In its September 2026 threat intelligence report, published on September 10, Anthropic accuses seven China-based AI labs of running industrial-scale “illicit distillation” campaigns against its Claude models. Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax are named. The Alibaba case alone exceeds 151 million exchanges between May and July 2026. Beyond the rivalry between AI vendors, this matters directly to enterprises: stolen API keys, opaque proxy services and customer requests relayed without their knowledge are all part of the playbook.
- Seven Chinese labs are named; five come with a minimum exchange count, two are described without figures.
- The attackers sought to extract Claude’s reasoning to turn it into training data, using thousands of fraudulent accounts.
- Access relied on reseller proxies, fake identities, stolen payment cards and stolen API keys, including keys belonging to legitimate businesses.
- Moonshot AI, DeepSeek and Xiaomi allegedly relayed their own users’ real requests to Claude without those users knowing.
- Anthropic responds with layered defenses: organization-level attribution, extraction classifiers, summarized reasoning and identity verification.
What Anthropic disclosed
The report, “Detecting and countering misuse of AI: September 2026”, covers all misuse disrupted between December 2025 and August 2026. Its final section is dedicated to illicit distillation, which Anthropic describes as an industrial-scale, covert campaign to extract a model’s capabilities without authorization, typically enabled by fraudulent accounts. The company stresses that distillation itself is a common training technique: what is at stake is its unauthorized use at scale. Attributions are presented with high confidence.
| Lab | Period | Exchanges (minimum) | Accounts | Specifics |
|---|---|---|---|---|
| Alibaba (Qwen) | May–July 2026 | Over 151 million | Over 3,500 at peak | Nearly 3 million exchanges per day at peak; targeted Opus 4.6 and 4.7 |
| Moonshot AI (Kimi) | May–July 2026 | Over 23 million | 5,380 in one ten-day operation | Almost 300,000 customer requests relayed to Claude |
| DeepSeek | 14 days in July 2026 | Over 12.1 million | Not disclosed | Requests from coding-tool users relayed to Opus |
| Zhipu (Z.ai) | 17 days, June–July 2026 | Over 3.4 million | 273 | Used Claude to “clean” captured reasoning traces |
| Xiaomi | 20 days, March–April 2026 | Over 400,000 | Over 1,500 | Replayed sessions from users of its own models through Claude |
| SenseTime | Not disclosed | No count | Not disclosed | Bought Claude transcripts from data vendors |
| MiniMax | Not disclosed | No count | Not disclosed | Ran a proxy service through a shell company offering only Anthropic and OpenAI models |
Anthropic describes the Alibaba-attributed campaign as the largest distillation attack it has ever measured. In February 2026, the company had already named DeepSeek, Moonshot AI and MiniMax, citing more than 16 million exchanges through roughly 24,000 fraudulent accounts.
How the techniques worked
Extracting reasoning, not just answers
The main target was the model’s reasoning, which is especially valuable for training a competitor. Alibaba injected a fixed prompt forcing Claude to write its reasoning inside inline tags, which were then converted into supervised fine-tuning data. Other attempts asked the model not to flag the request, framed it as a debugging session, impersonated the operator with fake system prompts, or asked Claude to “translate” its earlier reasoning. One lab tested more than 12,000 requests, each using a different technique, before scaling up the ones that worked.
Cross-session signature replay
Moonshot AI and DeepSeek saved the encrypted “thinking signature” returned by Claude, opened a new session and got the model to turn that signature back into the full reasoning trace. Anthropic says it is developing new defenses against this kind of replay, without detailing how they work.
Users relayed without their knowledge
The most sensitive point for enterprises: some platforms forwarded their customers’ real requests to Claude, then displayed the answers as if they came from their own model. Kimi users believed they were talking to Kimi. DeepSeek identified users of third-party coding tools through string matching and relayed a selection of their requests. Xiaomi replayed saved sessions from users of its MiMo models.
An ecosystem of proxies and resellers
Because Claude is not sold in China, access relied on proxy services (“transfer stations”) fed by fake identities, stolen or fake payment cards and stolen API keys, including keys belonging to legitimate businesses. Some of these networks resold harvested exchanges to other labs, and the same infrastructure served several organizations.
Why it matters for your organization
This case goes beyond AI vendors’ intellectual property. Three risks directly concern enterprises:
- Your AI API keys are valuable: they are stolen and resold to feed these networks. A key exposed in a code repository or on a compromised workstation can generate significant costs and create liability for your organization.
- Your data may flow through an unexpected model: a third-party service may relay your requests to another provider without transparency, raising immediate confidentiality, data residency and compliance questions.
- Distilled models do not necessarily inherit safeguards: a model trained on extracted outputs may reproduce capabilities without the associated protections, which calls into question the use of models with poorly documented provenance.
MITRE ATLAS and ATT&CK mapping
The report does not map the activity to these frameworks. The table below is an indicative Defensy reading; MITRE ATLAS, dedicated to attacks on AI systems, is more relevant here than ATT&CK.
| Technique | Observed behavior |
|---|---|
| AML.T0040 — ML Model Inference API Access | Massive querying of the Claude API through thousands of accounts |
| AML.T0024.002 — Extract ML Model | Harvesting answers and reasoning to train a competing model |
| AML.T0054 — LLM Jailbreak | Fake system prompts and phrasing designed to bypass safeguards |
| T1078 — Valid Accounts | Use of API keys stolen from legitimate businesses |
| T1090 — Proxy | Access through reseller proxy services to hide the origin |
Recommendations
- ImmediateInventory and protect your AI API keys
List the AI provider keys used across the organization, store them in a secrets vault, scan your code repositories for them, and revoke any exposed or unused key.
- ImmediateMonitor API consumption
Set alerts on volumes, daily spikes and unusual origins. A sudden jump in consumption can signal a stolen and resold key.
- Short termCheck your AI supply chain
Require vendors and third-party tools to disclose which models they actually use, where processing takes place and which subcontractors are involved. Rule out opaque intermediaries.
- Short termControl data sent to AI services
Classify which data may leave the organization and enforce DLP rules on flows to generative AI platforms.
- Medium termAssess the provenance of adopted models
Before integrating a third-party or open-weight model, document its origin, known training conditions and safeguards as part of your AI governance.
These campaigns show that AI has become a strategic asset, and that its access and data are stolen and resold like any other asset. API keys, data flows and vendor choices are now part of security governance.
Our Secure AI Adoption offering helps you govern your usage, vendors and models, while Data Protection & Governance secures the information you entrust to these services.
- Detecting and countering misuse of AI: September 2026Anthropic — September 10, 2026
- Anthropic distillation campaigns: Alibaba, Moonshot, DeepSeek (analysis)Progressive Robot — September 11, 2026
- Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation AttacksThe Hacker News — September 2026
