Anthropic Names Seven PRC Labs Behind Illicit Distillation Attacks on Claude

Anthropic's threat intelligence report of September 10, 2026 names Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax as the seven China-based labs behind illicit distillation campaigns against Claude. Adding only the five campaigns given a figure, observed exchanges approach 190 million. Alibaba alone accounts for more than 151 million between May and July 2026, peaking at nearly 3 million exchanges a day from over 3,500 fraudulent accounts. What separates this report from Anthropic's February disclosure is attribution rather than scale: the company wrote down corporate names instead of anonymous threat actors, and assigned each campaign a tracking number from GTG 16001 through 16012. ASAP works only from figures and statements verifiable in Anthropic's own text.

Seven company names separate this report from the February disclosure

The document Anthropic published is titled "Detecting and countering misuse of AI: September 2026," and it covers activity disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons, and distillation. The wording in the distillation section is unambiguous. Anthropic states that since its first disclosure in February 2026 it has identified and disrupted additional distillation attacks against Claude from seven labs based in China.

Targeting was confined to generally available models. Anthropic states it has not observed attempts against Mythos 5 or Mythos Preview, neither of which is accessible to the general public. The report's opening runs the same way: across all misuse cases documented, only one illicit distillation case involved a Claude Fable or Mythos-class model.

The report separates legitimate distillation from the illicit kind before describing any campaign. Training a smaller student model on the outputs of a larger teacher is a standard method. What Anthropic classifies as illicit is an industrial-scale, covert campaign that extracts a model's capabilities and replicates them elsewhere without authorization, enabled by networks of fake accounts built on stolen credit cards, stolen login credentials, and stolen API keys.

The Alibaba campaign went straight at the chain of thought in Opus 4.6 and 4.7

Classified as GTG 16005, the Alibaba campaign is the largest distillation attack Anthropic says it has ever measured. The target was the chain-of-thought transcripts of Opus 4.6 and Opus 4.7. Alibaba's pipeline injected a fixed prompt into every request that forced Claude to write its reasoning inside inline text tags before the final answer, then converted the saved transcripts into supervised fine-tuning data. Anthropic states this data was used to distill Claude's capabilities into Qwen 3.5, 3.6, and 3.7.

Account operations are described in detail. Alibaba ran two account pools, the first consisting of nearly 5,000 fraudulent accounts that hid their access behind residential proxies, disposable emails, and virtual-card payments. When Anthropic banned that pool, traffic shifted immediately to the second. Some of those accounts were also funneling requests from DeepSeek and Xiaomi, which means the same proxy service networks serve multiple organizations.

Uses beyond distillation appear as well. Alibaba used Claude to help build internal model-development infrastructure, develop reinforcement learning environments, and advance model architecture research. The targeted tasks were agentic work, software engineering, kernel development, and long-horizon tasks.

Moonshot and DeepSeek quietly forwarded their own customers to Claude

GTG-16002, the Moonshot case, is different in kind. Moonshot, which produces the Kimi family of models, forwarded customer requests to Claude instead of serving them with Kimi, then displayed Claude's responses to its users. In one instance, roughly 300,000 customer requests were relayed to Anthropic over a ten-day period, the vast majority routed to Opus. The proxy network used 5,380 fraudulent accounts, most of which appeared to be in Singapore and Japan.

The technical bypass turns on the thinking signature. Claude returns a signature in place of its raw reasoning, and the API looks up the raw trace on subsequent calls, which limits unauthorized distillation. Moonshot circumvented that control by saving the signature from a response, opening a new session, and eliciting Claude to convert the signature back into the full reasoning trace. Anthropic states it is introducing new methods to strengthen defenses against these cross-session replay attacks.

GTG-16001, DeepSeek, used the same replay attack, with a more selective targeting step. DeepSeek inspected strings in inbound requests to tag users working through third-party harnesses such as Claude Code, the Claude Agent SDK, and OpenCode, then relayed selected tagged users to Claude Opus. Observed scale reached more than 12.1 million exchanges over 14 days in July 2026, against Moonshot's more than 23 million between May and July.

Zhipu gave up on Fable and switched down to Opus 4.6

GTG-16006, the Zhipu case, contains a record of a safeguard actually working. Ahead of its GLM 5.3 release, Zhipu built capture-the-flag challenges from public vulnerability datasets and used them to run a distillation attack against the top model of another leading US frontier lab. Anthropic's model was targeted separately, primarily to evaluate and grade the other model's responses.

The target migration is the notable part. Zhipu first went after the cyber capabilities of Fable, Anthropic's top generally accessible model, and abandoned the attempt after strengthened cyber safeguards degraded the attacks. Zhipu employees then switched to Opus 4.6 and to another US lab's leading model, expressly because they assessed the safeguards there were weaker.

The volume is smaller than other cases but denser. Zhipu rotated through 273 fraudulent accounts to run a chain-of-thought extraction pipeline against Claude Opus 4.8 for ten days, and 770,609 exchanges passed through the extraction cleaner over a 10-day period in June. Over the same period Anthropic attributed more than 3 million exchanges to Zhipu, reaching more than 3.4 million across 17 days in June and July.

Ranking 151 million against 400,000 misreads the numbers

From here this is ASAP's reading. Turning these figures into a straight leaderboard produces a misreading, because the observation window differs case by case. Alibaba's 151 million covers roughly three months from May to July and Moonshot's 23 million the same span, but DeepSeek's 12.1 million covers 14 days in July, Zhipu's 3.4 million covers 17 days across June and July, and Xiaomi's 400,000 covers 20 days across March and April.

Divide by the window and the picture changes. Alibaba runs about 1.64 million a day over roughly 92 days, DeepSeek about 860,000 a day over 14, Zhipu about 200,000 a day over 17, and Xiaomi about 20,000 a day over 20. Alibaba's total is 12 times DeepSeek's, but its daily rate is less than double. Total volume is not a ranking of attack intensity, and the differing windows reflect that these are sums over detected intervals rather than whole campaigns.

Account counts deserve the same treatment. Against more than 3,500 for Alibaba, 5,380 for Moonshot, and more than 1,500 for Xiaomi, Zhipu's 273 does not signal weaker defenses on Anthropic's side but a different operating choice, namely higher throughput per account. Clearing 3 million exchanges in ten days across 273 accounts puts each account above 1,000 requests a day, the opposite of Alibaba's strategy of spreading load across account volume.

The route by which outside developers land in the victim list is the model router

The most operationally relevant part of the report is not the scale of distillation but the data exposure path. Anthropic states that DeepSeek, Xiaomi, and Moonshot fed conversations between their own models and their users into Claude, and that those exchanges contained sensitive information from individual users, major multinational companies, and state-affiliated actors. The exposed fields named are names, email addresses, and company data, covering hundreds of end users in at least a dozen languages. Anthropic adds that many of these exchanges were relayed from third-party model routing services commonly used in the United States and Europe.

That is exactly the route by which an outside engineering team lands in this list. Routing services that put several models behind one endpoint are in wide use. Read literally, the report describes requests that selected a Chinese lab's model at the router, passed through that lab's servers, and were forwarded to Claude, with the sender unable to know their prompt had reached a third party. That DeepSeek's selection filter keyed on coding harnesses like Claude Code and OpenCode means the exposed sample skews toward developers rather than general chatbot users.

Three checks follow. First, confirm in the contract and data-processing terms that any routing service in use actually serves the model it says it serves. Second, enforce secret masking at the harness layer, since prompts sent by coding agents routinely carry repository paths alongside credentials. Third, treat an unusually extended free trial on a new model as a possible traffic-acquisition play: Anthropic records that Xiaomi launched MiMo-V2-Pro on a free trial, extended it, and that the bulk of the distillation attacks began just as the trial was ending.

A defense that works as a version gradient cuts both ways

Zhipu's retreat from Fable down to Opus 4.6 is both proof that Anthropic's safeguards work and proof of their limit. The safeguard behaved as a gradient rather than a wall. Blocked at the newest model, the attack did not disappear but flowed one generation down, where Opus 4.6, 4.7, and 4.8 were still carrying commercial traffic.

Anthropic's own list of countermeasures shows the same shape. Adversarial extraction classifiers were strengthened alongside the launch of Fable 5, and both the summarized-reasoning behavior and Fable 5.1's preserved thinking attach to the newest generation. Preserved thinking blocks new API accounts from altering the system prompt, tools, or messages that precede Claude's reasoning in multi-turn conversations, which is precisely the context manipulation behind the cross-session replay attacks used by Moonshot and DeepSeek.

The practical significance of this disclosure is therefore closer to a change in cost structure than to the shutdown of specific campaigns. Anthropic states that rather than banning proxy accounts one by one, it attributes suspicious activity to a specific organization so enforcement can be comprehensive, and that abuse signals such as operation from unsupported countries including China, Russia, and Iran can trigger identity verification, with bans for accounts that fail it. That raises the cost of minting new accounts, and it loosens the moment the attribution work linking a proxy network to an organization fails.

Every attribution in this report is one company's judgment

The verification limits are clear. First, the attributions to Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax rest on Anthropic's own logs and internal investigation, described in the report as high confidence, with no third-party verification and no response from the named companies. Second, each exchange count is what Anthropic detected, which leaves undetected traffic outside these figures entirely.

Third, one of the report's central risk arguments rests on Anthropic's internal research. Anthropic states that a model distilled from a frontier model can help achieve dangerous capabilities in the biological or cyber domains even when the harvested exchanges contain little about those subjects. The experimental design and numbers behind that claim are not presented in the report, leaving a gap between the strength of the assertion and the evidence published with it.

Fourth, the SenseTime and MiniMax cases differ in evidentiary character from the rest. SenseTime is identified as having sourced Claude transcripts purchased from third-party data vendors, and MiniMax as having run a proxy service through a shell company that offers access only to Anthropic and OpenAI models and to no Chinese models, including its own. Unlike the five cases carrying exchange counts, neither carries a quantitative figure, and the MiniMax finding rests on what the service composition implies.

Taken together, this report documents not the existence of distillation attacks but their degree of industrialization. Three million exchanges a day, 5,380 accounts, and the data of hundreds of end users across at least a dozen languages are not the footprint of individual hackers, and Anthropic's decision to write down corporate names carries its own judgment that technical controls alone will not settle the problem.

Source: Anthropic threat intelligence report "Detecting and countering misuse of AI: September 2026" (September 10, 2026), illicit distillation section