Anthropic Accuses Chinese Firms of Using Claude to Train Rival AI Models

In February 2026, a major AI controversy shook the global technology landscape. Anthropic, the creator of Claude AI, accused three Chinese AI firms of conducting large-scale “distillation attacks” to extract and replicate its model’s capabilities. What began as a terms-of-service dispute has now evolved into a geopolitical flashpoint involving intellectual property, national security, and the future of AI competition between the U.S. and China. Here’s everything you need to know.

In late February 2026, one of the most consequential developments in the global artificial intelligence (AI) race unfolded, involving accusations that have reverberated far beyond Silicon Valley and Beijing: Anthropic, the U.S. developer of the advanced AI system Claude, publicly accused three prominent Chinese AI labs — DeepSeek, Moonshot AI and MiniMax — of anomalously using the Claude model to enhance their own AI systems via large-scale “distillation” campaigns.

This story touches on a range of critical issues shaping the international AI landscape — from intellectual property rights and tech competitiveness to national security, regulatory gaps, ethical norms in AI, and broader U.S.–China tensions over emerging technologies. Below, we unpack the full narrative, technical details, responses from key stakeholders, competing viewpoints, and what this may mean for the future of AI.

1. The Initial Accusation — What Happened?

On February 23, 2026, Anthropic publicly stated it had uncovered what it described as “industrial-scale distillation attacks” on Claude — its flagship AI model and one of the largest language models (LLMs) deployed by enterprises, governments and developers.

According to the company’s announcement:

• Three Chinese AI labs — DeepSeek, Moonshot AI, and MiniMax — allegedly created approximately 24,000 fraudulent accounts to interact with Claude.

• These accounts generated more than 16 million unique query exchanges with the Claude model.

• The purpose, Anthropic claims, was to extract Claude’s reasoning, writing, coding, censorship-handling and other advanced capabilities and use that information to train or prime their own AI systems through a process called distillation.

• The activity violated Anthropic’s terms of service, regional access restrictions (Claude access was already limited in China), and allegedly bypassed safeguards designed to prevent data harvesting.

Anthropic noted that some of this behavior was continuing in real time, and even described how MiniMax alone accounted for the bulk of the interactions — over 13 million of the 16 million-plus total.

Anthropic framed these actions not merely as competitive mischief but as a serious threat to intellectual property, safety, and even national and economic security, especially if distilled models are deployed without the built-in safety training that Claude has.

2. What Is “Distillation” and Why It Matters

To grasp what’s at stake, it helps to understand what distillation means in the AI context.

In machine learning, distillation is a standard technique where a smaller model (“student”) learns from the outputs of a larger, more powerful “teacher” model — mimicking its behavior at reduced computational cost. This can make models cheaper to run and tailor them to specific tasks or deployment environments.

However, there’s a key distinction:

• Legitimate distillation is used by developers on their own systems with permission or open-source models.

• Anthropic’s accusation concerns using distillation illicitly — actively querying Claude on a large scale to extract its cleverest responses, then using that data to train new models without authorization.

The concern is not theoretical. If this sort of extraction succeeds, the resulting models may replicate advanced reasoning and behaviors of Claude without having done the costly foundational training themselves — essentially cutting decades off the competitive lead of the original model creators. That’s why Anthropic’s statement stressed both economic and security implications.

Arguably, distillation is a gray area in AI research: many organizations distill models for benign tasks. But what distinguishes this case, per Anthropic, was the scale, use of fraudulent accounts, and lack of authorization — making it closer to industrial espionage than standard research practice.

3. How It Allegedly Worked: Fraudulent Accounts and High-Volume Queries

Anthropic’s analysis identified that the distillation campaigns were industrial in scale:

• 24,000 accounts were created to mask the volume and purpose of queries.

• More than 16 million interactions with Claude were logged.

• The queries included not only broad reasoning and conceptual questions but also chain-of-thought demonstrations, code generation, and subtle inference patterns that feed directly into model training.

• Some queries even focused on censorship evasion techniques — language that would normally be restricted or sanitized — allegedly training rival models to respond in politically sensitive or censored contexts.

These sorts of outputs are precisely the sort of data most coveted by competing AI labs because they reflect the nuanced internal logic of an advanced model — something that is typically far more resource-intensive to generate via conventional training on raw data alone.

Anthropic claimed to have implemented detection systems to identify this activity as it occurred, but the episode exposed how AI platforms can be manipulated at scale through proxy accounts and volume-based extraction tactics.

4. Legal and Contractual Dispute — Terms of Service vs. AI Norms

Anthropic’s formal argument rests on the idea that the use of Claude in this way violated its terms of service and access restrictions. Since Claude access was limited or blocked in mainland China for security reasons, any access that circumvented regional restrictions – especially at such scale – was inherently illegal under the access contract.

However, no widespread international legal framework exists yet that clearly defines illicit AI model distillation or IP theft in AI. While Anthropic’s claim frames this as a contractual violation, enforcing intellectual property rights over generative model outputs remains an open legal frontier. Many open-AI research practices involve scraping and learning from publicly available text — steps that are themselves in legal debate.

This ambiguity has sparked pushback from some AI experts outside of Anthropic, arguing that:

• Distillation is a common research practice when properly licensed;

• There’s no clear legal precedent that model outputs, once generated, remain proprietary;

• Restricting access may stifle innovation and exchange in the global AI research community.

Nevertheless, in this case, Anthropic’s contention is that the scale, fraud, and potential for competitive abuse elevate this beyond normal research into extractive behavior that should be governed by clearer policies and enforcement.

5. Reactions from Chinese AI Community and Public Debate

The accusations quickly triggered debate across the tech world.

In China, reactions ranged from denial of wrongdoing to counterclaims that such criticism reflects broader geopolitical tensions rather than fair technical critique. Some commentators argue that China’s AI firms have developed capable technologies independently and that the AI space thrives on open scientific exchange. Others point out that U.S. firms themselves frequently train models on vast troves of public data under contested legal frameworks, questioning the double standard in how the practice is framed.

Some Chinese AI developers dismiss the contract-breach framing, emphasizing that distillation is legitimate when done responsibly, and accusing Western firms of trying to protect monopolistic proprietary advantage.

Still others in the global research community emphasize the need for clearer international norms and standards around data usage, model distillation ethics, and cooperative frameworks for AI safety and innovation.

6. Geopolitical Backdrop: AI, National Security and Export Controls

Anthropic’s statement did not stop at accusing individual companies. It connected the alleged distillation attacks to broader national security concerns, advocating for stronger export controls on advanced AI chips and coordinated global governance structures that restrict access to foundational AI technologies.

This ties into wider policy debates in the U.S. government and international forums over whether AI technology — especially high-performance hardware and foundational models — should be treated as strategic assets akin to aerospace or military hardware. As tensions with China rise over technology leadership, trade restrictions, and strategic competition, the Claude dispute coincides with growing calls to curb the flow of advanced AI-enabling technology to foreign firms perceived as adversarial.

One indication of this broader geopolitical flux: analysts have likened China’s AI sector growth, including companies like MiniMax and DeepSeek, to previous rapid technology booms (like EVs) that experienced explosive investment but are now facing scrutiny over sustainability and strategic risk.

7. Broader Implications for the AI Ecosystem

The Claude story is not just an isolated spat; it highlights several larger themes in how AI is evolving globally:

a. Intellectual Property in AI Is Still Undefined

Unlike software, where source code and binaries are clearly owned and licensed, AI training practices and model outputs occupy a legal gray zone. Questions such as “Who owns the outputs of a generative model?” and “Can those outputs be used to train competitive systems?” remain unsettled.

This ambiguity is ripe for international conflict and might require new legal frameworks for AI IP protection and enforcement.

b. Competitiveness vs. Collaboration

AI research has traditionally been collaborative — academics publish papers, share models, and pool insights. But as commercial stakes have skyrocketed, so has competitive secrecy. The Claude case reflects the tension between open scientific exchange and proprietary advantage in commercial AI.

c. Security and Safety Concerns Are Intertwined with Commercial Strategy

Anthropic’s linking of distillation attacks to national security dialogues is revealing: AI safety is no longer just about model robustness or bias, it is also about controlling how advanced systems are deployed, accessed, and replicated — especially by actors in strategic rival nations.

d. International Norms Lag Behind Technology

The lack of clear international norms governing AI model extraction, training data rights, and cross-border use of AI capabilities means companies and governments must set their own rules, leading to conflicts that mirror broader geopolitical tensions.

8. What Comes Next? Potential Outcomes and Watchpoints

In the wake of the Claude dispute, several developments may unfold:

Stronger AI Usage Terms and Monitoring Tools

AI providers may embed more sophisticated monitoring to prevent unauthorized querying and extraction, and create terms of service with stronger legal enforceability across jurisdictions.

International Agreements on AI Ethics and Usage

Just as nuclear, aerospace, and biotechnology sectors have multilateral treaties and conventions, AI may see fresh efforts at international governance frameworks that set clear standards on training, distillation, data rights, and cross-border research.

Trade and Export Controls Tighten

The U.S. and allied countries may move to restrict the export of advanced AI chips and software tooling to countries deemed strategic competitors, arguing that hardware control translates into competitive advantage and security.

Chinese AI Sector Push-Back and Domestic Innovation

Chinese AI companies may respond by accelerating domestic hardware and training ecosystems, pushing for self-reliant infrastructure less dependent on foreign models or chips.

9. Conclusion

The accusations that Chinese AI companies used Claude to “steal” capabilities via distillation attacks represent far more than a unilateral complaint — they signal a turning point in how AI competition, intellectual property, national security, and ethics intersect in the twenty-first century.

What initially looks like a contractual conflict now resonates across realms of geopolitics, licensing norms, technology leadership and international regulation. The Claude controversy underscores that AI is not just an engineering venture, but a strategic frontier at the heart of economic power and geopolitical rivalry.

As this story continues to unfold, the AI industry — and the world — will be watching closely to see whether this dispute catalyzes clearer global standards or deepens the divide between competing technological spheres.