U.S. agencies have accused six Chinese AI companies of extracting capabilities from American models, while separate figures from Anthropic show campaigns against Claude but do not measure the practice’s reach across China.
A Sept. 8 advisory from the National Security Agency (NSA), Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies alleged that China-based firms had targeted Claude, GPT, Gemini and Grok since at least late 2024, using tactics including fraudulent accounts and proxy services. They said drawing on established models could lower the research, computing and electricity costs of developing AI systems.
Anthropic’s September report attributed campaigns against Claude to seven China-based labs. It put Alibaba-associated exchanges at more than 151 million from May through July 2026, and Moonshot AI’s at more than 23 million over the same period. The company also reported more than 12.1 million exchanges attributed to DeepSeek in 14 days in July, more than 3.4 million for Zhipu over 17 days in June and July, and more than 400,000 for Xiaomi over 20 days in March and April. Anthropic reported the figures across different observation periods. The U.S. advisory named six firms, while Anthropic gave a seven-lab count.
Distillation transfers a stronger model’s outputs into the training of another model. Anthropic describes the method as legitimate when used appropriately; its allegations concern covert, large-scale efforts to reproduce capabilities without authorization. China’s Ministry of Commerce rejected the U.S. claims. A ministry spokesperson called them “groundless and legally unsound.”
Anthropic said on Feb. 23, 2026, that DeepSeek, Moonshot AI and MiniMax had generated more than 16 million exchanges through about 24,000 accounts it described as fraudulent. Separately, a Carnegie Endowment analysis of authors in its 2025 NeurIPS sample found 41% worked in China and 34% in the United States. That conference sample does not represent the entire AI workforce or measure model output across either country.
Anthropic’s October update said early results showed its safeguards left distillers with 90% to 99% less data to harvest. It also reported that reasoning tokens extracted through its platform were 10 to 100 times fewer after the measures took effect. The company said some developers had to update integrations, classifiers could block benign requests in fewer than 0.1% of cases, and it resumed charging for certain requests blocked by the safeguards on Sept. 24.
