Anthropic says it identified and disrupted six industrial-scale “illicit distillation” campaigns run by seven AI laboratories based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (also known as Zhipu), and MiniMax. Illicit distillation is the practice of secretly extracting a competing model’s capabilities by feeding it massive volumes of specially crafted queries and using the responses — along with the model’s internal reasoning traces — to train a second, unauthorized model. Unlike legitimate fine-tuning, these campaigns operated entirely without Anthropic’s knowledge or consent, and in some cases without the knowledge of the end users whose conversations were harvested.
Anthropic’s report, covering activity detected since February 2026, describes several methods the labs used to scale these attacks. Operators built networks of fake accounts funded with stolen credit cards, login credentials, and API keys to stay below per-account usage limits. Some labs went a step further: they silently rerouted their own users’ real queries to Claude, harvested the responses, then returned the results — meaning users believed they were talking to a domestic model while their conversations were secretly being logged and sold. A secondary market of proxy services grew up around this activity, reselling transcripts of genuine Claude conversations to labs that couldn’t operate accounts directly. To counter the campaigns, Anthropic said it is banning reseller accounts and accounts from unsupported regions when users don’t verify their identity. The company also updated Claude to summarize its internal reasoning before responding, which makes stolen transcripts far less useful for follow-on training. A newer measure called “preserved thinking,” introduced with Fable 5.1, prevents new API accounts from modifying the system prompt or message context that precedes Claude’s reasoning chain — closing a technique attackers used to try to surface the model’s hidden thought process.