Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Distillation Attacks on Claude

What happened

Anthropic reported on Thursday that it identified and disrupted industrial-scale illicit distillation attacks against its Claude models, attributing the activity to seven labs based in China. Anthropic named Alibaba, Moonshot, DeepSeek, Z.ai (also known as Zhipu), and MiniMax among the labs involved, according to the report.

Knowledge distillation is itself a legitimate and widely used machine learning technique, in which a large "teacher" model's outputs are used to train a smaller "student" model. Anthropic's characterization here is that these specific operations crossed into unauthorized, large-scale extraction of Claude's outputs to train competing models — details on the exact technical methods and volume of activity were not included in the portion of the report available at this time.

Why it matters for defenders

This story sits outside typical vulnerability/exploit territory, but it's directly relevant to organizations that operate or rely on commercial LLM APIs. Unauthorized distillation campaigns represent an abuse-of-service and intellectual-property risk vector: they can involve automated, high-volume querying against an API using techniques that overlap with credential abuse, scraping, and terms-of-service circumvention. Enterprises that provide or resell LLM API access, or that operate their own model endpoints, should view this as a reminder that API abuse at scale is an active threat model — not just a theoretical one — with nation-state-adjacent competitive stakes.

What defenders should watch for or do now

• Monitor API usage patterns for anomalous volume, diversity of prompts, or systematic sampling behavior consistent with automated data harvesting rather than normal usage.
• Review rate-limiting, API key attribution, and abuse-detection controls on any LLM endpoints your organization exposes internally or externally.
• Track account/organization-level telemetry (geographic origin, request cadence, prompt structure diversity) as potential indicators of distillation-style scraping.
• If your organization licenses or resells access to frontier models, review contractual terms-of-service enforcement and anomaly-detection tooling with your provider.

Developing story

This is a net-new report with limited technical detail disclosed publicly so far; specifics on detection methodology, scope, and any response actions from the named labs may evolve. For the original reporting, see The Hacker News.