Incident Overview
On February 23, 2026, Anthropic publicly disclosed that three Chinese AI development organizations—DeepSeek, Moonshot AI, and MiniMax—had conducted large-scale, unauthorized distillation campaigns targeting its Claude model. The campaigns involved the creation of thousands of fraudulent accounts and the use of proxy services to generate over 16 million interactions with Claude. These actions violated Anthropic’s terms of service and access restrictions, as the exchanges were designed to extract model capabilities for competitive advantage.
Anthropic’s report marked the second major public allegation of unauthorized capability extraction from a frontier AI model, following the 2025 dispute between OpenAI and DeepSeek. The disclosure highlighted concerns over industrial-scale model theft, which could undermine the integrity of AI development ecosystems and pose risks to national security, particularly if extracted capabilities were repurposed for malicious use, such as offensive cyber operations.
The incident was confirmed by Anthropic, which stated that it had detected the campaigns through internal monitoring systems and subsequently banned the implicated accounts. The company also emphasized its commitment to sharing detection indicators and strengthening account controls to prevent similar breaches in the future. The allegations were framed within broader geopolitical tensions, as U.S.-based Anthropic accused Chinese AI labs of engaging in practices that could accelerate the development of rival AI systems without ethical or legal constraints.
The scale of the operation—spanning millions of exchanges—demonstrated a systematic effort to bypass security measures, including rate limits and authentication protocols. Anthropic’s statement suggested that the fraudulent accounts were likely managed by proxy reseller services, further complicating attribution and enforcement efforts.
Possible Root Cause
Anthropic’s report indicated that the attackers exploited weaknesses in its account management and rate-limiting systems, using fraudulent accounts and proxy infrastructure to evade detection. The use of proxy services allowed the perpetrators to distribute requests across a vast network, making it difficult for Anthropic to trace the origin of the activity or block it effectively.
Competitive pressures likely played a significant role in motivating the campaigns. DeepSeek, Moonshot AI, and MiniMax are among China’s most prominent AI laboratories, each vying to develop advanced models that can rival those of Western counterparts like Claude. The extraction of capabilities from Claude would have provided these labs with a shortcut to enhancing their own models, potentially accelerating their research timelines without the need for independent training on comparable datasets. This aligns with a broader trend observed in the AI sector, where proprietary models are increasingly targeted for capability extraction.
While Anthropic implemented detection measures and account controls, the incident underscored the challenges of enforcing these measures in an environment where adversarial actors can rapidly adapt their tactics. The involvement of proxy reseller services also suggested a commoditized market for fraudulent AI interactions, where bad actors can purchase access to large-scale automation tools designed to bypass security protocols.
However, the scale of the operation implied that the attackers had identified and exploited specific gaps in Anthropic’s defenses, whether through technical flaws or operational oversights. The use of industrial-scale methods further indicated a high level of coordination and resource allocation, suggesting that the perpetrators were well-funded and technically sophisticated.
Takeaways
The incident serves as a critical case study in the risks associated with unauthorized model extraction, particularly as frontier AI models become more valuable targets for competitive and malicious actors. One key takeaway is the urgent need for improved detection and mitigation strategies within the AI industry. Anthropic’s response—including the sharing of detection indicators and the enforcement of stricter account controls—demonstrates a reactive approach to securing its models.
The involvement of Chinese AI laboratories in this incident has reinforced concerns in the U.S. and other Western countries about the ethical and security implications of AI development in regions with less stringent regulatory oversight.
The use of fraudulent accounts and proxies in this case indicates that attackers are increasingly focusing on the supply chain of AI interactions, rather than just the models themselves. Organizations must invest in robust authentication mechanisms, anomaly detection systems, and real-time monitoring to identify and neutralize such threats before they escalate.
While public APIs and models drive innovation, they also create opportunities for exploitation by actors with malicious or competitive intent.
Finally, the case of Claude’s unauthorized distillation campaigns should serve as a warning to AI organizations about the evolving tactics of adversarial actors. The use of industrial-scale methods, proxy infrastructure, and fraudulent accounts suggests that future attacks may involve even more sophisticated techniques, such as adversarial machine learning or social engineering.
Sources
Incident summary from the AI Incident Database, used under CC BY-SA 4.0.