Anthropic says Claude was targeted by distillation campaigns.
And it’s naming DeepSeek, Moonshot, and MiniMax.
In a new post, Anthropic said it detected “industrial-scale” distillation activity aimed at extracting Claude’s capabilities. The company said the campaigns used about 24,000 fraudulent accounts and generated more than 16 million exchanges with Claude, which it said violated its terms of service and regional access restrictions.
What Anthropic is alleging, and what ‘distillation’ means
Distillation is a common AI technique where one model learns from another model’s outputs, often to produce a smaller or cheaper system that behaves more like a stronger one. Anthropic claims that the distillation was done without authorization, at scale, to replicate Claude’s behavior.
The Verge described the alleged approach as prompting Claude in high volume, collecting the responses, and using those outputs to improve other models.
Anthropic’s post also includes lab-specific activity counts and target areas. It said DeepSeek generated more than 150,000 exchanges, Moonshot generated more than 3.4 million exchanges, and MiniMax generated more than 13 million exchanges. Anthropic said the prompting targeted areas like reasoning and evaluation-style tasks, agentic reasoning and tool use, and agentic coding and orchestration, and it said it observed fast shifts in activity after new model releases.
What changes next for AI providers and customers
Anthropic said it is investing in stronger detection and behavioral fingerprinting, tightening verification for pathways frequently abused for fraud, sharing indicators with other AI labs and cloud providers, and building product, API, and model-level countermeasures intended to make outputs less useful for illicit distillation.
For customers, the short-term changes are likely to be practical. Providers may watch more closely for abnormal usage patterns, bulk automation, and reseller activity that looks like extraction. That can mean more friction around high-volume access and stricter enforcement when usage looks coordinated rather than organic.
More broadly, model providers are increasingly treating extraction as a repeatable threat pattern, not a one-off dispute, and safety governance is becoming a more visible part of how labs defend their approach. Gemini model extraction attacks and the recent spotlight on Anthropic reflect that shift. DeepSeek, meanwhile, has faced separate operational pressure, including chip-related delays.
Also read: Claude’s Constitution lays out Anthropic’s “80-page ethical blueprint” for how Claude should balance honesty, compassion, safety, and oversight, which is exactly the kind of behavior distillation fights could put at risk.