Anthropic catches Chinese AI rivals cloning Claude

Distillation is one of the worst-kept secrets in AI: taking the outputs of a giant frontier model to train smaller, cheaper ones is standard practice across the industry.

What is rare is seeing a frontier lab name names and publish the digital receipts. On February 23, Anthropic accused three prominent Chinese AI labs—DeepSeek, Moonshot AI, and MiniMax—of running industrial-scale distillation campaigns against Claude.

Anthropic claims the three companies used roughly 24,000 fraudulent accounts to generate over 16 million exchanges, deliberately extracting Claude’s reasoning and agentic chops to train their own systems.

Who grabbed what

According to Anthropic, each lab went after very specific strengths.

MiniMax was the heavyweight by volume, accounting for over 13 million exchanges focused heavily on agentic coding and tool use. Anthropic caught the campaign live before MiniMax even shipped the model it was training. When Anthropic dropped an updated model during the operation, MiniMax redirected nearly half its scraper traffic to the new system within 24 hours.

Moonshot AI generated more than 3.4 million queries targeting agentic reasoning, computer-use agents, and computer vision. Anthropic said it traced the activity back to public profiles of senior Moonshot staff using request metadata.

DeepSeek ran a smaller but far more surgical operation with around 150,000 exchanges. They used Claude to generate step-by-step chain-of-thought data, used it as a reward model for reinforcement learning, and asked it for policy-safe alternatives to politically sensitive questions. Anthropic claimed these requests traced directly to specific researchers.

The hydra clusters and defense lines

Since Anthropic does not serve Claude in China, the labs relied on commercial proxy setups that Anthropic calls hydra clusters.

These networks managed tens of thousands of shell accounts across Anthropic’s API and third-party cloud platforms, blending distillation traffic with legitimate user queries to dodge rate limits and automated bans. In one instance, a single proxy setup ran over 20,000 accounts at once.

Anthropic says it is deploying behavioral fingerprinting to spot chain-of-thought elicitation, tightening onboarding for academic and startup tiers, sharing threat data with other labs, and engineering model-level mitigations designed to make outputs less usable for training without ruining normal user interactions.

Why it matters

We think Anthropic’s report is as much about Washington politics as it is about terms-of-service violations.

Distillation itself is neither new nor inherently unethical; frontier labs routinely distill their own flagship models into cheaper tiers. But extracting capabilities from a direct competitor at this scale crosses clear contractual lines, and the speed at which MiniMax pivoted within 24 hours shows just how agile open-source and foreign rivals have become.

For regular developers, the immediate fallout will likely be tighter API access controls, stricter know-your-customer hurdles, and more aggressive false-positive bans as frontier providers lock their gates.

More importantly, look at how Anthropic framed the narrative. Instead of just complaining about stolen IP, it explicitly tied the attacks to national security and chip export controls. By arguing that foreign advancements are partially piggybacking on American models, Anthropic gave policymakers fresh ammunition to tighten export restrictions while positioning itself as a defender of Western AI dominance. It is a shrewd maneuver, but one that further fragments the global AI landscape.