Anthropic accuses DeepSeek, Moonshot AI, and MiniMax of coordinated ‘distillation attack’ on Claude

Anthropic says it has uncovered what it describes as a coordinated effort by three Chinese AI companies to siphon knowledge from its Claude model, escalating tensions between U.S. and Chinese labs at a moment when the race for AI dominance is intensifying.

In a statement released Monday, Anthropic accused DeepSeek, Moonshot AI, and MiniMax of running a large-scale “distillation attack” campaign. According to the company, the firms flooded Claude with carefully structured prompts intended to extract useful behaviors and capabilities that could then be used to train their own systems.

“We have identified industrial-scale campaigns by three AI laboratories—DeepSeek, Moonshot, and MiniMax—to illicitly extract Claude’s capabilities to improve their own models. These labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, in violation of our terms of service and regional access restrictions,” Anthropic said.

The allegation places Anthropic alongside OpenAI, which has raised similar concerns in recent months about attempts to replicate frontier models through indirect data harvesting.

Distillation itself is widely used across the AI industry. The technique allows smaller models to approximate the performance of larger ones by learning from their outputs. It has become a common efficiency strategy, especially for teams working with limited compute budgets.

“Distillation can be legitimate: AI labs use it to create smaller, cheaper models for their customers. But foreign labs that illicitly distill American models can remove safeguards, feeding model capabilities into their own military, intelligence, and surveillance systems,” Anthropic wrote in a post on X.

Anthropic’s concern centers on scale and intent. The company said the three firms allegedly bypassed its commercial access restrictions in China by relying on proxy services. That workaround, according to the statement, opened the door to networks running tens of thousands of Claude accounts simultaneously.

“Once access is secured, the labs generate large volumes of carefully crafted prompts designed to extract specific capabilities from the model,” Anthropic said in the statement.

Anthropic Says DeepSeek, MiniMax Used 24,000 Accounts to Mine Claude Responses

The company estimates that the activity produced more than 16 million Claude interactions across roughly 24,000 fraudulent accounts. Anthropic said MiniMax accounted for the largest share of traffic, with more than 13 million exchanges.

DeepSeek, Moonshot AI, and MiniMax had not responded to requests for comment at the time of reporting.

Anthropic’s claims arrive amid a broader drumbeat from U.S. AI companies warning about model distillation efforts tied to Chinese labs. Earlier this month, OpenAI submitted an open letter to U.S. lawmakers stating it had observed activity “indicative of ongoing attempts by DeepSeek to distill frontier models of OpenAI and other US frontier labs, including through new, obfuscated methods,” CNBC reported.

OpenAI has tracked signs of such behavior since early last year. When DeepSeek released its first model, some users remarked on similarities to ChatGPT, according to a January 2025 Financial Times report citing people familiar with the matter.

Anthropic acknowledged in its own statement that AI firms “routinely distill their own models to create smaller, cheaper versions.” The company framed its concern around competitive dynamics, arguing the practice could allow rivals to obtain advanced capabilities far faster and at far lower cost than building systems independently.

Both Anthropic and OpenAI have cast the issue in national security terms. Like OpenAI, which labeled the activity “adversarial distillation,” Anthropic warned about the risk that “authoritarian governments deploy frontier AI for offensive cyber operations, disinformation campaigns, and mass surveillance.”

The situation remains murky. Some observers online quickly pointed out that distillation plays a standard role in modern AI development, including within U.S. labs themselves. Critics question where the line sits between normal optimization work and improper extraction.

Rui Ma of Tech Buzz China said the framing carries policy implications. Anthropic has long treated compute leadership as a national priority and has supported tighter export controls on advanced chips to China.

“Whether intentional or not, the narrative of illicit capability transfer strengthens the case for stricter chip restrictions,” Ma said.

Fresh reporting the same day added fuel to the debate. Reuters reported that U.S. officials believe DeepSeek trained part of its model on Nvidia’s Blackwell chips, potentially sidestepping export controls, according to anonymous senior officials.

Taken together, the developments reflect rising anxiety in Washington over China’s pace in AI. Many of the advances drawing attention appear tied, directly or indirectly, to technology originating in the United States.

The allegations surfaced as speculation about a DeepSeek 4 release gained traction online, with some social media users claiming the model could perform “50x” better than current U.S. systems. DeepSeek has not confirmed the claim.

“Looks to me like Anthropic is panicked because DeepSeek V4 is going to beat Opus 4.6 on the SWE benchmark. No doubt Anthropic is highly capable for coding agents. They’ve been the best all along. But DeepSeek is about to change that. And screaming, “they stole our answers!” isn’t really going to fly. Opus itself was trained on knowledge distilled from other, previous models,” a user said on X.

Meanwhile, the White House announced late last week the creation of an AI-focused Peace Corps initiative to promote American AI systems abroad and help partner nations adopt them.

The dispute over distillation is unlikely to cool soon. As frontier models grow more capable and more expensive to build, the incentive to replicate their behavior at lower cost is only getting stronger.