Anthropic names names

In a threat report out Thursday, Anthropic said it caught and shut down large-scale efforts by Alibaba, Moonshot and DeepSeek to train their models on Claude.

What illicit distillation means

You pump a stronger model for outputs, then feed those outputs to your own model so it copies the behavior. Doing it without permission breaks the terms of service.

“outputs from a more capable AI model are used to train another model and replicate some of its capabilities without authorization”

151 million exchanges

Anthropic calls the Alibaba campaign the biggest it has ever measured: 151 million exchanges between May and July, peaking near 3 million a day from 3,500-plus fake accounts.

Kimi users got Claude

Moonshot quietly forwarded some Kimi customer requests to Claude and showed Claude's answers back as Kimi's. In one 10-day stretch that was nearly 300,000 requests.

Reasoning traces harvested

Anthropic says Moonshot kept some of those exchanges and pulled out Claude's reasoning transcripts as training data. Total attributed to Moonshot: over 23 million exchanges.

Private data went along

Some relayed requests carried sensitive information from individuals, multinationals and state-linked actors. DeepSeek ran a similar relay, 12 million attacks in 14 days of July 2026.

“These practices are likely inconsistent with privacy laws and the labs' own terms of service”