Anthropic's Own Findings
Published: September 12, 2026 | Updated: September 12, 2026 | Category: AI | By Mahesh
Anthropic published a threat intelligence report on September 10 naming seven China-based AI companies, Alibaba, DeepSeek, Moonshot AI, Xiaomi, Zhipu, MiniMax and SenseTime, in what it calls the largest unauthorized AI training operation the company has ever measured. According to Anthropic's own published report, Alibaba-affiliated operators alone generated more than 151 million exchanges with Claude Opus 4.6 and 4.7 between May and July 2026, using a network of more than 3,500 fraudulent accounts that peaked at nearly 3 million exchanges in a single day.[1] China's government has publicly rejected the accusations.
What "Distillation" Actually Means, In Anthropic's Own Language
The technique at the center of the report, distillation, is not inherently illegitimate, and Anthropic's own report is explicit about that distinction. "Distillation is a widely used and legitimate training method," the company wrote in an earlier February disclosure covering a related set of cases, adding that "frontier AI labs routinely distill their own models to create smaller, cheaper versions for their customers," according to Anthropic's own February announcement.[2] What makes the September cases unauthorized, in Anthropic's framing, is not the technique itself but the method of access: the report states that "DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and users into Claude," then used Claude's responses as training data to replicate its capabilities, all while routing traffic through commercial proxy services specifically to bypass Anthropic's existing restriction on commercial Claude access from mainland China.[3]
The scale breakdown across the seven named labs, drawn from Anthropic's full 143-plus-page report, gives a clearer sense of how the operations actually worked in practice. According to Martin Cid Magazine's detailed review of the disclosed figures, Moonshot AI, the company behind the widely used Kimi assistant, ran 23 million exchanges and rerouted roughly 300,000 of its own paying customers' active sessions through Claude via a proxy network of more than 5,380 accounts, without those customers' knowledge.[4] Anthropic's own report states plainly that the harvested exchanges included sensitive information from individual users, large multinational corporations, and state-affiliated organizations, information that was never anonymized before being fed back into the labs' own training pipelines.
How This Connects to Anthropic's Earlier February Warning
This is not the first time Anthropic has made this exact accusation. In February 2026, the company disclosed a smaller, earlier set of cases involving DeepSeek, Moonshot and MiniMax, which it said generated more than 16 million exchanges through roughly 24,000 fraudulent accounts, according to NBC News' reporting on that earlier disclosure.[5] Anthropic's own February statement warned that "these campaigns are growing in intensity and sophistication," and September's report confirms that warning was not overstated. The scale documented in September, 151 million exchanges from Alibaba's operation alone, is nearly ten times larger than the combined total Anthropic disclosed just seven months earlier across three separate labs, indicating the underlying activity accelerated substantially rather than being deterred by the company's earlier public disclosure.
Beijing's Response Was Immediate and Categorical
China's government did not stay quiet on this one. Chinese Foreign Ministry spokesperson Mao Ning addressed the allegations directly at a regular press briefing the day after the report's release, according to reporting on the briefing, stating that Beijing "advocates AI for good" and accusing Anthropic of "distorting facts."[6] "We firmly oppose attempts to throw mud at China by distorting facts," Mao said. None of the seven named companies has issued a detailed technical rebuttal of Anthropic's specific exchange counts or account numbers as of this writing, leaving the dispute, for now, as a direct clash between Anthropic's documented technical findings and a general political denial rather than a point-by-point factual disagreement.
Why Anthropic Is Framing This as a National Security Issue, Not Just a Competitive One
Anthropic's own language throughout its reporting on distillation consistently frames the practice as more than a business dispute over intellectual property. The company's February statement argued that "foreign labs that distill American models can then feed these unprotected capabilities into military, intelligence, and surveillance systems, enabling authoritarian governments to deploy frontier AI for offensive cyber operations, disinformation campaigns, and mass surveillance," according to Anthropic's own published announcement. The company has also connected this argument directly to US chip export policy, stating separately in its published position on open-weight models that China "cannot build more powerful models than the US without US chips," and arguing that distillation attacks specifically undermine the strategic purpose of export controls by letting Chinese labs close the capability gap through data extraction rather than compute access.
That framing connects directly to Depth Grid's coverage of CXMT's lawsuit against the Pentagon over its own blacklist designation last month, and to the broader pattern of US-China technology friction Depth Grid has tracked closely, including Anthropic's own separate legal fight with the Pentagon over its blacklist designation. Anthropic is simultaneously positioned as a company defending against what it characterizes as state-linked Chinese extraction of its technology, while also having fought its own legal battle earlier this year against being formally treated as a national security risk by the US government itself, an ironic juxtaposition worth noting even though the two disputes involve entirely different legal and technical questions.
The Detail That Complicates a Simple US-Versus-China Reading
One detail in Anthropic's own report resists a purely adversarial framing. The report states that none of the disrupted misuse cases involved Anthropic's own most capable Claude Fable or Mythos-class models, with a single exception involving one illicit distillation case, according to Anthropic's own report summary. Wikipedia's sourced entry on Claude Mythos notes that model was specifically built with a series of safeguards that "greatly reduce its ability to perform harmful cyber tasks," and Anthropic's own report echoes that language nearly verbatim when describing why Mythos was largely absent from the disrupted cases. That detail suggests Anthropic's tiered access and safeguard system for its most advanced models has functioned largely as designed against this specific threat, even as its more widely available Claude Haiku, Sonnet and Opus models remained the primary targets of the distillation campaigns documented in the same report.
What to Watch Next
The most consequential open question is whether any of the seven named labs issue a specific, technical response addressing Anthropic's disclosed exchange counts and account numbers directly, rather than the general denial China's foreign ministry has offered so far. Also worth watching closely is whether this disclosure influences the ongoing US policy debate over chip export controls to China, since Anthropic has explicitly and repeatedly tied its distillation findings to that specific policy argument in both this report and its earlier public statements on the topic.
Read More on Depth Grid
- A federal judge just released Trump's own Truth Social post as evidence against his Pentagon
- China's biggest memory chipmaker is doing something Chinese companies almost never do: suing the Pentagon
- Anthropic Researcher Quits Over AI Extinction Fears
- DeepSeek is about to raise $7.4 billion. Not one investor will get a vote.
- Oracle Owes $125 Billion. Its Own CFO Says That's the Point.
Article by Depth Grid News Desk | depthgrid.in
Discussion (0)
Comments are disabled for this post.