Model Distillation Campaigns Targeting Anthropic Claude
- Occurred
- Feb 23, 2026
- Published
- Unknown
- Source
- MITRE ATLAS
- Sector
- incident
Summary
Anthropic uncovered campaigns to extract Claude’s capabilities carried out by the three Chinese AI Labs: DeepSeek, Moonshot, and MiniMax. Collectively, these campaigns used approximately 24,000 accounts and 16 million queries. They used model distillation to train their own models on the outputs of Claude in an attempt to replicate Claude’s capabilities such as agentic reasoning, code generation, tool use, and computer use. As outlined in Anthropic's report, model distillation was leveraged as a means for these labs to undermine Anthropic's export controls.[<sup>\[1\]</sup>][1] Distilled models lack the safeguards that prevent bad actors from using frontier models for malicious purposes such as the bioweapon development, disinformation, offensive cyber operations, and mass surveillance. [1]: https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks "Detecting and preventing distillation attacks" Target: Anthropic Claude Actor: DeepSeek, Moonshot AI, MiniMax Reporter: Anthropic Procedure: 1. DeepSeek, Moonshot AI, and MiniMax used commercial proxy services to gain access to Claude. This circumvented Anthropic’s policy of not offering commercial access to Claude in China. 2. DeepSeek, Moonshot AI, and MiniMax generated large datasets of prompts designed to extract capabilities from Claude. 3. The AI labs accessed Claude’s inference API via the combined approximately 24,000 fraudulent accounts. 4. DeepSeek, Moonshot AI, and MiniMax used their generated prompts to repeatedly query Claude and train their own models from the responses. Collectively, the labs issued over 16 million queries during their distillation campaigns. 5. DeepSeek, Moonshot AI, and MiniMax acquired Claude’s capabilities via distillation at a fraction of the cost of developing their own models. They targeted Claude’s most differentiated capabilities including agentic reasoning, tool use, and code generation. 6. The distilled models lack safeguards and could be used for malicious purposes such as offensive cyber operations, disinformation campaigns, mass surveillance, and censorship. 7. The distilled models lack Claude's safety guardrails, potentially exposing users to harmful outputs and behaviors.
Deployers
- Anthropic Claude
Tags
- MITRE ATLAS
- AML.CS0056
Classification
Rationale: Incident involves LLM distillation attacks and capability extraction, representing a notable failure in model security.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8