Anthropic Accuses Chinese AI Labs of Copying Claude

Anthropic Accuses Chinese AI Labs of Copying Claude’s Capabilities

What if a company spent years developing one of the world's most capable AI models, only to discover that competitors may have been using millions of interactions with that model to improve their own systems?

That is the allegation at the centre of a major AI industry controversy.

On September 10, 2026, Anthropic published a threat-intelligence report detailing what it describes as large-scale, unauthorized attempts by China-based AI laboratories to extract capabilities from its Claude models. The company says it identified several campaigns involving millions of exchanges, with one operation attributed to Alibaba accounting for more than 151 million exchanges between May and July 2026.

The report names companies including Alibaba, Moonshot AI, DeepSeek, Xiaomi, and Zhipu in its descriptions of suspected distillation campaigns. Anthropic says these activities targeted valuable model capabilities, including reasoning, coding, data analysis, and AI agent workflows.

These are serious allegations, but an important distinction matters: the claims come from Anthropic's own investigation. They should not be presented as independently established findings about wrongdoing by every named company. The controversy nevertheless raises important questions about competition, intellectual property, privacy, and the economics of building advanced AI systems.

1. What Exactly Is Model Distillation?

Before understanding the controversy, we need to understand the technology behind it.

Model distillation is a machine-learning technique in which a larger, more capable model helps train a smaller or different model. The larger model is often called the teacher, while the model learning from its outputs is called the student.

Instead of relying exclusively on expensive training runs, developers can use carefully designed questions and the teacher model's responses to create additional training examples. The student model then learns patterns from those examples.

Imagine a student learning mathematics from an experienced teacher. The student studies worked examples, compares different solutions, and practices applying the same concepts to new problems.

AI distillation follows a related idea, although the underlying process involves mathematical optimization and training rather than human understanding.

A simplified workflow looks like this:

Teacher model → Questions and responses → Training dataset → Student model → Evaluation and improvement.

Distillation can be extremely useful. It can reduce inference costs, help smaller models perform better, and make advanced capabilities more accessible to developers who cannot afford to operate the largest models.

This is why distillation itself is not inherently unethical or illegal. It is an established machine-learning method used across the industry.

The controversy arises when a developer allegedly extracts another company's model capabilities at scale without authorization, bypasses access restrictions, or uses data in ways that violate applicable agreements or privacy obligations.

In other words, the debate is not simply about whether one model learns from another. It is about how the information is obtained, whether the activity is authorized, and what rules govern its use.

2. The 151 Million Exchange Allegation

One of the most striking figures in Anthropic's report concerns an operation it attributed to Alibaba.

According to Anthropic, the campaign generated more than 151 million exchanges with Claude between May and July 2026. The company says the activity peaked at nearly three million exchanges per day and involved more than 3,500 accounts it considered fraudulent.

Anthropic alleges that the operation targeted reasoning transcripts from its Opus models and converted the collected material into training data intended to improve Alibaba's Qwen models.

The company also describes attempts to use Claude for broader AI research and development, including work related to training infrastructure.

Why would a company want to do this?

Training a frontier AI model requires enormous amounts of computing power, engineering expertise, data, and experimentation. Even after a model has been trained, improving its reasoning, coding, and agent capabilities can require substantial additional investment.

If a developer can obtain high-quality examples from a stronger model, those examples may help accelerate the development of its own systems.

However, millions of exchanges do not automatically translate into a model that matches the teacher. The value of the collected data depends on its quality, diversity, relevance, and how effectively it is incorporated into training.

Anthropic's allegation is that the scale and methods of this particular campaign went beyond ordinary, authorized use of its service.

The 151 million figure is therefore significant as a measure of the activity Anthropic says it observed—not as proof that a competing model acquired 151 million units of knowledge or became equivalent to Claude.

3. Why Were Moonshot AI and DeepSeek Mentioned?

Anthropic's report also describes separate campaigns involving Moonshot AI, the company behind the Kimi model family, and DeepSeek.

These allegations raise an additional concern: the handling of user conversations.

Anthropic says Moonshot routed some requests that users believed were being handled by Kimi to Claude instead. It alleges that the responses were then captured for use in model training. In one reported ten-day period, Anthropic observed nearly 300,000 relayed requests associated with Moonshot's operation.

The report describes similar activity involving DeepSeek. Anthropic alleges that selected requests were forwarded to Claude and that exchanges were collected for distillation.

Why does this matter beyond competition between AI companies?

Users may submit much more than ordinary questions to an AI assistant. They might upload internal company documents, source code, business plans, confidential research, or other sensitive material.

If a request is routed to another company's model without the user's knowledge, the user may not understand where their information is being processed.

Anthropic says some of the observed exchanges contained sensitive information. The company argues that the practices it describes raise serious privacy concerns.

These claims require careful interpretation. The report presents Anthropic's findings and assessments; it does not establish that every customer interaction with these services was handled in the same way.

Nevertheless, the underlying issue is important for anyone using AI: knowing which model is processing your information is part of knowing where your data is going.

For businesses, this is a reminder to examine vendor agreements, data-retention policies, model-routing configurations, and restrictions on using confidential information with external AI services.

4. Is This AI Theft or Normal Competition?

This is where the story becomes more complicated.

AI companies routinely learn from public research, benchmark results, published papers, open-source software, and their own experiments. They also use techniques such as distillation to create smaller models and improve efficiency.

Healthy competition can produce better products, lower prices, and more accessible technology.

But there is a meaningful difference between training a model using permitted data and allegedly operating a large-scale system designed to extract protected capabilities while evading a provider's restrictions.

Several questions matter when evaluating a particular case:

- Was access to the teacher model authorized?

- Did the activity comply with the service's terms and technical restrictions?

- Was sensitive information collected or transferred without appropriate consent?

- Were proprietary materials or protected information involved?

- What evidence supports the allegation, and has the other party responded?

The answers can affect the legal, contractual, and ethical assessment.

It is also important not to confuse competitive imitation with a definitive legal finding of theft. The terminology used in an industry report reflects the reporting company's assessment, not necessarily a court's conclusion.

Anthropic calls the campaigns it describes unauthorized or illicit distillation. That is the company's characterization of the activity it investigated.

The wider lesson is that the AI industry needs clearer expectations around access, model outputs, data use, and enforcement.

5. Why Distillation Is Becoming an AI Business Weapon

The economics explain why this issue matters so much.

Developing a powerful model from scratch can be expensive. Developers need skilled researchers, large computing clusters, suitable training data, extensive testing, and infrastructure to serve users reliably.

Distillation can reduce some of those costs by allowing a student model to learn from high-quality examples generated by a stronger system.

For startups, this can be a major advantage. Smaller models can be cheaper to run and easier to deploy on limited infrastructure. A company might also specialize its model for coding, customer support, document analysis, or a particular industry.

But if a competitor can allegedly obtain a large quantity of valuable training examples without paying the full cost of developing equivalent capabilities, the economics become more complicated.

The company investing in the original model may face a situation in which others can use its outputs to accelerate competing products.

That creates a difficult balance. Restricting access too aggressively could make AI less available to legitimate researchers, developers, and smaller businesses. Leaving access entirely unrestricted could increase opportunities for abuse.

The likely response will involve a combination of technical controls, usage monitoring, contractual enforcement, and more careful management of sensitive capabilities.

For AI companies, protecting valuable capabilities is becoming part of the core business strategy—not just a technical security task.

6. What Does This Mean for Indian AI Startups and Creators?

For India's growing AI ecosystem, this story offers several practical lessons.

First, building an AI product does not always require training a frontier model from scratch. Startups can use existing models, open-source systems, retrieval-augmented generation, fine-tuning, and permitted distillation techniques to build useful products.

Second, businesses should understand the terms under which they use third-party AI services. An API key does not automatically grant unlimited rights to extract model capabilities, reproduce proprietary systems, or use outputs for every possible training purpose.

Third, data privacy needs to be considered from the beginning. A developer building an AI agent for WhatsApp, Instagram, customer support, or business automation should know which providers receive customer data and what those providers do with it.

Fourth, companies should protect their own valuable information. If a business uses AI tools to process confidential code, customer records, or internal documents, it should verify the provider's data-handling policies and configure access appropriately.

For students and independent creators, the takeaway is not to avoid distillation or AI experimentation. It is to learn the methods properly, use authorized datasets and services, and understand the difference between building on technology and extracting capabilities in ways that violate the applicable rules.

India has an opportunity to develop AI products that compete through efficiency, specialization, useful local-language capabilities, and strong execution.

That opportunity does not depend on copying another company's model without permission.

7. How Can AI Companies Defend Against Distillation Attempts?

There is no single safeguard that can eliminate every attempt to extract model capabilities.

One approach is to monitor unusual usage patterns. Large volumes of highly repetitive queries, coordinated account activity, and requests designed to extract restricted information may warrant additional investigation.

Another approach is to apply rate limits, authentication controls, and restrictions on suspicious accounts. These measures can raise the cost of large-scale automated extraction, although they must be designed carefully to avoid unfairly blocking legitimate users.

Model providers can also limit the exposure of sensitive internal information. For example, a system may provide useful summaries of its reasoning rather than exposing internal reasoning traces directly.

Providers can review suspicious activity, update safeguards, and cooperate with relevant partners when appropriate. They can also establish clearer terms governing the use of model outputs for training competing systems.

At the same time, security measures should be proportionate. Not every developer who sends many queries is engaged in misconduct. Legitimate testing, research, and product development can also generate high volumes of requests.

Effective enforcement therefore requires evidence, context, and a process for reviewing difficult cases.

The objective should be to make unauthorized extraction harder without unnecessarily restricting legitimate AI innovation.

8. The Bigger Question: Who Owns AI-Generated Knowledge?

This controversy points toward a larger question that the industry has not fully resolved.

If an AI company spends billions developing a model, what rights should it have over the answers that model produces?

Can another company use thousands or millions of those answers to train a competing model? Does the answer change when the outputs contain proprietary information, when automated extraction is involved, or when access rules have been bypassed?

There is no single answer that applies to every situation. The outcome may depend on contracts, intellectual-property law, privacy obligations, technical methods, and the jurisdiction involved.

There is also a legitimate concern on the other side: overly restrictive control over model outputs could make it harder for researchers and developers to build useful applications or improve AI efficiency.

The industry will need to distinguish between legitimate learning, authorized model distillation, ordinary product competition, and abusive attempts to extract protected capabilities.

Clear rules would help both model developers and the companies building on top of their technology.

Final Verdict

Anthropic's September 2026 report describes what the company says were large-scale, unauthorized attempts by China-based AI labs to extract Claude's capabilities. The reported Alibaba campaign alone involved more than 151 million exchanges, according to Anthropic.

The allegations are significant, but they should be understood as claims from the company that conducted the investigation rather than as independent proof of every alleged action.

The broader issue is real: distillation can make AI more efficient and accessible, but it can also create serious questions about authorization, privacy, intellectual property, and competition.

For developers, the best path is to build with permitted tools, protect user data, and understand the rules governing the models they use.

For AI companies, the challenge is to protect their investments without closing the door to legitimate innovation.

And for the industry as a whole, one question remains:

When does learning from a powerful AI model become unfair extraction of its capabilities?

Is AI model distillation a legitimate shortcut to better technology, or does it cross a line when companies extract another model's capabilities without permission? Share your perspective.