How Seven Chinese AI Labs Stole 190+ Million Claude Conversations in Massive Distillation Attack
Executive Summary
In September 2026, Anthropic disclosed that seven China-based AI laboratories, including Alibaba, Moonshot, DeepSeek, and others, conducted industrial-scale illicit distillation attacks against Claude AI models between February and July 2026. The attackers used networks of fake accounts created with stolen credit cards and API keys to extract over 190 million conversation exchanges, routing requests through proxy services to harvest Claude's capabilities including chain-of-thought reasoning, coding abilities, and logical reasoning functions for unauthorized training of competing models.
This incident highlights the emerging threat landscape of AI model theft and intellectual property extraction, representing a new category of cybercrime where nation-state affiliated entities systematically steal proprietary AI capabilities to advance their own technological development and competitive positioning.
Why This Matters Now
AI model distillation attacks represent a critical new threat vector as organizations increasingly rely on frontier AI models for competitive advantage, with nation-state actors now systematically targeting intellectual property embedded in AI systems.
Attack Path Analysis
Chinese AI labs conducted industrial-scale model distillation attacks against Claude by establishing proxy networks with fraudulent accounts using stolen credentials and API keys. Attackers scaled operations across multiple regions, routing millions of user requests through proxy services to harvest model capabilities. Labs like DeepSeek and Moonshot silently intercepted user conversations, while others like Alibaba operated massive extraction campaigns targeting chain-of-thought reasoning. The stolen model interactions were systematically collected and sold through secondary markets. Harvested data was used to train competing AI models, with some campaigns processing over 150 million exchanges. The attacks resulted in unauthorized replication of proprietary AI capabilities and potential exposure of sensitive user data from multinational companies and state actors.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers established proxy networks using fraudulent accounts created with stolen credit cards, login credentials, and illegally harvested API keys from legitimate companies and individuals to gain unauthorized access to Claude API services
MITRE ATT&CK® Techniques
Valid Accounts
Compromise Accounts: Email Accounts
Brute Force
Exploit Public-Facing Application
Exfiltration Over C2 Channel
Exfiltration Over Web Service
Masquerading
Data Manipulation: Stored Data Manipulation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Authentication Factors
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – ICT Third-Party Risk
Control ID: Article 11
CISA ZTMM 2.0 – Strong Identity Verification
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21
GDPR – Security of Processing
Control ID: Article 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI model theft targeting companies like Anthropic through industrial-scale distillation attacks threatens proprietary algorithms, intellectual property, and competitive advantages in software development.
Information Technology/IT
Sophisticated proxy networks using fraudulent accounts and stolen API keys compromise IT infrastructure security, requiring enhanced zero trust segmentation and anomaly detection capabilities.
Financial Services
Stolen credit cards enabling fraudulent account creation for model distillation attacks expose financial institutions to compliance violations and unauthorized access to sensitive customer data.
Research Industry
Chain-of-thought reasoning extraction from AI models threatens research institutions' proprietary methodologies, potentially compromising competitive research advantages and intellectual property protection.
Sources
- Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attackshttps://thehackernews.com/2026/09/anthropic-says-seven-china-based-ai.htmlVerified
- Anthropic Threat Intelligence Report - September 2026https://www.anthropic.com/threat-intelligence-report-september-2026#illicit-distillation-sep-26Verified
- US Agencies Accuse China AI Firms of Systematic Model Extractionhttps://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.htmlVerified
- AI Insights: Model Distillation - UK Governmenthttps://www.gov.uk/government/publications/ai-insights/ai-insights-model-distillation-htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the scale and reach of this AI model distillation attack by constraining cross-regional proxy operations and limiting automated extraction pipelines through segmented access controls and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Identity-aware access controls would likely constrain the ability to establish large-scale proxy networks by limiting account creation patterns and reducing the effectiveness of credential-based authentication bypass attempts across cloud services.
Control: Zero Trust Segmentation
Mitigation: Segmented access policies would likely constrain cross-regional account rotation and limit the ability to scale operations across geographic boundaries by restricting lateral privilege expansion between isolated account pools and regional services.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain inter-service communication paths and reduce the ability to establish covert relay stations by limiting unauthorized cross-platform routing and restricting lateral movement between AI service endpoints.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility and control policies would likely constrain the coordination of large-scale extraction campaigns by limiting command infrastructure reach and reducing the ability to orchestrate synchronized operations across thousands of distributed fraudulent accounts.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely constrain automated data extraction pipelines and reduce the volume of harvested model exchanges by limiting outbound data flows and restricting systematic collection of sensitive user conversations and reasoning transcripts.
While intellectual property theft would likely still occur, the reduced scale of successful data extraction would limit the completeness of model replication efforts and constrain the volume of harvested exchanges available for secondary market distribution.
Impact at a Glance
Affected Business Functions
- AI Model Development and Training
- Intellectual Property Protection
- API Service Operations
- Customer Data Privacy
Estimated downtime: N/A
Estimated loss: N/A
Over 190 million user exchanges with Claude AI including sensitive information from individual users, major multinational companies, and state-affiliated actors. CoT reasoning capabilities and proprietary model training data were extracted without authorization through fraudulent API access.
Recommended Actions
Key Takeaways & Next Steps
- • Implement egress security and policy enforcement to detect and block unauthorized API request routing and data exfiltration to suspicious destinations
- • Deploy multicloud visibility and control systems to identify anomalous automation patterns, repeated malformed requests, and suspicious large-scale API usage
- • Establish zero trust segmentation with identity-based policies to prevent unauthorized account creation and enforce least privilege access to AI services
- • Enable encrypted traffic protection and east-west traffic security to secure model interactions and prevent interception of sensitive conversations
- • Deploy threat detection and anomaly response capabilities to baseline normal API usage patterns and alert on industrial-scale extraction attempts
