Chinese AI Labs Conduct Industrial-Scale Distillation Attacks Against Claude (2025)

Incident Summary

In February 2026, Anthropic disclosed that three Chinese AI laboratories — DeepSeek, Moonshot AI, and MiniMax — had conducted industrial-scale model distillation campaigns targeting Claude’s differentiated capabilities.^[1] Model distillation involves training weaker models on the outputs of a stronger model, effectively extracting capabilities without the original research investment.

The campaigns employed “hydra cluster” architectures — sprawling networks of fraudulent accounts distributing traffic across APIs and cloud platforms. Across the three campaigns, attackers used approximately 24,000 fraudulent accounts and extracted more than 16 million exchanges from Claude, targeting capabilities in agentic reasoning, tool use, coding, data analysis, computer vision, and chain-of-thought reasoning.^[1]

Key Facts

• DeepSeek: Approximately 150,000 exchanges with Claude extracted^[1]
• Moonshot AI (Kimi models): 3.4 million exchanges extracted^[1]
• MiniMax: 13 million exchanges extracted; campaign detected while still active before model release^[1]
• Account infrastructure: Approximately 24,000 fraudulent accounts, with one proxy network managing more than 20,000 simultaneously^[1]
• Access methods: Commercial proxy services reselling Claude access; exploitation of educational accounts, research programs, and startup pathways^[1]
• Attribution method: IP address correlation, request metadata, infrastructure indicators, and industry partner corroboration^[1]
• Detection markers: Massive volume concentrated in narrow capability areas, highly repetitive structures, and content mapping directly to training-valuable outputs^[1]

Threat Patterns Involved

Primary: Model Inversion & Data Extraction — The distillation campaigns systematically extracted Claude’s trained capabilities through high-volume, targeted querying. Unlike traditional data extraction that targets training data, these attacks aimed to replicate the model’s learned reasoning patterns, representing an evolution of the model extraction threat at industrial scale.

Secondary: AI Capability Proliferation — Anthropic warned that distilled models may lack the safety guardrails present in the original system, enabling state and non-state actors to repurpose extracted capabilities for bioweapon development, cyber operations, or military and intelligence applications. The attacks effectively circumvent export controls and AI competitiveness restrictions.

Significance

This incident is the first publicly documented case of industrial-scale, state-linked model distillation targeting a frontier AI system. Several dimensions distinguish it:

1. Scale and coordination — 16 million exchanges across 24,000 fraudulent accounts represents a systematic capability extraction operation, not opportunistic misuse
2. Named threat actors — Anthropic publicly attributed campaigns to three specific organizations, an unusual step that signals the severity of the threat
3. Safety implications — Distilled models lack the safety training of their source, creating a proliferation pathway for dangerous capabilities without corresponding guardrails
4. Export control circumvention — The campaigns enable acquisition of frontier AI capabilities at a fraction of the cost and time required for independent development, undermining technology transfer restrictions
5. Industry-wide vulnerability — Anthropic noted that other frontier labs and cloud providers were also targeted, indicating a sector-wide threat requiring coordinated response