Anthropic Logs 151M Distillation Hits from Alibaba in Months-Long Campaign

Anthropic dropped a bombshell report Thursday detailing an unprecedented scale of intellectual property theft targeting its frontier models. The San Francisco-based lab identified nearly 200 million suspicious exchanges linked to five distinct distillation campaigns, primarily originating from China-based entities. This isn’t just casual scraping; these are coordinated efforts to strip-mine the reasoning capabilities of US AI leaders. The sheer volume is staggering. Between May and July 2026 alone, one campaign attributed to Alibaba generated 151 million interactions. That peaks at almost three million requests daily across 3,500 accounts.

The technique is clever but illegal. Attackers aren’t just copying outputs; they’re tricking Claude into revealing its internal chain of thought. This hidden reasoning process is the secret sauce that makes modern models smart. By framing queries as translation tasks—like asking the model to convert its working memory into katakana-only Japanese—hackers bypassed safety filters designed to show only summarized thinking. Once extracted, this data trains smaller, cheaper models to mimic the logical prowess of giants like Claude or GPT-4. It’s supervised fine-tuning on steroids, built on stolen labor.

While Alibaba’s effort was the largest in scope, another campaign raised serious national security eyebrows. Moonshot AI, the creator of Kimi, routed nearly 300,000 requests through 5,000 accounts over ten days. Some prompts asked Claude to analyze closed-circuit surveillance footage for “abnormal behavior,” with traffic patterns suggesting direct links to the Chinese military. These weren’t random tests. They targeted the high-end Opus model specifically, aiming to replicate its advanced agentic and coding abilities for state-sponsored use.

This escalation marks a shift from competitive rivalry to industrial-scale extraction. OpenAI has flagged similar activity from DeepSeek, but Anthropic’s data shows the tactics are getting more sophisticated and harder to block. The industry now faces a paradox: making models more transparent improves user trust, but it also creates larger attack surfaces for distillation. As defenses tighten, attackers will likely evolve further. The race isn’t just about who builds the smartest model anymore. It’s about who can protect their brain before someone else copies it.