SAN FRANCISCO, February 24, 2026 : U.S.-based artificial intelligence company Anthropic has formally accused three Chinese AI laboratories — DeepSeek, Moonshot AI and MiniMax — of conducting coordinated, large-scale distillation campaigns to extract capabilities from its Claude models, according to a company blog post published on February 23, 2026, and contemporaneous reporting by The Wall Street Journal, Reuters, Bloomberg and TechCrunch.
Anthropic stated that the campaigns involved approximately 24,000 fraudulent accounts and generated more than 16 million exchanges with Claude. The company said the activity violated its terms of service and regional access restrictions, noting that Claude is not available in China. According to Anthropic, the laboratories used commercial proxy services and “hydra cluster” account architectures — networks of coordinated accounts — to evade detection and distribute traffic.
The company said it traced account activity using request metadata and linked it to researchers at each laboratory.
Breakdown of the Alleged Campaigns
Anthropic provided a detailed account of the scope and focus of each operation.
MiniMax was responsible for the largest volume of activity, generating more than 13 million exchanges. According to Anthropic, the campaign focused on agentic coding, tool use and orchestration capabilities. The company said it detected the operation while it was active and before the release of the model being trained. Anthropic added that when it released an updated Claude model during the period of activity, MiniMax redirected nearly half of its automated traffic to the new system within 24 hours in order to capture updated capabilities.
Moonshot AI generated more than 3.4 million exchanges. Anthropic said the campaign targeted agentic reasoning, tool use, coding, data analysis, computer-use agent development and computer vision. The company reported that Moonshot AI initially operated hundreds of fraudulent accounts across multiple access pathways before shifting to a more targeted approach designed to reconstruct reasoning traces and internal step-by-step processes.
DeepSeek conducted more than 150,000 exchanges. Although lower in total volume, Anthropic described the activity as highly specific. The company said DeepSeek targeted reasoning capabilities across diverse tasks, including rubric-based grading tasks used in reinforcement learning. Anthropic further alleged that DeepSeek used Claude to generate “censorship-safe” alternatives to politically sensitive queries involving dissidents, party leaders and authoritarianism. According to Anthropic, the associated accounts displayed synchronized traffic patterns, shared payment methods and coordinated timing consistent with load-balancing systems.
Anthropic stated that the three laboratories relied on proxy services and coordinated account networks to bypass regional restrictions and usage limits.
What Distillation Means in This Context
Anthropic described model distillation as a standard machine-learning technique in which a large “teacher” model is used to train a smaller or more efficient “student” model. In legitimate internal use, developers feed a teacher model complex prompts, collect high-quality outputs and train a smaller system to replicate selected capabilities at lower computational cost.
In the cases described, Anthropic alleged that the technique was used without authorization. Instead of training a model from scratch — a process that can require significant computational resources, time and access to training data — the laboratories allegedly generated millions of prompts to Claude, recorded its outputs and used those responses to accelerate development of their own systems.
Anthropic referred to this practice as “illicit distillation” or a “distillation attack,” arguing that it enables rapid capability transfer at a fraction of the traditional cost of frontier model development.
Security and Export Control Concerns
Anthropic stated that the campaigns highlight potential weaknesses in export controls on advanced AI chips and models. The company argued that distillation requires substantially less computing power than full-scale model training, potentially allowing organizations to acquire advanced capabilities without direct access to restricted hardware.
The company also raised concerns about safety guardrails embedded in frontier models. Anthropic said Claude is designed with safeguards intended to prevent misuse in areas such as malicious cyber activities and bioweapons development. According to the company, distilled models may replicate core capabilities while failing to preserve embedded safety constraints, increasing the risk of misuse if integrated into military, intelligence or surveillance systems or released as open-source software.
Anthropic said it has strengthened detection systems, including behavioral fingerprinting, traffic analysis and specialized classifiers designed to identify coordinated querying patterns. It also reported enhancing account verification processes and sharing technical indicators with other AI developers, cloud providers and authorities.
The company called for coordinated action among AI laboratories, cloud infrastructure providers and policymakers to address unauthorized distillation practices.
Industry Response and Criticism
Following publication of the allegations, Anthropic faced criticism from some industry figures and commentators who questioned the distinction between distillation and broader data acquisition practices in AI development.
Critics noted that major AI laboratories, including U.S.-based firms, have trained foundational models on large volumes of publicly available internet data, including copyrighted materials, often without explicit permission from original creators.
Tesla and xAI CEO Elon Musk commented on the social media platform X that Anthropic had itself engaged in large-scale data use and referenced a reported $1.5 billion settlement related to copyright infringement claims involving pirated books used for training data. The settlement has been cited in reporting as part of broader legal disputes over AI training practices.
Anthropic has not publicly responded in detail to those specific criticisms in connection with the current allegations.
Broader Context
The allegations follow a memorandum issued earlier in February 2026 by OpenAI, which accused DeepSeek of using distillation techniques on OpenAI models. The claims by Anthropic and OpenAI indicate increased scrutiny among leading AI developers regarding cross-border capability transfer and competitive model training practices.
As of publication, no public responses to Anthropic’s February 23, 2026 blog post have been issued by DeepSeek, Moonshot AI or MiniMax.
Anthropic stated that its findings are based on internal investigations, account metadata analysis and traffic pattern assessments. All details referenced in this report originate from Anthropic’s official February 23, 2026 blog post titled “Detecting and preventing distillation attacks” and contemporaneous reporting by The Wall Street Journal, Reuters, Bloomberg and TechCrunch.
——— End of Article ———
