Anthropic says seven labs in China ran 190 million chats with Claude this year34. Each one, it says, aimed at copying what the model can do. The company put a smaller number on the same fight in February: 16 million chats, three labs, about 24,000 fake accounts1. That gap, from one count to the next, is the story. Anthropic calls the growth proof that Chinese labs are copying faster. Beijing calls the whole count a pretext for trade restrictions7. Any company that buys Claude answers to the same rule the seven labs broke. Anthropic's terms ban extracting its reasoning at scale, for every customer, and a flagged account can lose access within two hours5.
What Distillation Means, in Plain Words
Distillation starts as an ordinary trick. One company's model answers a question. A second model studies those answers and learns to produce something close, cheaper and faster to run. Labs train their own smaller models this way all the time, openly, through a paid API.
Seven labs skipped that paid, open version, Anthropic says. Instead of buying normal access, they built thousands of fake accounts. Then they asked Claude to write out its reasoning step by step, the chain of thought it keeps hidden from an ordinary user. That hidden reasoning is the expensive part to build. Harvest enough of it, and a smaller model learns to reason the way Claude does, at a fraction of the training cost.
A security lead checking a vendor contract can borrow Anthropic's own test here. Does the agreement name reasoning extraction specifically, or does it lean on a broad, unenforced misuse clause? Anthropic's September report shows the gap between a named ban and a real one, measured in months and millions of chats4.
Anthropic described one method it caught directly. "In one case, a single proxy network managed more than 20,000 fraudulent accounts simultaneously, mixing distillation traffic with unrelated customer requests to make detection harder," Anthropic said1. A proxy network hides which real computer sent each request. Mixed in with ordinary traffic, the fake accounts looked like customers.
The Count That Grew Twelvefold
Anthropic's first public count, on Feb. 23, named three labs. DeepSeek ran more than 150,000 of the chats. Moonshot ran more than 3.4 million. MiniMax ran more than 13 million, the largest of the three1. Add them up: 16 million chats, roughly 24,000 fake accounts1.
Anthropic named a fourth lab in June, accusing Alibaba Cloud of running a similar campaign2. By the time its September threat report came out, Alibaba's own number had dwarfed the rest. Accounts tied to Alibaba ran more than 151 million chats between May and July34. Anthropic calls it the single biggest campaign it has ever measured. Moonshot added roughly 23 million more over a similar stretch4. DeepSeek ran about 12 million during a 14-day window in July4. The other three labs named in the report, Xiaomi, Zhipu and MiniMax, divided the rest of the 190 million total among them. Anthropic did that math itself4.
Alibaba drove 151 million of the 190 million China extraction chats
Claude exchanges Anthropic attributes to each lab, May to August 2026, per its September threat report
Each bar is one lab's share of the 190 million exchanges Anthropic counted. The magenta bar is Alibaba, the single biggest campaign Anthropic says it has measured.
Anthropic published exact counts for Alibaba, Moonshot and DeepSeek. The combined bar for the other three labs is derived by subtraction from the report's 190 million total.
Sources: TechCrunch [3]; Better Stack [4]. Chart by The AILately.com Desk.
The numbers behind this chart
| Item | Value | Note |
|---|---|---|
| Alibaba | 151M | |
| Moonshot | 23M | |
| DeepSeek | 12M | |
| Xiaomi, Zhipu and MiniMax combined | 4M | Anthropic skipped a lab-by-lab count here; this is the remainder after subtracting the other three from its 190 million total |
Set February next to September, and the jump looks enormous. Three labs became seven. Sixteen million chats became 190 million. Read the dates instead, and the picture steadies some. Alibaba's run sat inside the same May-to-July window Anthropic was already tracking the first three labs. The Sept. report mostly finished counting a wider campaign already underway, past catching new behavior twelvefold worse in a few months.
Anthropic's extraction count grew from 16 million chats to 190 million
Total Claude exchanges Anthropic attributed to Chinese labs, February disclosure against September report
Each column is one disclosure's total. The September column covers four more labs than the February one did.
The two counts cover different lab rosters and overlapping measurement windows, so the jump reflects a wider count more than a sudden spike in new activity.
Sources: Anthropic [1]; Better Stack [4]. Chart by The AILately.com Desk.
The numbers behind this chart
| Item | Value |
|---|---|
| Feb. (3 labs) | 16M |
| Sept. (7 labs) | 190M |
Why Anthropic Calls It Theft
Anthropic's case rests on what the fake accounts did, more than how many there were. The company watched one lab adjust within hours of a product launch. "When we released a new model during MiniMax's active campaign, they pivoted within 24 hours, redirecting nearly half their traffic to capture capabilities from our latest system," Anthropic said1. That reads as a system tuned to catch every upgrade, past what someone poking at a chatbot would manage.
Its response grew teeth as the year went on. Accounts created after Aug. 31 lose the ability to edit or reread their own earlier sessions5. That change blocks one path labs used to rebuild hidden reasoning after the fact. A two-stage classifier screens incoming traffic for distillation patterns, built on Claude Sonnet 5.55. It puts the false positive rate under 0.1 percent. The company says it has banned tens of thousands of accounts this way, some within two hours of their first flagged request5.
Anthropic published a bigger claim on Oct. 12. Early evidence suggests the new classifier cut the data harvested by distillers by around 90 to 99 percent, the company says5. That exact figure had spread online for weeks beforehand, credited to Anthropic but missing from any page the company had posted. It now sits on Anthropic's own research page, dated and sourced to the company itself5.
Beijing Calls It Projection
China's government answered through its commerce ministry. The labs it named stayed quiet. "These actions lack any actual evidence, have no legal backing, and effectively amount to a double standard," a ministry spokesperson said in response to reporters' questions in July7. Each of the seven labs Anthropic named skipped a public reply of its own.
The U.S. side of this fight sits at the threat stage alone. Unnamed U.S. officials said they might investigate Chinese AI firms for distillation and impose sanctions, framed around stolen intellectual property7. Those officials skipped naming an agency or a statute. China's commerce ministry answered a threat, months before any rule existed7.
Tian Feng, former dean of SenseTime's Intelligence Industry Research Institute, made the sharper case in June. He argued Anthropic's claims serve a goal apart from stopping theft. "The allegations reflect a strategy driven by technological hegemony anxiety and are intended to curb China's technological advancement," Tian said6. His framing treats distillation as ordinary work: a smaller model learning from a larger one. Western labs use that same technique on their own systems.
Alibaba's own leadership changed hands during the window Anthropic is now checking. The company folded its Qwen team into a new unit called Alibaba Token Hub in March. Zhou Jingren became chief AI architect there, under chief executive Eddie Wu8. Two months later, accounts tied to Alibaba began the run Anthropic calls its largest ever measured34. Alibaba has stayed quiet on whether that change touched the accounts Anthropic flagged.
Dario Amodei, Anthropic's co-founder and chief executive, built the company's public case on exactly this kind of count. The number is large enough to demand a policy response, and it traces only to Anthropic's own logs2. A reader weighing the dispute checks one company's homework against a government's denial, and each side supplies its own referee.
By the numbers
- Anthropic attributed 16 million Claude chats to DeepSeek, Moonshot and MiniMax combined, disclosed Feb. 231.
- Roughly 24,000 fake accounts sat behind that February count1.
- Anthropic's Sept. report puts the seven-lab total at 190 million chats4.
- Alibaba's own share of that total topped 151 million, run between May and July34.
- The run's peak hit nearly 3 million requests in a single day4.
- Anthropic's October classifier cut harvested data by 90 to 99 percent, the company claims5.
- That same classifier carries a false positive rate under 0.1 percent, Anthropic says5.
What to watch
Watch whether China's commerce ministry follows its July statement with real action, or leaves the dispute as talk7. Each of the seven named labs has skipped a reply in its own words so far. A reply from any one of them is itself worth watching46. Anthropic's own number deserves the same scrutiny. The company says its classifier cut harvesting by 90 to 99 percent, a claim only Anthropic has checked so far5.
Sources
- Anthropic, "Detecting and preventing distillation attacks," Anthropic, Feb. 23, 2026, https://anthropic.com/news/detecting-and-preventing-distillation-attacks
- Wikipedia contributors, "Anthropic," Wikipedia, retrieved Oct. 14, 2026, https://en.wikipedia.org/wiki/Anthropic
- Russell Brandom, "Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek," TechCrunch, Sept. 10, 2026, https://techcrunch.com/2026/09/10/anthropic-details-distillation-campaigns-from-alibaba-moonshot-ai-and-deepseek/
- Better Stack, "Anthropic's September 2026 Threat Report: Illicit Distillation and the Labs Behind It," Better Stack, Sept. 11, 2026, https://betterstack.com/community/guides/ai/anthropic-threat-report-2026/
- Anthropic, "Strengthening our defenses against distillation attacks," Anthropic, Oct. 12, 2026, https://anthropic.com/research/distillation-defenses
- Global Times, "Anthropic's 'distillation' claims against Chinese firm lack substance, rooted in tech hegemony anxiety: Chinese expert," Global Times, June 25, 2026, https://www.globaltimes.cn/page/202606/1364418.shtml
- China Ministry of Commerce, "Ministry of Commerce Press Spokesperson Answers Reporter's Question about the United States Threatening to Launch Investigations and Implement Sanctions Against Chinese Artificial Intelligence Enterprises," Center for Security and Emerging Technology, Georgetown University, July 27, 2026, https://cset.georgetown.edu/publication/china-mofcom-statement-model-distillation
- Wikipedia contributors, "Qwen," Wikipedia, retrieved Oct. 14, 2026, https://en.wikipedia.org/wiki/Qwen