Anthropic says three Chinese AI labs distilled millions of queries from Claude to replicate its capabilities, triggering an unprecedented security alliance among US rivals.
Anthropic has published detailed findings accusing DeepSeek, Minimax, and Moonshot AI of running what amounts to an industrial heist on its flagship AI model. The mechanism is called model distillation, and it is disarmingly elegant. Rather than training a model from scratch at enormous expense, you query a sophisticated target model millions of times, harvest its responses, and use that data to train your own student model. The result is a replica that captures much of the original's reasoning power without the billions in R&D investment.
The scale Anthropic describes is considerable. According to a technical report published by the company in late February, the three Chinese firms collectively fired roughly 16 million queries at Claude through automated systems designed to extract reasoning data. That volume, Anthropic argues, bears no resemblance to standard usage. It looks like systematic reverse engineering.
For anyone unfamiliar with the technique, model distillation is not a new concept in machine learning research. Academics have explored it for years as a compression method. What has changed is the sophistication of the approach and the stakes involved. Training a frontier model like Claude or GPT-4 reportedly costs well over $100 million in compute alone, not accounting for talent, infrastructure, and multiple failed iterations. Distillation can dramatically shortcut that process. A well-executed distillation campaign might produce a model that performs within striking distance of the original for a fraction of the cost, which is precisely why US labs consider it an existential threat to their competitive advantage.
As the Financial Times recently noted, the united front among OpenAI, Anthropic, and Google represents a remarkable departure from their usual posture of fierce independence. These companies compete aggressively for talent, enterprise contracts, and benchmark supremacy. That they are now sharing intelligence on security threats tells you how seriously they view the distillation problem. Anthropic has also launched Project Glasswing, an initiative focused on hardening software infrastructure against what it characterizes as AI-era espionage.
The hypocrisy problem
The accusations have not gone unchallenged. Elon Musk was among the first to highlight the awkward optics, pointing out that Anthropic itself settled a $1.5 billion copyright lawsuit in September 2025 after admitting it had trained on copyrighted works without permission. The irony is hard to miss. A company that built its models by scraping vast troves of human-created text is now crying foul when someone else does a version of the same thing to its output.
There is also a market incentive angle worth considering. Chinese AI models have been gaining ground rapidly, driven in part by significantly lower pricing. DeepSeek's models, for instance, have attracted global attention for delivering competitive performance at costs that undercut US offerings. Some industry analysts suggest the distillation narrative serves a convenient secondary purpose: building a case for regulatory protectionism against cheaper foreign competitors just as pricing pressure intensifies across the sector.
The policy gap
For policymakers, this creates a deeply uncomfortable paradox. The United States has spent years tightening export controls on advanced Nvidia chips, attempting to slow China's AI progress by restricting access to cutting-edge hardware. Yet if Chinese firms can replicate frontier model capabilities through remote data extraction, chip bans alone are an incomplete solution. You can lock down the physical supply chain all day long, but if the intellectual property flows freely through APIs, the horse has already left the barn. Based on reporting from Bloomberg, Capitol Hill staffers are now drafting legislation that would extend export control frameworks to cover software-level IP theft, though any such measure would be fiendishly difficult to enforce across international borders.
What makes this moment consequential is that it forces a structural question the industry has been avoiding. If the primary value of a frontier model can be distilled through clever querying, then the moat around these businesses is thinner than investors have assumed. The coming months will reveal whether technical countermeasures like real-time distillation detection and IP blocking can meaningfully protect these assets, or whether the economics of AI development are about to get a lot more brutal for everyone.
