Anthropic says Alibaba, Moonshot ran distillation attacks

Anthropic's report lands after the company first raised alarms about distillation in February, when it named specific labs. OpenAI has reported similar activity, which it attributed to DeepSeek specifically. Anthropic says the campaigns in its new report are larger and more aggressive than what came before, suggesting the tactics have scaled up along with the models themselves.

The report zeroes in on how these attacks work. Distillation tries to pull the chain of thought out of a model's answers, which can then be used to train a smaller model. Anthropic normally shows users only summarized thinking blocks rather than the internal chain of thought, but the report says the campaigns found specific ways to trick the model into revealing its thinking traces directly — for example, by posing as a katakana-only translation task. The bulk of the attempts, attributed to Alibaba, involved 151 million exchanges between May and July 2026 across 3,500 accounts, all tied to a single fixed prompt aimed at producing training data for Alibaba's Qwen family.

A separate campaign attributed to Moonshot AI, the maker of Kimi, appeared to route requests directly from the Chinese military, including one asking Claude to review surveillance footage for abnormal behavior. Over one ten-day period, nearly 300,000 requests went through 5,000 accounts, mostly targeting Anthropic's Opus model. The outcome likely hinges on how these allegations are received and whether the named labs respond, since the report's claims about scale and intent are central to the dispute.