Anthropic says Chinese AI developers used covert proxy networks to query U.S. models at scale and reproduce their capabilities. The company has reported millions of exchanges and new safeguards, but its allegations have not been independently verified or tested in court.
Anthropic says Chinese AI companies used networks of proxy accounts to extract capabilities from leading U.S. AI models at industrial scale. The allegations are serious, but the public evidence described so far is not enough to independently establish how each company obtained or used the outputs.
A September report by Anthropic named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It alleged that, over two years, the companies drew billions of tokens through millions of exchanges with models including Claude, GPT, Gemini and Grok. A joint advisory from the National Security Agency, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation, issued on September 8, described distillation as a legitimate research method while warning that some China-based firms had allegedly used it aggressively to obtain restricted capabilities. That government warning is a cybersecurity assessment, not a judicial finding about any named company.
The distinction matters: extracting model outputs is not the same as proving theft of model weights or source code. In machine learning, knowledge distillation generally trains a student model on outputs from a more capable teacher; it can transfer useful behavior without providing access to the teacher's internal parameters. The method is widely discussed in AI research, including in the foundational distillation paper by Geoffrey Hinton and colleagues. Using the method is not, by itself, evidence of wrongdoing; authorization and the means of obtaining the training data are central to the dispute.
Anthropic's account of Moonshot AI offers a specific example. The company said requests presented to users as interactions with Moonshot's Kimi chatbot were instead routed to Claude. It reported 300,000 customer requests over ten days, handled through 5,380 accounts it described as fraudulent and operating through proxy services in Singapore and Japan. A separate account of the May-July 2026 campaign attributed more than 23 million exchanges to Moonshot AI and said the alleged scheme involved redirecting Kimi users' prompts to Claude. The available material does not include public confirmation from Moonshot AI. The ten-day figure and the three-month total may describe different scopes or periods; neither has been independently verified.
Anthropic also alleged that Alibaba conducted more than 151 million exchanges between May and July 2026 through more than 3,500 accounts it called fraudulent, with activity peaking at nearly three million interactions a day. These are figures attributed to Anthropic, not independently measured results. Descriptions of the campaigns also refer to stolen payment details, credentials and API keys, as well as third-party aggregators, cloud providers and proxy services used to conceal or distribute access.
On October 13, Anthropic said it had blocked tens of thousands of accounts linked to distillation campaigns and that new safeguards had sharply reduced such activity, according to Reuters' report. The company also named Z.ai, or Zhipu, alleging that it had tried to extract Claude's capabilities while developing GLM-5.3. Anthropic said the activity created security and national-security risks. Publicly available information does not indicate that the company filed lawsuits against the named firms or that courts have ruled on the allegations.
The central evidentiary challenge is attribution. Aggregate request totals do not by themselves show which prompts produced useful training examples, how outputs were filtered, whether they were incorporated into a model, or what capabilities a resulting system acquired. The available accounts provide counts of exchanges and accounts, but not a public, independently assessed dataset, a controlled comparison, confidence intervals or other statistical measures that would allow outsiders to evaluate the claims as they might a reproducible study. Research centers such as MIT and Stanford illustrate the broader academic ecosystem in which model evaluation and reproducibility are active concerns, but no finding from either institution is presented here as evidence about these allegations.
Shenzhen investment manager Wang Zebin told the South China Morning Post that Anthropic's report lacked concrete examples sufficient for outsiders to verify how the named companies acquired or used model outputs. Moonshot AI and DeepSeek did not respond to the newspaper's requests for comment. The South China Morning Post also reported that China's Cyberspace Administration questioned seven domestic developers before focusing on DeepSeek and Moonshot. No public court ruling has established the allegations against the companies.
Such scrutiny of AI companies is also appearing in local oversight, including a New York City hearing that was expected to bring major developers before city council members. The settings differ, but both put a practical question before institutions: what evidence can establish how powerful AI systems are being used and who is responsible when access controls fail?
Distillation can transfer behavior through examples or model outputs, while copying weights would involve access to the model's learned parameters. That difference is important for interpreting the accusations: the reported activity concerns obtaining and using answers, not demonstrated theft of model weights or code. As in scientific reporting in journals such as Nature, clear methods and inspectable evidence would help distinguish a measured result from an allegation. Until such evidence is independently available, the reported account totals and claims about model use should be treated as Anthropic's allegations, not as verified findings about every company's conduct.
