Anthropic Flags Distillation Wave From Alibaba and Moonshot
Anthropic reported on Thursday, 10 September 2026, that nearly 200 million Claude exchanges across five distillation campaigns were linked to efforts to harvest chain-of-thought for training competing models. The largest campaign, attributed to Alibaba, alone accounted
PromptCrates Editorial
Staff Writer
Anthropic reported on Thursday, 10 September 2026, that nearly 200 million Claude exchanges across five distillation campaigns were linked to efforts to harvest chain-of-thought for training competing models. The largest campaign, attributed to Alibaba, alone accounted for about 151 million exchanges between May and July 2026, peaking near 3 million requests a day across roughly 3,500 accounts. The disclosure lands as frontier labs escalate accusations that rivals are using product APIs as unpaid teachers for smaller models.
How the distillation campaigns actually worked
Distillation, in this sense, is not a public research collaboration. Attackers prompt a frontier model, capture its reasoning traces, then use those traces as supervised fine-tuning data for a smaller student model. Anthropic says it normally shows users a summarized thinking view rather than raw chain-of-thought. Campaign operators tried to bypass that boundary with translation-style prompts—including katakana-only Japanese instructions—that tricked Claude into emitting fuller thinking traces.
TechCrunch’s coverage of Anthropic’s distillation report describes fixed prompts designed to extract chain-of-thought for Qwen-related training in the Alibaba-linked wave. Moonshot AI’s Kimi-linked activity was smaller by volume—about 300,000 requests in ten days via roughly 5,000 accounts—but Anthropic said it focused heavily on Opus and included at least one request that asked Claude to assess CCTV footage for abnormal behavior with routing that appeared to track toward Chinese military infrastructure.
OpenAI had previously blamed DeepSeek for similar harvesting. Anthropic’s February call-outs and this September dossier together sketch a pattern: when one lab’s API is cheaper or more convenient than training from scratch, another lab’s training stack may treat that API as a data mine. That is the commercial fight behind the security language.
Why raw chain-of-thought is the prize
Summarized thinking is a product feature and a safety control. Raw chain-of-thought is a training asset. If a competitor can farm millions of high-quality reasoning traces, it can compress months of research into weeks of supervised fine-tuning. Anthropic’s numbers matter because they quantify the scale: 151 million exchanges is not a handful of curious developers; it is industrial throughput.
The same report sits in a wider security conversation PromptCrates has tracked, including Anthropic’s enterprise security Mythos work and policy pressure around NIST agent standards and the Stop Rogue AI Act. Distillation abuse is not the same as a jailbreak that asks for malware, but it is still unauthorized use of a paid capability to rebuild a rival’s cognitive stack.
CNBC’s roundup of Anthropic and OpenAI existential concerns places the distillation fight next to broader competitive anxiety: labs fear both capability leakage and narrative leakage when rivals announce “open” models that look suspiciously well-taught.
What buyers and policymakers should watch now
Enterprise buyers should ask vendors three practical questions. First, how does the provider detect fixed-prompt distillation at account and cohort level? Second, what happens when thinking traces are requested through translation or role-play wrappers? Third, which contract terms treat bulk CoT extraction as abuse rather than ordinary usage?
Security teams that already worry about cyber capability gates—see our note on frontier labs gating cyber capabilities and OpenAI Astra’s critical cyber monitorability tradeoffs—should add distillation monitoring to the same risk register. A model that refuses exploit PoCs but freely emits industrial volumes of reasoning traces still transfers value.
Policymakers will hear competing stories. Labs will frame distillation as theft of intellectual work. Accussed organizations will call the same behavior fair use of a public API. The evidence Anthropic published—account counts, daily peaks, prompt templates—shifts the debate from vibes to telemetry. Whether regulators treat API harvesting as trade-secret theft, terms-of-service breach, or ordinary competition remains unsettled.
The durable news from 10 September 2026 is scale with names attached. Nearly 200 million exchanges. Five campaigns. Alibaba’s wave at 151 million. Moonshot’s smaller but Opus-heavy spike. DeepSeek already in the blame cycle from OpenAI. Distillation is no longer a niche security blog topic; it is a first-rank competitive and compliance issue for anyone shipping or buying frontier models.
For security operations centers, the operational playbook looks familiar even if the payload is novel: detect coordinated account farms, fingerprint fixed prompts, throttle suspicious thinking-extraction patterns, and share indicators with peer labs when campaigns cross products. Anthropic’s decision to name Alibaba, Moonshot, and the DeepSeek precedent raises the diplomatic temperature; quiet takedowns without attribution would have been safer for bilateral tech relations but weaker as deterrence. Naming is a strategy. So is publishing peak daily volume near three million requests, a number that procurement committees will remember.
Researchers studying model stealing will note that translation wrappers are an old red-team trick applied to a new asset class. If katakana-only Japanese can elicit fuller traces, other orthography and cipher games will follow. Defenders need evaluations that treat “show your work” coercion as a first-class abuse case, not an afterthought to classic jailbreaks. That evaluation gap is as important as the raw exchange counts.
Competitive fallout and compliance pressure ahead
Legal teams will debate whether bulk CoT harvesting violates trade-secret law, computer-fraud statutes, or only API terms of service. Product teams will respond with rate limits, cohort detectors, and quieter thinking surfaces that are harder to coerce into raw traces. Investors will ask which lab’s training stack depends on another lab’s API, because that dependency is both a cost advantage and a litigation risk.
None of this ends open research collaboration. It does mean that “we trained on public outputs” is no longer a casual shrug when the outputs were coaxed through thousands of accounts at millions of requests per day. Anthropic’s dossier forces procurement questionnaires, SOC2 appendices, and model-card footnotes to mention distillation explicitly. The labs that ignore the telemetry will keep winning short-term capability races and losing long-term trust.
