News Date: 2026-09-11
Anthropic has disclosed what it describes as industrial-scale illicit distillation campaigns conducted by seven China-based artificial intelligence laboratories. The operations allegedly used fraudulent accounts, proxy networks, stolen payment information and compromised API keys to collect large volumes of Claude responses for training competing models.
Legitimate Technique, Unauthorized Collection
Knowledge distillation is normally a legitimate engineering method in which a smaller model learns from the output of a more capable model. The security and intellectual-property problem begins when an organization secretly extracts those capabilities without authorization or collects conversations that users did not knowingly agree to share.
Anthropic attributed the campaigns to operators associated with Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax. One operation reportedly generated 151 million exchanges between May and July 2026, peaking at about three million interactions per day across more than 3,500 fraudulent accounts. Other campaigns allegedly relayed requests from users of competing services to Claude and retained the responses as training material.
This is not simply a dispute over model competition. Some exchanges reportedly contained information belonging to individuals, multinational companies and state-affiliated users. Proxy providers that record prompts and responses can therefore become an overlooked concentration point for confidential business data, source code, personal information and internal instructions.
Defensive Priorities
- Treat AI API keys as production credentials and rotate them after any suspected exposure.
- Block unapproved AI relay services and require employees to use sanctioned enterprise platforms.
- Monitor unusual API volume, rapid account creation and geographically inconsistent requests.
- Prevent sensitive prompts, customer records and proprietary code from entering unverified AI services.
- Review contracts to determine whether AI intermediaries retain, resell or reuse conversation data.
- Apply data-loss prevention controls to prompts and uploaded files.
Anthropic says it has strengthened identity checks, restricted suspicious reseller access and changed how model reasoning is exposed to make collected transcripts less useful.
Expert View
I believe AI security teams must expand their definition of data theft. Attackers are no longer interested only in databases and documents. Model behavior, reasoning patterns, tool-use methods and user conversations are valuable assets. Enterprises should assume that an unknown AI proxy may function as both a service provider and a data collector, making approved access paths and strong credential governance increasingly important.