Chinese AI firms targeted Claude's key capabilities, Anthropic says
What's the story
Anthropic has accused China-based artificial intelligence (AI) companies of conducting distillation attacks, a practice that has become more common in recent months. The company claims that these unauthorized labs have developed advanced techniques to bypass their defenses and extract capabilities from US frontier models. The report highlights that the campaigns targeted some of Claude's most valuable capabilities, including agentic capabilities and tool use, coding and data analysis, as well as logical reasoning.
Prior alerts
Distillation attacks on the rise
Back in February, Anthropic had warned about distillation attacks, even naming specific labs involved.
OpenAI also reported similar activities, specifically blaming DeepSeek.
However, the campaigns detailed in Anthropic's latest report are larger and more aggressive.
The company recorded nearly 200 million exchanges linked to these attacks across five different campaigns.
Attack mechanism
What are distillation attacks?
Distillation attacks are mainly focused on extracting a model's chain of thought from its responses to different queries.
This extracted chain can be used to train a smaller model on general reasoning ability through supervised fine-tuning.
Typically, Anthropic doesn't provide users with the internal chain of thought of its models and only shows "summarized thinking" blocks giving a general overview.
However, these distillation campaigns found specific techniques to trick the model into revealing its thinking traces directly.
Major player
Alibaba's Qwen family of models driving most of the attacks
The majority of the distillation attempts were linked to a campaign attributed to Alibaba, which Anthropic calls the biggest wholesale distillation effort it has ever seen.
Between May and July 2026, the company observed 151 million exchanges related to this campaign, peaking at nearly three million exchanges per day.
These exchanges were spread across 3,500 different accounts, but since they all used a single fixed prompt to extract the chain of thought, Anthropic attributed them all to one effort.
Military link
Chinese military linked to Moonshot AI's campaign
Another campaign from Moonshot AI, the maker of Kimi, appeared to route requests directly from the Chinese military.
One request asked Claude to analyze a trove of closed-circuit television footage for signs of "behaving abnormally."
Over a 10-day period, nearly 300,000 requests were routed to Claude through a network of 5,000 accounts. These mainly targeted the company's Opus model.