Anthropic said on February 24 that three Chinese AI companies, DeepSeek, Moonshot AI and MiniMax, ran coordinated campaigns to extract reasoning and coding outputs from its Claude models through thousands of fraudulent accounts. The company described the activity as industrial-scale “distillation attacks” aimed at copying Claude’s capabilities into rival models.
In a post on its website, Anthropic said it had identified roughly 24,000 fake accounts and more than 16 million exchanges with Claude tied to the three labs. According to the company’s breakdown, MiniMax accounted for more than 13 million interactions, Moonshot AI for more than 3.4 million, and DeepSeek for about 150,000. Anthropic said the pattern of requests pointed to a deliberate, long-running strategy rather than ordinary use of the service.
What distillation is
Distillation is a standard machine learning technique in which a smaller model is trained on the outputs of a larger, more capable one, so that it inherits some of the larger model’s behavior at lower cost. The method itself is legitimate and widely used, including by frontier labs on their own models.
The dispute is about how the outputs are obtained. Anthropic’s terms of service prohibit using Claude to build competing models, and the company says the labs disguised their activity behind fake accounts to avoid detection. When outputs are harvested covertly and in violation of usage rules, Anthropic argues, the practice raises questions of intellectual property and model security rather than technical merit.
A widening dispute
Anthropic’s statement is not the first of its kind. In January 2025, OpenAI said it had found evidence that DeepSeek had used distillation of OpenAI models in building its own systems. CNBC reported that Google also flagged, around the same time as Anthropic’s disclosure, attempts to extract knowledge from its Gemini models in a similar fashion.
Taken together, the claims suggest that competition among frontier model developers is increasingly a contest over who can protect their models’ behavior, not just who can build the most capable system. Anthropic said it has strengthened its detection and account-enforcement systems and is sharing information with other developers and with policymakers.
The three companies named in the report had not publicly responded to Anthropic’s specific allegations at the time of the company’s announcement. Chinese developers have previously rejected accusations of improper training practices, and DeepSeek did not respond to CNBC’s request for comment.
Why it matters
If reasoning and coding behavior can be extracted at scale from a deployed model, the cost advantage of training a frontier system shrinks, which affects the business case for the hundreds of billions of dollars being spent on compute. It also complicates export-control policy: Anthropic framed the campaigns as a way for Chinese labs to work around restrictions on advanced chips by borrowing capability from U.S. models instead of training from scratch.
How effective the campaigns were is unclear. Anthropic did not quantify how much of the rival models’ performance, if any, derives from Claude outputs, and independent researchers have not verified the company’s attribution of the accounts to the three labs.
