Anthropic Accuses DeepSeek, Moonshot, and MiniMax of Distillation Attacks

Anthropic published a detailed account claiming that three Chinese AI laboratories ran coordinated, industrial-scale data extraction operations against its Claude API, using more than 24,000 fraudulent accounts and generating over 16 million conversations specifically to harvest outputs as training data for competing models. The post reached tens of millions of views within days of publication. I am Madhuranjan Kumar, and I want to think through what this story actually reveals, because the geopolitical framing it received in most coverage obscures the more transferable and more practically useful lessons buried inside it.

Twenty-Four Thousand Fake Accounts Is an Infrastructure Project, Not a Curiosity Probe

The scale described in Anthropic's account is the first thing worth sitting with carefully. Twenty-four thousand fraudulent accounts is not a handful of curious researchers probing a competitor's product out of technical interest. It is an organized infrastructure project requiring account management tooling, proxy services to evade detection and rate limits, coordination across a team or teams, and a sustained operational commitment over weeks or months. Sixteen million conversations with a production AI model is a genuinely large dataset, the kind that normally requires hiring specialized annotation teams, building evaluation infrastructure, and paying for human judgment at scale across thousands of hours of carefully managed work.

The allegation, if accurate, is that three separate organizations effectively ran parallel annotation operations by using the competitor's own production system as a free annotation and evaluation infrastructure. The cost per training example would be a fraction of what legitimate annotation costs, the quality would be drawn directly from the strongest available model rather than from human annotators of varying quality, and the risk of being caught appears to have been underestimated or accepted as a reasonable operational risk.

The post reached tens of millions of views not because AI data practices are a mainstream consumer topic, but because the story had the structure of an industrial espionage case, which is a story category that travels across audiences easily and generates strong reactions from people who would not normally engage with AI industry technical developments.

The Extraction Techniques Are More Instructive Than the Attribution Claims

The specific extraction techniques described in the account deserve more attention than they received in most coverage. One organization allegedly focused a significant portion of its roughly 150,000 exchange dataset on reasoning extraction, specifically using prompts that asked Claude to imagine and write out its internal chain of thought step by step rather than simply produce a final answer. A chain-of-thought response is not just a longer answer. It is a map of how the model approaches a problem, a teaching signal that tells a student model not just what conclusion to reach but how to structure the thinking process that arrives there. As training data, that is dramatically more valuable than a bare output because it teaches reasoning process rather than just output pattern matching.

A second organization allegedly used the production model as a reward model, submitting outputs from its own developing model and asking Claude to score and grade them. Building a reward model from scratch requires human annotators scoring thousands of candidate responses to teach a model what a high-quality answer looks like, which is expensive, slow, and introduces human judgment variance across the annotation team. Using a competitor's production model to provide those scores costs only the API fees, which at the scale of a major research organization are negligible compared to the legitimate alternative. The method is genuinely clever independent of any ethical or legal assessment of whether it should have been done.

A third organization ran the largest volume, approximately 13 million exchanges, and was reportedly caught while a training run was still in progress. When Anthropic updated its production model, traffic from the suspicious accounts began probing the new version for fresh capability data, which confirmed the connection between the traffic pattern and an active training pipeline. That specific detection mechanism, watching for unusual probing traffic following a model update, is a monitoring pattern that applies to any system where new capability versions are deployed incrementally.

Attribution in all three cases reportedly came through IP correlation, request metadata analysis, infrastructure pattern recognition, and in some cases confirmation from industry partners who had observed the same actors through their own systems. Both critics and supporters of the account raised legitimate points in the same news cycle. Some researchers questioned whether the transaction volumes cited make sense given typical API traffic patterns at scale. Others pointed to historical questions about Anthropic's own training data sourcing practices. Both of those points can be accurate at the same time as the core technical claim about what happened. The rhetorical positioning of any story and the technical truth of the underlying events are separate questions.

Being the Strongest Model Creates a Specific Kind of Competitive Exposure That Being a Follower Does Not

There is a structural reality in this story that applies to any business that is genuinely the best at what it does in a competitive market. The reason these extraction attempts targeted Claude specifically is that Claude was worth extracting from. A mediocre model is not a useful training signal for a competitor trying to build a competitive alternative. The most capable model in a market segment is precisely the one that competitors want to learn from most, which means being the leader creates a specific category of exposure that being a follower does not face in the same way.

This is not unique to AI. The dominant product in any category is the one that gets most intensively reverse-engineered, emulated, and studied by everyone who wants to compete with it. The investment, the data quality, and the fine-tuning that produced the capability advantage are simultaneously what make the leader a valuable target for extraction by anyone who wants to close the gap faster than organic development would allow.

The defense is not to stop being the best. It is to make extraction sufficiently difficult and sufficiently visible that the cost and risk of attempting it outweigh the benefit in the attacker's calculation. That defense requires monitoring, rate limiting, and anomaly detection, not just continued capability investment. Detecting the attack required looking for behavioral patterns that did not match organic human usage, which is a detection approach that requires actively monitoring traffic for anomalies rather than passively logging it.

The Access-Control Lesson Scales Directly to Any Business With a Public-Facing Automated Interface

The practical implication that transfers most directly to businesses outside the AI industry is this: the outputs you expose through any public-facing automated interface carry value, and that value can be systematically extracted at scale by anyone sufficiently motivated to do so. The specific mechanics in Anthropic's account, coordinated fake accounts, load-balanced traffic to avoid per-account rate limits, and prompts designed to extract reasoning rather than just answers, all have direct analogies in business contexts that have nothing to do with frontier AI models.

A business with a proprietary pricing engine accessible through a public interface faces the risk that a competitor can systematically probe that interface to reverse-engineer the pricing logic by submitting many structured queries and observing the response patterns. A business with a recommendation system accessible through a chatbot or a website tool faces the risk that someone can map its recommendation patterns entirely by submitting thousands of structured queries. A business whose CRM and website stack includes a public-facing AI assistant faces the risk that the assistant's outputs, generated from the business's proprietary customer data and business rules, can be harvested at scale by anyone with access to the public interface.

The defensive measures are not exotic and most of them are available as standard features of the infrastructure tools most businesses already use. Rate limiting per account rather than only in aggregate prevents the load-balancing approach used in the described attacks. Monitoring for traffic patterns that are synchronized or load-balanced in ways that do not match organic human usage catches coordinated probing before it reaches meaningful scale. Flagging prompts that probe for reasoning steps rather than direct answers catches reasoning extraction attempts that differ structurally from normal user behavior. Rotating API credentials on a regular schedule and reviewing access logs periodically are standard access control practices that most businesses skip because they feel operational rather than important.

The Attribution Problem Points to a Monitoring Gap Most Businesses Share

One of the less-discussed implications of this story is how long the extraction operations reportedly ran before they were detected. The detection eventually happened through a combination of internal monitoring and industry partner information, but the scale of 16 million conversations suggests the operations had been running for a meaningful period before the behavioral anomalies became visible enough to trigger investigation. The time between the start of the operation and detection represents the window during which the extraction provided competitive advantage to the attacker without any cost or consequence.

For any business with a public-facing interface that generates valuable outputs, the question is not whether someone might try to systematically probe it but how long they could do so before the monitoring infrastructure detected it. Most small businesses have no meaningful monitoring beyond basic error logs and access counts. They would not detect coordinated probing until it either caused service degradation or was reported by a partner who noticed the same traffic pattern elsewhere.

Any business running paid social advertising through a managed platform should apply the same monitoring logic to its ad account API access. Any business using AI tools for Facebook and Instagram ad campaigns should ensure that the API keys and access tokens that connect those tools to ad accounts have appropriate restrictions, are reviewed periodically, and are revoked immediately if the associated tool is no longer actively being used. The access-control lesson from this story is quieter than the geopolitical one and considerably more actionable for most business owners. You do not need an opinion about AI export controls or technology policy to act on it. You only need to recognize that any system producing valuable outputs from a public endpoint is a target for systematic extraction, and that detecting it in weeks rather than months is entirely a function of whether basic monitoring is in place. ## The Competitive Intelligence Lesson Is Worth Separating From the Ethics Debate

There is a competitive intelligence insight buried in this story that is worth extracting independently of any ethical or legal conclusion about what Anthropic's named organizations did. The insight is about what makes AI training data valuable and how the most efficient source of that value can shift when a dominant competitor's production system is publicly accessible. The organizations in the account were not randomly probing the API. They were systematically targeting the categories of output that are most difficult and expensive to produce through legitimate annotation: long reasoning chains, quality scores on candidate outputs, and high-volume diverse dialogue. Those are the three categories where using a production model as a data source provides the clearest cost advantage over building the data through human annotation.

Understanding what makes different types of training data expensive to produce legitimately helps explain which types of AI capabilities are most likely to be targeted by competitive intelligence operations, because those are the categories where the shortcut provides the clearest financial advantage. For the AI industry, this creates a durable tension between making models publicly accessible to generate usage revenue and protecting the specific output categories that carry the most competitive training value. That tension is not resolved by access controls alone, but access controls do change the cost calculation for anyone attempting the extraction at industrial scale. ## What the Story Changes for Businesses That Rely on AI-Assisted Client Work

For service businesses whose daily workflow involves AI tools processing client information, the story raises a practical operational question that is separate from any opinion about the actors named in the account. When a business uses an AI model to process client briefs, draft client communications, or analyze client data, the outputs of that processing are generated by a system that is itself a commercial product with competitive value. Understanding where your business's data goes when it enters a cloud AI model, and what the model provider's terms of service say about training data use, is a basic due diligence question that most small businesses have not asked.

Most major AI providers give users the option to opt out of having their conversations used for model training. That option is typically buried in the account settings rather than presented prominently during onboarding. For any business whose client work involves confidential information, exercising that opt-out is a straightforward step that takes under a minute and removes one category of data handling concern entirely. The deeper lesson from this story is that AI systems are commercial products embedded in competitive dynamics, and the data that flows through them carries value beyond its immediate utility for the task at hand. Businesses that treat AI tools as neutral utilities rather than as commercial products with their own competitive interests are making an assumption the tools themselves do not justify. Treating them correctly means using them deliberately, with appropriate access controls, and with an awareness of the data handling terms that govern each tool.