Anthropic says it caught five distillation campaigns against Claude, including 151 million requests from Alibaba

TechCrunch reports Anthropic has released a threat-intelligence report naming five separate distillation campaigns against Claude, totalling close to 200 million requests aimed at extracting the model's internal chain-of-thought reasoning. TechCrunch says Anthropic ties the campaigns to accounts linked to Alibaba, Moonshot AI (the maker of Kimi), and DeepSeek, and quotes Anthropic saying "unauthorized labs have developed increasingly sophisticated methods to circumvent our defenses and harvest the capabilities of US frontier models".

The numbers Anthropic put in the report

The largest campaign named in the TechCrunch account is tied to Alibaba: 151 million exchanges from May to July 2026, peaking at 3 million exchanges per day across 3,500 accounts. A smaller campaign tied to Moonshot AI is described as about 300,000 requests over 10 days across 5,000 accounts. TechCrunch does not give per-day or per-account figures for the DeepSeek campaign or for the remaining two of the five.

Anthropic's stated concern, per TechCrunch, is that the goal of the requests was to harvest capabilities: agentic behaviour, tool use, coding, data analysis, and logical reasoning. One Moonshot request in the report is described as analysing surveillance footage for "abnormal" behaviour, said to be routed from Chinese military sources. The attackers used prompt-injection patterns, including framing requests as translation tasks to expose Claude's reasoning trace.

How the abuse worked

TechCrunch's account is that the campaigns targeted the internal thinking traces the model produces before its visible answer, not the answers themselves. That is the piece a competitor training a smaller model would want: paired examples of a prompt and the full reasoning the frontier model produced, which is expensive to synthesise and cheap to copy once produced.

Framing the prompt as a translation task is one of the older jailbreaks in the public literature, and TechCrunch says Anthropic saw it repurposed at industrial scale to slip past the guardrails that hide the reasoning trace. The report also names the account count against the daily volume, which is how Anthropic's abuse team distinguishes a scripted campaign from ordinary heavy use: 3 million requests per day across 3,500 accounts is roughly 860 requests per account per day, sustained.

What it means for a team on Claude's API

A team building on the Claude API is not the target here, but the report changes what "abuse" looks like inside the platform they share. Anthropic's action against these campaigns is what keeps the same rate limits and pricing available for legitimate customers, and the report is the first named-and-numbered version of that argument the company has published.

The second implication is on the visibility of reasoning traces. If translating the prompt into another language was the payload the abuse team saw work, the reasoning trace is being treated as a leakable side channel by adversaries at scale. Anyone building an evaluation harness against Claude that logs the trace should know it is treated as extractable, and design retention accordingly.

Source

• Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek, TechCrunch, 10 September 2026.