Anthropic says Chinese AI labs ran nearly 190 million Claude distillation exchanges

In its September 2026 threat-intelligence report, Anthropic says it identified industrial-scale attempts by five Chinese AI laboratories to extract capabilities from Claude, with the quantified campaigns involving at least 189.9 million exchanges.

The activity was attributed to Alibaba, Moonshot AI, DeepSeek, Z.ai and Xiaomi, with reported targets including reasoning, coding, agentic behavior, data analysis, model evaluation and synthetic training-data generation.

The numbers are highly concentrated.

Based on the minimum figures disclosed by Anthropic, Data Studios calculates that Alibaba alone represents about 79.5% of the quantified exchanges, while Alibaba, Moonshot and DeepSeek together account for approximately 98%.

There is also a second issue beyond model distillation.

Anthropic alleges that Moonshot and DeepSeek forwarded some user requests to Claude while customers believed they were interacting with their own models, creating a separate question about privacy, enterprise data routing and disclosure.

These attribution claims and exchange counts originate from Anthropic's own investigation and have not been independently verified by Data Studios.

The most useful way to understand the report is therefore to separate two distinct AI supply chains: one transfers model capabilities through training data; the other can transfer user prompts through hidden inference routing.

........

Laboratory attributed by Anthropic	Minimum observed exchanges	Reported activity	Data Studios share of quantified total
Alibaba / Qwen	151M+	Reasoning extraction and model development	79.5%
Moonshot AI / Kimi	23M+	Distillation and forwarding of user requests	12.1%
DeepSeek	12.1M+	Selective routing and capability extraction	6.4%
Zhipu / Z.ai	3.4M+	Training-data generation, evaluation and reasoning extraction	1.8%
Xiaomi / MiMo	400K+	Conversation replay and training-data generation	0.2%

........

Data Studios minimum calculation: 151.0M + 23.0M + 12.1M + 3.4M + 0.4M = 189.9M exchanges.

Because several reported figures are expressed as “more than,” 189.9 million should be read as a floor, not an exact total.

··········

ALIBABA DOMINATES THE REPORTED DISTILLATION VOLUME

The scale of the activity is not evenly distributed across the five companies named by Anthropic.

Alibaba accounts for almost four-fifths of the quantified total.

Anthropic says its largest identified Alibaba-linked operation exceeded 151 million exchanges and at one point approached 3 million exchanges per day.

The operation reportedly relied on thousands of accounts and intermediary infrastructure designed to maintain access at a scale far beyond normal individual use.

At that level, Claude is no longer functioning simply as a chatbot answering occasional questions.

It is effectively being used as a high-volume synthetic-data generator.

That distinction matters because modern model development increasingly depends not only on raw internet text, but also on carefully selected examples generated by stronger models.

A frontier system can produce difficult coding problems, reasoning traces, agent trajectories, evaluations and corrected answers that can later become training material for another model.

The competitive asset is therefore not only the model itself, but the behavior the model can generate at scale.

··········

DISTILLATION CAN TRANSFER CAPABILITIES WITHOUT REPEATING THE ENTIRE TRAINING PROCESS

Model distillation uses a stronger teacher model to help train a weaker or smaller student model.

The mechanism is legitimate and widely used in machine learning.

A developer can ask the teacher model to solve tasks, explain difficult problems, write code, use tools or evaluate candidate answers.

The resulting outputs can then be incorporated into a new training dataset.

The student does not receive the teacher's weights.

Instead, it learns from examples of the teacher's behavior.

For a simple task, that may mean learning from pairs such as:

Prompt → high-quality answer

For more complex systems, the training material can contain much richer information:

Prompt → task decomposition → intermediate reasoning → tool selection → verification → final output

The second form is potentially far more valuable.

It reveals not just what the model answered, but how a capable system structures difficult work.

This can reduce the amount of independent experimentation required during post-training.

Anthropic describes the reported campaigns as illicit because it says the outputs were obtained through methods intended to bypass its restrictions, including large numbers of accounts, proxy infrastructure and automated extraction.

The underlying economic incentive is straightforward.

If another frontier model can generate high-quality training trajectories, obtaining those trajectories may be cheaper than independently discovering all of the same behaviors.

··········

REASONING TRACES WERE A PARTICULARLY VALUABLE TARGET

Several of the campaigns reportedly attempted to extract more than Claude's visible final response.

Reasoning data can expose how a model breaks a difficult problem into smaller components, identifies errors, chooses tools and changes direction when an initial approach fails.

That is especially useful for workloads such as:

• software engineering

• mathematics

• research

• data analysis

• multi-step agent tasks

• tool use

Anthropic says one operation tested more than 12,000 requests using different extraction techniques before scaling methods that appeared more successful.

The practical distinction is important.

A dataset containing one million ordinary answers is not necessarily equivalent to a dataset containing one million carefully selected reasoning trajectories.

Exchange volume measures activity, but it does not directly measure the amount of capability successfully transferred.

That is one of the main limitations of interpreting the headline figure.

··········

MOONSHOT AND DEEPSEEK RAISE A DIFFERENT ISSUE: THE USER MAY NOT KNOW WHICH MODEL RECEIVES THE PROMPT

The allegations concerning model routing have different implications from the distillation claims.

Anthropic says Moonshot sometimes forwarded customer requests to Claude while users believed they were interacting with Kimi.

It also alleges that DeepSeek selectively forwarded some requests, including requests originating through coding environments, to Claude.

If accurate, this changes the problem from model competition to data governance.

Consider a hypothetical finance manager using an AI assistant to troubleshoot a forecasting model.

The prompt might include:

• internal revenue forecasts

• customer-level information

• confidential pricing assumptions

• database structures

• temporary credentials

• unreleased product data

If the company has approved Provider A, its security review may assume that Provider A is the system processing those prompts.

If Provider A silently forwards selected requests to Provider B, a second company enters the data-processing chain.

The practical question is no longer simply:

Which AI provider are employees using?

It becomes:

Which providers, routers and fallback models can ultimately receive company data?

That is becoming increasingly important as AI products use automatic model routing to optimize for quality, latency, cost or availability.

··········

DATA STUDIOS MAPS TWO DIFFERENT AI SUPPLY CHAINS IN THE REPORT

Training extraction and inference routing should not be treated as the same problem.

Data Studios maps the activity described by Anthropic into two separate architectures.

........

Supply chain	Simplified flow	Main risk
Training supply chain	Frontier model → generated outputs → synthetic dataset → competing model	Capability transfer, access controls, competitive advantage
Inference supply chain	User → AI service → router/intermediary → external model → response	Privacy, governance, contractual disclosure, data residency

........

The first chain is about who can learn from a frontier model.

The second is about who can see the user's data.

Those questions may overlap technically, but they create different obligations for companies.

A business could accept external model usage for training under a contractual agreement while prohibiting hidden prompt forwarding.

Conversely, a company might allow multi-model inference routing but restrict the use of those outputs for training.

The strongest practical insight from the report is therefore not simply that AI laboratories may copy one another's behavior.

It is that the AI stack increasingly contains hidden intermediaries between both models and training pipelines, and between users and the systems actually processing their prompts.

··········

Z.AI SHOWS THAT A FRONTIER MODEL CAN SUPPORT MULTIPLE STAGES OF ANOTHER MODEL’S DEVELOPMENT

A teacher model can be useful far beyond generating answers.

Anthropic attributes more than 3.4 million exchanges to Z.ai-related activity and describes Claude being used across several parts of the development process.

These reportedly included generating tasks, producing candidate solutions, evaluating outputs, cleaning reasoning material and filtering training examples.

That illustrates why access to a frontier model can have greater value than the raw number of responses suggests.

The external model can act as:

• a data generator

• an evaluator

• a critic

• a reasoning teacher

• a quality-control system

A laboratory using the same model across several of these functions can effectively outsource part of its post-training workflow.

This is also why simple API-volume comparisons can be misleading.

The value of 1 million requests depends heavily on what those requests are doing.

One million routine answers may contribute little to model improvement.

A much smaller set of carefully designed evaluation and reasoning tasks can be materially more useful.

··········

THE 189.9 MILLION FIGURE DOES NOT MEASURE HOW MUCH CAPABILITY WAS ACTUALLY TRANSFERRED

The disclosed exchange count establishes scale, not effectiveness.

Data Studios can reproduce the arithmetic behind the minimum total.

It cannot infer from those counts alone how much the target models improved.

Several variables would matter:

• quality of the extracted outputs

• diversity of the tasks

• amount of duplicate data

• filtering quality

• student-model architecture

• post-training methodology

• weighting of synthetic examples

• availability of comparable internal datasets

The reported total also covers only activity Anthropic says it detected.

It does not measure undetected traffic, authorized distillation arrangements or similar activity involving other frontier-model providers.

The correct interpretation is therefore narrower:

Anthropic says it detected at least 189.9 million exchanges associated with these five campaigns.

That is evidence of reported scale.

It is not a direct benchmark of capability transfer.

··········

MODEL OUTPUTS ARE BECOMING PART OF THE FRONTIER-AI MOAT

AI competition increasingly extends beyond chips, researchers, datasets and model weights.

A strong model can produce another strategic resource: high-quality synthetic trajectories.

Those trajectories can contain examples of reasoning, coding, planning, tool use, evaluation and self-correction.

The laboratory that already owns a frontier model can generate that material internally.

A competitor without an equally capable teacher must either create comparable data using weaker models, improve its models independently, obtain licensed access to another system or find another way to acquire higher-quality outputs.

This gives rate limits, identity controls, automated-abuse detection and extraction restrictions a strategic role.

They are not only anti-spam mechanisms.

They can also protect part of the post-training advantage embedded in the model's observable behavior.

··········

THE COMPETITIVE BOUNDARY IS MOVING FROM MODEL WEIGHTS TO MODEL BEHAVIOR

The most important implication is that a deployed AI model can itself become a source of valuable training data.

Protecting model weights is therefore no longer sufficient to protect every economically valuable part of a frontier system.

The behaviors produced after deployment can also be collected, evaluated and reused.

At the same time, automatic model routing means users and companies increasingly need to know which systems actually receive their prompts, not merely which brand appears in the interface.

The Anthropic report therefore exposes two emerging control problems at once: protecting frontier-model behavior from industrial extraction and making the real inference path visible to the user.

··········

FOLLOW US FOR MORE.

DATA STUDIOS

datastudios.org