{"id":2812,"date":"2026-09-11T18:40:15","date_gmt":"2026-09-11T18:40:15","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2812"},"modified":"2026-09-11T18:40:15","modified_gmt":"2026-09-11T18:40:15","slug":"anthropic-says-seven-china-based-ai-labs-ran-industrial-scale-claude-distillation-attacks","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2812","title":{"rendered":"Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 11, 2026<\/span><\/span>Artificial Intelligence \/ Cybercrime<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax.<\/p>\n

Knowledge distillation by itself is a legitimate training method<\/a>. It refers to a machine learning technique<\/a> where a large, powerful AI model assumes the role of a \u00abteacher\u00bb to train a smaller, less-capable or faster \u00abstudent\u00bb model to copy its capabilities.<\/p>\n

Illicit distillation, on the other hand, is an industrial-scale campaign that covertly extracts a model’s capabilities and replicates them in another model without authorization, typically by making use of networks of fake accounts created with stolen credit cards, login credentials, and API keys.<\/p>\n

Frontier AI labs in the West, including those from Google and OpenAI, have repeatedly called out distillation attacks aimed at their models. Anthropic said it has observed unauthorized labs employing \u00abincreasingly sophisticated methods\u00bb to get around defenses and harvest its capabilities, such as agentic capabilities and tool use, coding and data analysis, and logical reasoning, through prompt manipulation tricks.<\/p>\n

\u00abDeepSeek, Xiaomi, and Moonshot fed conversations between their own models and users into Claude,\u00bb Anthropic said<\/a>. \u00abThese labs then used Claude\u2019s responses as training data with which to distill Claude’s capabilities. Some of these exchanges included sensitive information, including from individual users, major multinational companies, and state-affiliated actors.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The AI company said these labs generally gain access to its models by routing requests through proxy services, also referred to as transfer or relay stations, which create thousands of new accounts under fictitious identities, fake or stolen credit cards, and illegally harvested API keys that belong to legitimate companies or individuals.<\/p>\n

<\/p>\n

According to Anthropic, unauthorized AI labs also acquire transcripts of user exchanges with U.S. frontier models by purchasing them off third-party resellers, who are the operators of proxy services that save such conversations without the users’ knowledge or consent.<\/p>\n

\"\"<\/a><\/div>\n

\u00abIn other cases, unauthorized labs rerouted requests from their users to Claude — without the knowledge or permission of those users — to harvest exchanges between users and Claude for training,\u00bb Anthropic pointed out.<\/p>\n

\"\"<\/a><\/div>\n

Since February 2026, the AI company said it has detected six illicit distillation campaigns that were conducted by China-based AI labs to advance their own models –<\/p>\n