Anthropic IDs 151M-example illicit distillation of Claude

This is not just an enforcement announcement—it's a technical case study in adversarial distillation. The distinction between bulk query extraction and live conversation routing matters for anyone designing frontier model defenses, watermarking systems, or API monitoring pipelines.

Anthropic's September 10, 2026 threat intelligence disclosure shifts the AI security conversation from theoretical risk to documented industrial-scale exploitation. The company said it disrupted multiple malicious uses of its Claude models over the preceding eight months, including what it described as a suspected Russia-linked cyber espionage campaign and coordinated efforts by Chinese AI labs to extract and replicate Claude's capabilities. The report names seven China-based labs, singling out Alibaba, Moonshot, DeepSeek, and Xiaomi. The most detailed allegation centers on Alibaba, where Anthropic says it observed more than 151 million exchanges between May and July 2026, peaking at nearly three million per day from more than 3,500 accounts it called fraudulent. Anthropic asserted the campaign was the largest "illicit distillation" attack against Claude, aimed at improving Alibaba's Qwen models.

“

The report names seven China-based labs, singling out Alibaba, Moonshot, DeepSeek, and Xiaomi.

The operational detail matters. Distillation—training a smaller or cheaper model on outputs from a larger, more expensive frontier model—has become the primary vector for model capability theft. Anthropic's report distinguishes between bulk query-based distillation and a more invasive tactic: Moonshot and DeepSeek allegedly routed live customer conversations, sometimes containing sensitive information, through Claude and used its responses as training data. That claim moves beyond IP theft into potential data leakage, because real user queries and context may have been used to teach competing models. For any enterprise whose employees or customers used those services, the report raises questions about where their data ended up and how AI providers monitor intermediary traffic.

The report also highlights a shift in how attackers use AI. Anthropic said a majority of the operations were enabled by AI through direct execution or orchestration, with humans acting as overseers rather than hands-on operators. Multi-agent frameworks now allow attackers to automate account creation, query generation, response parsing, and adaptation at scale—an evolution from simple chatbot prompting. This explains the enormous volume associated with the Alibaba campaign and signals that abuse detection must move from static rate limits to behavioral and agentic-pattern analysis.

The geopolitical and criminal dimensions compound the risk. Anthropic disclosed activity by a hacking group whose tradecraft was consistent with Russia-based threat actor Midnight Blizzard, a group Microsoft and other firms have long tied to Russian intelligence. The report also highlighted ShinyHunters, a cybercrime collective known for high-profile data theft and extortion. Perhaps most concerning, Anthropic said it identified new categories of threat actors misusing AI for developing software related to conventional weapons. That introduces dual-use and export-control considerations that go well beyond commercial competition.