In late February 2026, Anthropic published one of the most detailed public disclosures of industrial-scale AI distillation attacks the industry has seen. The announcement reveals that three AI laboratories—DeepSeek, Moonshot, and MiniMax—orchestrated massive campaigns to illicitly extract Claude's capabilities across more than 16 million exchanges, using approximately 24,000 fraudulent accounts.
The findings are significant not just for what they expose about competitive espionage in AI, but for what they quietly confirm about a principle that has guided our approach from day one: whoever controls the infrastructure controls the data. And whoever controls the data controls the risk.
What Anthropic Found
The three campaigns followed a similar playbook—fraudulent accounts, proxy services, coordinated traffic patterns—but each targeted distinct capabilities and operated at different scales.
DeepSeek ran the most targeted operation: over 150,000 exchanges focused on reasoning capabilities, rubric-based grading tasks (effectively using Claude as a reward model for reinforcement learning), and generating censorship-safe alternatives to politically sensitive queries. Anthropic traced the accounts to specific researchers at the lab through request metadata. One notable technique involved asking Claude to articulate the internal reasoning behind completed responses step by step—generating chain-of-thought training data at scale.
Moonshot AI (known for the Kimi model family) operated at a much larger scale: over 3.4 million exchanges through hundreds of fraudulent accounts spanning multiple access pathways. Their targets included agentic reasoning, tool use, coding, data analysis, computer-use agent development, and computer vision. Anthropic attributed the campaign through request metadata matching the public profiles of senior Moonshot staff.
MiniMax ran the largest campaign: over 13 million exchanges focused on agentic coding and tool use/orchestration. Anthropic detected this campaign while it was still active—before MiniMax released the model it was training—giving them visibility into the full lifecycle of a distillation attack for the first time.
Why Distillation Is Different from Other IP Concerns
Distillation — A training technique where a less capable model learns from the outputs of a stronger one. Legitimate when used by a lab on its own models to create smaller, cheaper variants. Illicit when used by competitors to extract capabilities without authorization, bypassing the years of research and billions of dollars that built the original system.
It's worth distinguishing what makes distillation distinct from the usual debates about training data and AI intellectual property. When a model is trained on publicly available text, the legal and ethical questions are genuinely complex—fair use, transformative work, the boundaries of copyright in a new medium.
Distillation is different in kind. It involves systematically querying a production service—often through fraudulent accounts and in violation of explicit terms of service—to reverse-engineer the capabilities of a specific model. The extracted capabilities are then stripped of their safety guardrails and embedded into a competing product.
Anthropic frames this as a national security issue, and the specifics of the disclosure justify that framing. US AI companies build systems with safeguards designed to prevent state and non-state actors from using AI to develop bioweapons or carry out malicious cyber activities. Models built through illicit distillation are unlikely to retain those safeguards. If such models are open-sourced, dangerous capabilities can spread beyond any single government's control.
The connection to export controls is direct. Anthropic argues that distillation attacks undermine export controls by allowing foreign labs to close the competitive gap through capability extraction rather than independent development. Without visibility into these attacks, the apparently rapid advancements by these labs are incorrectly cited as evidence that export controls are ineffective. In reality, those advancements depend significantly on capabilities extracted from American models—and executing this extraction at scale still requires access to advanced chips.
The Data Sovereignty Question This Raises
Here's the angle that rarely makes the headline but matters most for every business using AI tools today: every prompt you send to a cloud-based AI service is data that lives on someone else's infrastructure.
This isn't about Anthropic specifically doing anything wrong with customer data. The disclosure actually demonstrates their commitment to monitoring and transparency. But the structural reality remains: when your business workflows, reasoning chains, proprietary processes, and strategic thinking flow through a third-party API, you are inherently dependent on that provider's security posture, access controls, and detection capabilities.
Anthropic detected these campaigns through IP address correlation, request metadata, infrastructure indicators, and corroboration from industry partners. That's sophisticated detection—but it also reveals what's *observable* from the provider side: patterns, metadata, infrastructure signals. The same observability that enables detection also means your data is being processed, logged, and analyzed as part of normal operations.
For teams building competitive advantages on AI—using it for research, coding, strategy, content creation—the question isn't just "which model is best?" It's: who has visibility into how I use that model?
This is precisely why the bring-your-own-key architecture exists in tools like OfficeForge's self-hosted AI team. When you run your own keys—OpenRouter, OpenAI, Anthropic, xAI—on your own VPS, your prompts and outputs never pass through a third-party platform's aggregation layer. The model provider sees API calls from your server, but your internal workflows, the way you chain reasoning across agents, the proprietary logic you encode into your team's behavior—that infrastructure is entirely yours. No shared tenant. No vendor-side observability into your business processes. The same principle applies to the local models running alongside your paid keys: the simplest tasks stay on hardware you control, where the data never leaves your network at all.
Get OfficeForge — $199What This Means for Teams Building on AI
Three practical implications stand out:
1. Vendor concentration creates correlated risk. If your entire AI stack routes through a single provider's cloud, a security incident, policy change, or API disruption affects everything simultaneously. Distributing across providers—ideally with the option to run some work locally—reduces this coupling.
2. Workflow privacy is a competitive concern, not just a compliance one. The Anthropic disclosure shows that sophisticated actors actively monitor and extract patterns from AI interactions at scale. Your team's AI usage patterns—the way you prompt, what you build, how you chain tasks—contain competitive intelligence. Protecting that isn't paranoia; it's operational security.
3. The BYO model trend is accelerating for good reason. The ability to choose your model provider, switch between them, and run portions of your workload on local infrastructure isn't just about cost optimization (though it's that too). It's about maintaining optionality and control in a landscape where the ground shifts fast. When Anthropic can detect industrial-scale extraction campaigns, that's a strength—but it also confirms the scale of the threat.
The Bigger Picture
Anthropic's disclosure is commendable in its transparency and specificity. They named the labs, cited the exchange volumes, and connected the activity to real product roadmaps. They're calling for "rapid, coordinated action among industry players, policymakers, and the global AI community."
That call is necessary. But for individual businesses and teams, the actionable takeaway is simpler: build your AI infrastructure with the assumption that any centralized service is a target—because the evidence says it is.
Self-hosting doesn't make you immune to every risk. But it narrows the attack surface from "every interaction visible to the platform" to "only what leaves your network." In a landscape where three labs coordinated over 16 million exchanges across 24,000 fake accounts to extract a model's capabilities, that narrowing matters.
The companies that will navigate this era best aren't necessarily those with the biggest AI budgets. They're the ones who treat their AI infrastructure with the same rigor they apply to their most sensitive data: own the keys, own the servers, own the access controls. Choose your providers deliberately, and never let convenience override control.
The distillation arms race disclosed by Anthropic is almost certainly the beginning, not the end. The question for every team building on AI is whether their infrastructure is designed for a world where this is normal—or one where it isn't.
FAQ
What is a distillation attack in AI?
Distillation is a technique where a less capable model is trained on the outputs of a stronger one. When done illicitly—without permission and in violation of terms of service—it allows competitors to acquire frontier capabilities in a fraction of the time and cost it would take to develop them independently.
Which labs were implicated in the distillation campaigns?
Anthropic attributed the campaigns to DeepSeek (150,000+ exchanges), Moonshot AI (3.4 million+ exchanges), and MiniMax (13 million+ exchanges), based on IP address correlation, request metadata, infrastructure indicators, and corroboration from industry partners.
Why does distillation pose national security risks?
Illicitly distilled models lack the safety guardrails that US companies build into their systems—protections against bioweapon development, malicious cyber activities, and other dangerous uses. When these capabilities are extracted without safeguards, they can proliferate into military, intelligence, and surveillance systems.
How does self-hosted AI protect against data extraction?
When you run AI infrastructure on your own server with your own API keys, your prompts, workflows, and business logic never pass through a third-party platform. No vendor can observe, aggregate, or repurpose your usage patterns—you control the full data pipeline from input to output.