stolen credentials, and API keys.

Exploitation Status

Active exploitation confirmed. Anthropic detected and disrupted six distinct illicit distillation campaigns between February and July 2026. Largest campaign (GTG-16005) attributed to Alibaba-affiliated operators peaked at 3 million exchanges per day using 3,500+ fraudulent accounts. Multiple labs deployed proxy networks and shell companies to circumvent access controls and harvest model capabilities without authorization.

Business Impact

Organizations using Claude API face exposure of sensitive conversations including proprietary data from multinational companies and state-affiliated actors. Stolen API keys enable unauthorized access and potential cost liability. User data from Claude exchanges sold on secondary markets without consent. Affected organizations may face compliance violations (data residency, export controls) if conversations were rerouted to China-based infrastructure. Fraudulent account creation using stolen credit cards creates financial fraud risk. Model capabilities extracted through distillation undermine competitive advantage and IP protection for AI service providers.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Audit Claude API key usage for anomalous patterns: high request volumes, geographic mismatches (especially Singapore, Japan, China), or unexpected cost spikes from February-July 2026
  • Rotate all Claude API keys immediately and implement key rotation policies with usage monitoring and rate limiting per key
  • Review firewall and proxy logs for connections to known relay/proxy services offering access to restricted AI models; block identified proxy networks
  • If using third-party AI services from China-based vendors (Alibaba, Moonshot/Kimi, DeepSeek, Zhipu, MiniMax, Xiaomi MiMo, SenseTime), assess data exposure risk and review contracts for unauthorized model routing clauses
  • Implement DLP controls to detect sensitive data in API requests to AI services; consider on-premises or private cloud AI deployments for high-sensitivity use cases

---

# Threat Actor Context

Actor Profile

The actors comprise seven China-based AI laboratories: Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), MiniMax, Xiaomi, and SenseTime. Their motivation centers on unauthorized knowledge extraction from Anthropic's Claude AI model to advance their own commercial AI capabilities without authorization. These labs employed industrial-scale illicit distillation—a covert campaign to replicate Claude's advanced capabilities including chain-of-thought reasoning, agentic functions, coding, and logical reasoning. Operations originated from China, with some labs routing traffic through proxy services in Singapore and Japan to circumvent regional access restrictions.

TTPs (Tactics, Techniques, Procedures)

Initial access achieved through proxy services and fraudulent account creation using stolen credit cards, login credentials, and harvested API keys. Alibaba (GTG-16005) deployed over 3,500 fraudulent accounts generating 3 million daily exchanges targeting chain-of-thought reasoning transcripts. Moonshot AI and DeepSeek (GTG-16002, GTG-16001) employed man-in-the-middle techniques, silently rerouting customer requests to Claude instead of processing them locally, capturing responses for training data—a form of T1557 (Adversary-in-the-Middle). Zhipu (GTG-16006) extracted and replayed Claude reasoning traces through 273 rotating accounts. Xiaomi (GTG-16008) replayed user conversations through coding harnesses. SenseTime (GTG-16012) purchased stolen transcripts from third-party data vendors. MiniMax (GTG-16003) established shell company proxy networks to harvest user exchanges. Techniques involved prompt manipulation, context editing to extract internal reasoning, and systematic collection of sensitive data including exchanges from multinational companies and state-affiliated actors.

Targets & Patterns

Primary target was Anthropic's Claude AI model, specifically versions Opus 4.6 and 4.7, with focus on extracting chain-of-thought reasoning capabilities, agentic functions, tool use, software engineering capabilities, kernel development knowledge, and long-horizon task processing. The attacks targeted Claude's most advanced cognitive capabilities to replicate them in competing Chinese AI models. Secondary victims included Claude users—individuals, major multinational corporations, and state-affiliated actors—whose sensitive conversations were harvested without knowledge or consent when labs rerouted requests through Claude. The pattern indicates strategic targeting of Western frontier AI capabilities to achieve technological parity or advantage in the competitive AI development landscape, with particular emphasis on reasoning and agentic capabilities that represent cutting-edge AI functionality.

Historical Context

This disclosure represents the first publicly documented industrial-scale AI model distillation campaign attributed to multiple named entities. Anthropic noted that Western frontier AI labs including Google and OpenAI have previously reported distillation attacks, indicating this is part of a broader pattern of unauthorized knowledge extraction targeting leading AI models. The six campaigns detected since February 2026 show escalating sophistication and scale, with GTG-16005 (Alibaba) described as the largest distillation attack Anthropic has ever measured, peaking at 3 million exchanges daily. The evolution from simple API abuse to sophisticated techniques including silent request rerouting, shell company proxy networks, and third-party transcript marketplaces demonstrates increasing operational maturity and the emergence of a secondary illicit data market supporting AI model theft.

Defensive Recommendations

  • Implement behavioral analytics to detect anomalous API usage patterns including high-volume requests from geographically clustered accounts, rapid account rotation, and traffic originating from known proxy service IP ranges
  • Deploy identity verification controls requiring multi-factor authentication and payment method validation to prevent fraudulent account creation using stolen credentials and credit cards
  • Monitor for man-in-the-middle indicators where customer requests are silently rerouted to unauthorized third-party services; implement end-to-end encryption and request integrity verification
  • Encrypt or obfuscate internal reasoning traces and chain-of-thought outputs in API responses to reduce utility of stolen transcripts for training purposes, as Anthropic did with preserved thinking in Fable 5.1
  • Establish geofencing controls to block API access from unsupported regions (China, Iran, Russia) and known proxy service infrastructure; maintain threat intelligence feeds on illicit relay stations and reseller networks

---

# Geopolitical Context

Geopolitical Context

Anthropic's disclosure of industrial-scale knowledge distillation attacks attributed to seven China-based AI laboratories—including major firms Alibaba, DeepSeek, Moonshot, Zhipu, MiniMax, and others—represents a significant escalation in the strategic competition over artificial intelligence capabilities between the United States and China. The campaigns, which Anthropic detected between February and July 2026, involved the unauthorized extraction of Claude's advanced capabilities through networks of fraudulent accounts, stolen credentials, and proxy services. The attacks targeted high-value features including chain-of-thought reasoning, agentic capabilities, and software engineering functions. Notably, some laboratories allegedly rerouted their own users' requests to Claude without consent, harvesting the exchanges for training data. The incident underscores the dual-use nature of AI development, where commercial competition intersects with national technology strategy. China's pursuit of AI self-sufficiency amid Western export controls and the strategic imperative to close capability gaps with U.S. frontier models appears to have motivated these systematic extraction efforts. The involvement of state-affiliated actors' data in some harvested exchanges adds a counterintelligence dimension to what might otherwise appear as purely commercial intellectual property theft.

State Actor Alignment

The attacks are attributed to commercial AI laboratories based in the People's Republic of China, operating within a technology ecosystem that maintains complex relationships with state industrial policy and national development objectives. While the disclosed actors—Alibaba, Moonshot, DeepSeek, Zhipu, MiniMax, Xiaomi, and SenseTime—are nominally private enterprises, China's civil-military fusion doctrine and national AI development strategies blur distinctions between commercial and state interests in the technology sector. Anthropic's detection of exchanges involving "state-affiliated actors" within harvested data suggests potential national security implications beyond commercial espionage. The systematic use of proxy networks to circumvent geographic access restrictions from unsupported regions including China, Iran, and Russia indicates deliberate evasion of U.S. technology controls. This incident occurs against the backdrop of existing U.S. export controls on advanced semiconductors and AI systems to China, and may inform future regulatory approaches to AI model access and technology transfer. The scale and sophistication of the operations—including the largest campaign (GTG-16005) generating 3 million exchanges daily from over 3,500 fraudulent accounts—suggests organizational capacity and resources consistent with strategic technology acquisition efforts rather than opportunistic exploitation.

Business Impacty pro region

For the transatlantic technology community, this disclosure reinforces concerns about asymmetric technology transfer in AI development, where Western frontier models become training resources for competitors operating under different regulatory and ethical frameworks. European AI developers and policymakers will likely view this incident as validation of calls for stronger safeguards around model access and capability protection, particularly as the EU advances its AI Act implementation. The involvement of proxy services that "provide Claude access to users in unsupported regions" highlights enforcement challenges for geographic access controls in cloud-based AI services. The revelation that some harvested exchanges included sensitive information from "major multinational companies" creates potential exposure for European enterprises using U.S. AI services, raising data sovereignty and confidentiality concerns. For the broader Indo-Pacific region, the concentration of fraudulent accounts in Singapore and Japan (as noted in the Moonshot campaign) suggests these jurisdictions are being leveraged as operational platforms for circumventing geographic restrictions. This may prompt closer scrutiny of cloud infrastructure and identity verification practices in regional technology hubs. Globally, the incident accelerates the fragmentation of AI ecosystems along geopolitical lines, as trust deficits between technology blocs deepen. The secondary market for harvested AI exchanges described by Anthropic represents a new dimension of illicit technology supply chains that may require coordinated international enforcement responses.

Forecast

If Western AI laboratories continue to detect and publicly attribute large-scale distillation attacks to China-based entities, pressure will likely mount for stricter export controls and access restrictions on frontier AI models, potentially including mandatory identity verification, usage monitoring, and geographic blocking measures that could affect legitimate international research collaboration. Should U.S. policymakers treat systematic AI capability extraction as economic espionage or technology transfer violations, targeted sanctions against implicated Chinese AI firms or restrictions on their access to U.S. cloud infrastructure and services may follow, further bifurcating global AI development ecosystems. If the disclosed involvement of state-affiliated actors' data in harvested exchanges is substantiated and expanded upon, counterintelligence agencies in the U.S. and allied nations will likely intensify scrutiny of AI service usage by government contractors and sensitive industries, potentially leading to restrictions on frontier model deployment in classified or controlled environments. The technical countermeasures Anthropic describes—including encrypted reasoning and restricted API modifications—may become industry standards, but if proxy networks and credential theft operations continue to evolve, an escalating technical cat-and-mouse dynamic is probable. Should evidence emerge of similar distillation campaigns targeting other Western AI labs beyond Anthropic, Google, and OpenAI, coordinated industry responses and potential regulatory interventions addressing model security and capability protection appear increasingly likely within the next 12-18 months.