U.S. artificial intelligence company Anthropic said it detected and disrupted large-scale efforts by China-based AI labs to use Claude to train and improve their own models. In a threat intelligence report released by the company, Anthropic named Alibaba, Moonshot and DeepSeek among the firms involved.
Anthropic described the activity as “illicit distillation,” a process in which outputs from a more capable model are used to train another model and replicate part of its capabilities without authorization. According to the company, some of the exchanges included sensitive information from individual users, major multinational companies and state-affiliated actors. The report says such practices are likely inconsistent with privacy laws and with the labs’ own terms of service.
Anthropic said operators affiliated with Alibaba used Claude outputs to help train Qwen models. The company called it the largest distillation campaign it has measured, involving more than 151 million exchanges with Claude between May and July.
At its peak, the activity reached nearly 3 million exchanges per day through more than 3,500 fraudulent accounts, the report said. Anthropic also alleged that Alibaba used Claude for broader AI research, including reinforcement learning and model architecture work.
Moonshot and DeepSeek
Anthropic also detailed activity involving Moonshot AI, the Beijing-based company behind the Kimi family of AI models. According to the report, Moonshot quietly forwarded some customer requests intended for Kimi to Claude, then displayed Claude’s responses to users who believed they were interacting with a Kimi model.
Anthropic said that during one 10-day period, Moonshot relayed nearly 300,000 customer requests to Anthropic, with the vast majority routed to Claude Opus models. Those requests were sent through a network of 5,380 accounts that Anthropic described as fraudulent, most of which appeared to be located in Singapore and Japan.
The report said Moonshot saved at least some of those exchanges and extracted Claude’s reasoning transcripts to use as training data for its own models. In total, Anthropic attributed more than 23 million exchanges to Moonshot between May and July.
The company also said some of the requests routed to Claude contained sensitive information. Anthropic added that it did not know whether Moonshot had informed customers that their requests were being sent to Anthropic.
On DeepSeek, Anthropic said the company used tactics similar to Moonshot, transferring exchanges to Claude without notifying DeepSeek customers. Anthropic said it observed more than 12 million distillation attacks attributable to DeepSeek over 14 days in July 2026.
The findings are part of a broader Anthropic report covering misuse of its AI systems between December 2025 and August 2026. The report spans seven categories, including cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and distillation.
Alibaba, Moonshot, DeepSeek, Xiaomi and Anthropic did not immediately respond to CNBC requests for comment.
