Anthropic Exposes China-Based AI Labs' Industrial-Scale Claude Model Theft
Seven Chinese AI labs caught illicitly distilling Claude's capabilities using stolen credentials and proxy networks.
1Industrial-Scale AI Model Theft Uncovered
Anthropic revealed seven China-based AI labs, including Alibaba and Moonshot, conducted systematic attacks to replicate Claude's capabilities through unauthorized knowledge distillation. These operations used networks of fake accounts with stolen credit cards and API keys. Unlike legitimate knowledge transfer, this industrial-scale extraction replicates proprietary AI functionalities without consent. The labs harvested sensitive data from multinational companies and state-affiliated actors during these operations.
2How Illicit Distillation Works
Attackers route requests through proxy services that create thousands of fictitious accounts, using stolen credentials to access Claude. They manipulate prompts to extract capabilities like coding, logical reasoning, and tool use. Some labs purchased user conversation transcripts from third-party resellers operating these proxy networks. Other cases involved rerouting unsuspecting users' queries to Claude to harvest training data without their knowledge.
3Sophisticated Evasion Techniques
Chinese labs employed increasingly advanced methods to bypass defenses, including altering system prompts in multi-turn conversations. They targeted Claude's agentic capabilities and data analysis functions specifically. Anthropic discovered labs feeding user-model conversations back into Claude to create training datasets. The company identified six major campaigns since February 2026, all originating from China-based operations.
4Proxy Networks Fuel Secondary Market
A shadow economy has emerged where proxy services both provide Claude access in restricted regions and sell harvested conversations. These networks operate in China, Iran, and Russia using stolen corporate and individual API keys. Some resellers specialize in collecting and redistributing sensitive exchanges without user consent. This ecosystem enables continuous capability extraction despite Anthropic's access restrictions.
5Anthropic's Countermeasures
The company now bans accounts from unsupported regions unless identity-verified. Claude's Fable 5.1 update encrypts reasoning chains and prevents API prompt manipulation. Responses now include summarized internal reasoning before output, reducing stolen data's training value. These measures specifically target common distillation techniques like context editing that attackers use to reveal model internals.
6Broader National Security Concerns
The incidents coincide with China-based AI companies extracting capabilities from multiple US frontier models. US cybersecurity agencies warn these represent systematic intellectual property theft. Some compromised accounts attempted biological weapons research via Claude. The pattern suggests state-affiliated actors may be coordinating capability transfer to advance China's AI development.
7Industry-Wide Challenge
Google and OpenAI have reported similar distillation attacks against their models. The scale suggests an organized effort to close China's AI capability gap. Unlike individual researchers, these industrial operations systematically replicate entire model functionalities. The proxy network infrastructure indicates long-term planning and significant resource investment in these operations.
8Implications for AI Governance
These incidents highlight vulnerabilities in current API access controls and the need for international AI security standards. As frontier models become strategic assets, protection requires technical safeguards and policy measures. The emergence of proxy networks as attack vectors demands new verification approaches. Anthropic's case demonstrates how quickly adversarial techniques evolve against defensive measures.