Anthropic says three Chinese labs distilled Claude through 24,000 fake accounts, and open-weight provenance just got harder to ignore
Anthropic's September threat report says DeepSeek, Moonshot, and MiniMax ran over 16 million distillation exchanges through roughly 24,000 fraudulent accounts to copy Claude's agentic and coding abilities, with MiniMax pivoting to a newly released Claude within 24 hours.
Anthropic used its September threat intelligence report to name names. It says three Chinese AI labs, DeepSeek, Moonshot AI, and MiniMax, ran coordinated campaigns to copy Claude’s capabilities by feeding its outputs into their own training, a practice the report calls illicit distillation. The scale it describes is the headline: more than 16 million exchanges with Claude across roughly 24,000 fraudulent accounts created to evade Anthropic’s access controls and terms of service. The labs did not respond to requests for comment, and the allegations are Anthropic’s rather than an independent finding. But the report is specific enough, and the technique common enough, that it changes how carefully teams should think about where an open-weight model’s abilities came from.
What the report describes
Distillation, in the legitimate sense, is a standard technique: train a smaller model on a larger one’s outputs. What Anthropic alleges is the unauthorized version, systematically harvesting Claude’s responses at scale to replicate frontier behavior without permission. The report breaks the activity down by lab. It attributes over 13 million exchanges to MiniMax, the largest share, targeting agentic coding and tool orchestration. It attributes over 3.4 million to Moonshot AI, the maker of the Kimi models, aimed at agentic reasoning, tool use, coding, computer-use agents, and computer vision. And it attributes over 150,000 to DeepSeek, focused on reasoning, on rubric-based grading that made Claude act as a reward model, and on generating what the report calls censorship-safe alternatives to policy-sensitive queries. The common thread is that all three went after the capabilities that are hardest to build and most valuable to copy: not raw knowledge, but agentic reasoning and coding.
The MiniMax timing is the sharp part
The most striking claim is about speed. Anthropic says it caught MiniMax’s campaign while it was still running, before MiniMax had released the model it was training. When Anthropic shipped a new model during that window, it says MiniMax pivoted within 24 hours, redirecting nearly half its traffic to start extracting the newer system. Read literally, that describes an extraction operation responsive enough to retarget a frontier model the day it ships. It also explains why Anthropic is publishing this rather than quietly banning accounts: the company is arguing that access controls alone cannot keep pace, and that detection, intelligence sharing, and model-level countermeasures have to carry more of the load. That is a notable concession from the vendor whose own product is the target.
Why this reaches working developers
The temptation is to file this under lab-versus-lab politics, but there are two concrete consequences. The first is provenance. If you are choosing an open-weight or low-cost model for production, the possibility that its most useful behaviors were distilled from a competitor is now a documented risk rather than a rumor, and it carries legal, licensing, and reputational exposure for whatever you build on top. The second is safety. Anthropic’s argument, and it is worth weighing rather than accepting on faith, is that a model built through illicit distillation is unlikely to inherit the safety training of the model it copied. The capabilities tend to transfer; the guardrails often do not. A team deploying a distilled model in a user-facing product may be shipping frontier behavior with fewer of the refusals and mitigations that came with the original. There is also a quieter operational angle: Anthropic is now actively profiling API usage patterns to catch distillation, so teams running legitimately high-volume workloads, large eval suites, synthetic-data generation, or reward-model pipelines should expect access controls to tighten and should design for the possibility of being flagged.
What to watch
The open questions are whether any of the named labs respond with a substantive rebuttal rather than silence, whether independent researchers can corroborate the extraction patterns from outside Anthropic’s own telemetry, and whether other frontier vendors publish similar findings, which would turn one company’s threat report into an industry norm. The broader signal for developers is that the provenance of a model’s capabilities is becoming a real procurement question, on the same list as license, cost, and latency. The cheapest capable model is not automatically the safest thing to build a product on, and “where did these abilities come from” now has at least one detailed, if one-sided, answer. Stackmaven’s follow-up will revisit around December 11.