Full Report
Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax. Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large, powerful AI model assumes the role of a "teacher" to
Analysis Summary
# Incident Report: Industrial-Scale Illicit Distillation Attacks Against Claude
## Executive Summary
Anthropic identified and disrupted a series of "illicit distillation" campaigns launched by seven China-based AI labs, including Alibaba, Moonshot, and DeepSeek. These actors used sophisticated proxy networks and fraudulent accounts to covertly extract Claude’s reasoning and agentic capabilities to train their own student models. The attacks compromised sensitive user data and represented a significant unauthorized extraction of intellectual property on an industrial scale.
## Incident Details
- **Discovery Date:** July 2026 (Aggregated reporting)
- **Incident Date:** February 2026 – July 2026
- **Affected Organization:** Anthropic (Claude AI Models)
- **Sector:** Technology / Artificial Intelligence
- **Geography:** Attacks originated from China; infrastructure identified in Singapore and Japan.
## Timeline of Events
### Initial Access
- **Date/Time:** February 2026 (Initial onset)
- **Vector:** Exploitation of API infrastructure via proxy services and fraudulent account creation.
- **Details:** Attackers utilized thousands of fake identities, stolen credit cards, and harvested API keys to bypass rate limits and geographic restrictions.
### Lateral Movement
- **Relay Stations:** Attackers routed requests through "transfer stations" to mask the origin of the traffic.
- **User Rerouting:** Labs like Moonshot and DeepSeek silently rerouted their own customers' prompts to Anthropic’s models without user consent, effectively using Claude as a backend for their services to capture "Teacher" responses.
### Data Exfiltration/Impact
- **Capability Theft:** Extraction of Chain-of-Thought (CoT) reasoning, coding, and logical reasoning traces.
- **Volume:** Over 190 million cumulative exchanges observed across multiple campaigns (GTG-16005, GTG-16002, etc.).
- **Data Privacy:** Sensitive information from multinational companies and state-affiliated actors was captured during the relay process.
### Detection & Response
- **Discovery:** Anthropic threat intelligence identified anomalous patterns in API usage and "sophisticated prompt manipulation" aimed at harvesting reasoning traces.
- **Response Actions:** Disruption of identified account clusters and public attribution to the involved labs.
## Attack Methodology
- **Initial Access:** Use of stolen credit cards and illegally harvested API keys.
- **Persistence:** Creation of thousands of rotating fraudulent accounts (e.g., 5,380 accounts for GTG-16002).
- **Defense Evasion:** Use of proxy services/relay stations to hide China-based origins; rotating through accounts to avoid rate-limiting triggers.
- **Discovery:** Identification of Claude’s high-value reasoning capabilities through systematic probing.
- **Collection:** Saving "teacher" responses from Claude to build proprietary training datasets.
- **Exfiltration:** Transfer of Claude’s logic and reasoning traces into the student models of Chinese labs.
- **Impact:** Unauthorized replication of proprietary AI capabilities and exposure of user data.
## Impact Assessment
- **Financial:** High potential loss of R&D value due to intellectual property (IP) theft.
- **Data Breach:** Exposure of sensitive user-Claude exchanges including state-affiliated and corporate data.
- **Operational:** Massive load on Anthropic infrastructure (peaking at 3 million exchanges/day for GTG-16005).
- **Reputational:** Public exposure of Chinese AI labs engaging in illicit training practices.
## Indicators of Compromise
- **Behavioral indicators:**
- High-frequency API calls focusing on Chain-of-Thought (CoT) reasoning.
- Prompts designed to force "agentic" or "long-horizon" task explanations.
- Large-scale rerouting of traffic through proxies in Singapore and Japan.
- **Infrastructure:**
- Clusters of thousands of accounts sharing similar payment or registration artifacts.
## Response Actions
- **Containment:** Blocked thousands of fraudulent accounts and identified proxy service IPs.
- **Eradication:** Updated detection logic to identify prompt-based distillation attempts.
- **Recovery:** Public disclosure via threat intelligence reports to alert the industry of these specific TTPs (Tactics, Techniques, and Procedures).
## Lessons Learned
- **Distillation as a Weapon:** Knowledge distillation, while a legitimate ML technique, has been weaponized into a new form of industrial espionage.
- **Proxy Risks:** The "API-as-a-Service" model is highly vulnerable to relay attacks where the middleman steals data from both the user and the provider.
- **Account Verification:** Traditional credit card and email verification are insufficient against well-funded, state-level industrial actors.
## Recommendations
- **Enhanced Monitoring:** Implement behavioral analysis to detect "distillation-style" prompting patterns (e.g., excessive requests for reasoning steps).
- **API Security:** Strengthen API key lifecycle management and implement stricter telemetry to detect relay/proxy behavior.
- **Cross-Industry Collaboration:** Frontier AI labs should share threat intelligence regarding known "relay stations" and illicit labs.