Chinese AI companies used approximately 24,000 fake accounts to launch over 16 million unauthorized access attempts against Anthropic’s state-of-the-art AI model “Claude,” performing “distillation” to extract the model’s underlying knowledge. This campaign was driven by U.S. semiconductor export restrictions and a strategic push by China to bypass massive R&D costs while rapidly boosting domestic AI capabilities.

Key Facts and the Full Scope of the Breach

On February 23, 2026, U.S. AI startup Anthropic publicly revealed that three Chinese AI companies had conducted a massive unauthorized access campaign against its conversational AI model, “Claude,” stealing model knowledge to enhance their own AI systems. This followed a similar disclosure by OpenAI to the U.S. House Select Committee on the CCP, highlighting systemic attacks targeting leading U.S. frontier AI models. Investigations revealed that the Chinese tech firms created approximately 24,000 fake accounts and executed more than 16 million API calls in total. The primary targets were models boasting world-class reasoning capabilities, such as Claude, with attackers systematically circumventing terms of service and geographic access restrictions. Anthropic warned that such practices not only infringe upon developers’ intellectual property but also spread models lacking necessary safety guardrails internationally, posing severe national security risks.

Distinct Tactics Across Three Chinese AI Firms

The three Chinese AI labs implicated in the unauthorized access are MiniMax, Moonshot AI, and DeepSeek. Each firm employed distinct strategies and methods to harvest data. MiniMax operated on the largest scale, utilizing roughly 19,000 fake accounts to execute over 13 million API calls, extracting vast amounts of coding and tool-use capability data. Moonshot AI used approximately 4,500 fake accounts for around 3.4 million calls, targeting a broad spectrum of capabilities including reasoning and data analysis. DeepSeek, while making a relatively small number of calls—around 150,000—employed the most sophisticated and subtle techniques. DeepSeek specifically prompted Claude to output its internal “Chain-of-Thought” reasoning step-by-step, effectively extracting the core of its logical reasoning. Furthermore, DeepSeek tasked Claude with drafting politically sensitive response patterns compliant with Chinese domestic censorship. These queries were routed through an underground proxy network known as a “Hydra cluster” and obfuscated third-party routers to conceal their true origin. Please refer to the conceptual diagram below.

Technical Mechanisms of Distillation Attacks and Developer Alarm

Mechanism of Knowledge Distillation and the Threat of “Adversarial Distillation”

In the AI industry, “knowledge distillation” is a technique where outputs generated by a large, highly capable “teacher model” are used as training data to efficiently train a smaller “student model.” While legitimately used internally for model compression and efficiency, the core issue in this case is “adversarial distillation”—unauthorized, large-scale harvesting of outputs from a model developed by a rival at immense expense and effort. Training a frontier AI model from scratch requires hundreds of millions of dollars in R&D investment; however, adversarial distillation allows competitors to shortcut this process and acquire comparable reasoning capabilities for just tens of thousands of dollars in API fees. OpenAI’s analysis revealed that DeepSeek’s outputs exhibited an unnaturally high writing style similarity of 74.2% to ChatGPT, serving as compelling evidence of model duplication built upon a competitor’s intellectual property.

Technical and Geopolitical Context Driving the AI Shift

This surge in adversarial distillation is deeply rooted in the U.S.-China tech rivalry and stringent trade controls. Since 2022, the U.S. government has restricted exports of advanced AI chips, such as NVIDIA GPUs, to China, making it difficult for Chinese firms to build frontier models purely through raw compute power. In response, Chinese AI developers pivoted toward software-level IP extraction—distilling outputs from top-tier U.S. models to sustain rapid development despite hardware constraints. This strategy has sparked intense alarm among major U.S. AI developers. In April 2026, OpenAI, Anthropic, and Google joined forces through the Frontier Model Forum to establish an unprecedented joint defense framework, sharing threat intelligence, fake account behavioral fingerprints, and malicious prompt signatures to block unauthorized distillation.

Future Outlook, Impacts on Business and Society, and Key Watchpoints

Evolving Regulatory Landscape and Legal Frameworks for IP Protection

Following disclosures of unauthorized model training, U.S. political and regulatory bodies acted swiftly. In early 2025, U.S. lawmakers introduced the “No DeepSeek on Government Devices Act,” leading to widespread bans on federal networks and devices, as well as state-level bans on government-issued equipment. However, legal enforcement against foreign entities remains fraught with obstacles. While model providers’ Terms of Service (ToS) explicitly prohibit using outputs to train competing models, a ToS breach is merely a contractual issue with limited civil enforceability against overseas firms. Furthermore, establishing copyright protection over AI-generated outputs or proving trade secret misappropriation under the Defend Trade Secrets Act (DTSA) presents significant legal hurdles, highlighting how existing legal frameworks lag behind technological advancements. Please refer to the correlation diagram below.

Key Watchpoints and Broader Societal and Technical Impacts

Looking ahead, key areas to monitor include the securitization of AI technology and the accelerating decoupling of global AI ecosystems. Models distilled without authorization are frequently released open-source with alignment and safety filters stripped away, heightening the risk of unaligned AI proliferating globally. Meanwhile, Chinese authorities have begun considering regulations to restrict overseas access to their own cutting-edge models, such as GLM-5.2, deepening technological fragmentation. In this environment, enterprises adopting AI tools must look beyond cost and performance to rigorously evaluate training data provenance, vendor IP protections, and geopolitical risks. The primary battleground of AI competition has decisively shifted from hardware and semiconductors to the defense of artificial intelligence intellectual property itself.

Primary Reference Pages

• [Anthropic Official Announcement: Detecting and Preventing Distillation Attacks] https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks

• [CSET Report: Decoupling in Strategic Technologies] https://cset.georgetown.edu/publication/decoupling-in-strategic-technologies

• [HuggingFace DeepSeek-R1 Model Card] https://huggingface.co/deepseek-ai/DeepSeek-R1

• [USPTO AI-Related Intellectual Property Information] https://www.uspto.gov/

[#AI #ArtificialIntelligence #Claude #DeepSeek #ModelDistillation #Cybersecurity #USChinaRivalry #IntellectualProperty]