Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek

Anthropic says it has spotted a fresh wave of distillation attacks aimed at Claude, and this time the scale is a lot harder to shrug off. In a report released Thursday, the company says the campaigns have grown more aggressive over the last several months as competition in AI has tightened.

The basic trick is simple enough: get a model to spill its chain of thought, then use that material to train a smaller system. Anthropic says its own models usually hide that internal reasoning behind summarized thinking blocks, but attackers found ways around that. One example in the report uses a translation prompt to coax the model into exposing its working memory.

The biggest campaign Anthropic identified was tied to Alibaba. The company says it saw 151 million exchanges between May and July 2026, spread across 3,500 accounts and peaking at nearly 3 million exchanges a day. Anthropic says the repeated fixed prompt and the scale of the activity point to an effort to build training data for Alibaba’s Qwen family of models.

Another campaign was tied to Moonshot AI, the company behind Kimi. Anthropic says some of those requests appeared to be routed directly from the Chinese military, including one asking Claude to review closed-circuit surveillance footage and judge whether a subject was behaving abnormally. Over a ten-day stretch, the company says nearly 300,000 requests flowed through 5,000 accounts, mostly targeting Opus.

All told, Anthropic says it observed nearly 200 million exchanges linked to five separate campaigns. It had already warned about distillation attacks in February, and OpenAI has also reported similar activity, blaming DeepSeek. But Anthropic says the newer campaigns it found are both larger and more aggressive.