Anthropic released a report detailing five distillation campaigns targeting its Claude models. The company observed nearly 200 million exchanges linked to these activities, which involve extracting chain-of-thought data to train smaller AI models. These attacks have intensified in recent months, specifically targeting agentic capabilities, coding, data analysis, and logical reasoning.
The largest campaign, attributed to Alibaba, involved 151 million exchanges between May and July 2026. These requests peaked at nearly three million per day and were distributed across 3,500 accounts. Anthropic identified a single fixed prompt used across these accounts to extract internal thinking traces, which the company believes were intended for training the Qwen model family.
A separate campaign linked to Moonshot AI, the creator of Kimi, involved nearly 300,000 requests over a ten-day period. These requests were routed through 5,000 accounts and primarily targeted the Claude Opus model. Anthropic noted that some of these requests appeared to originate from the Chinese military, including tasks related to analyzing surveillance footage for abnormal behavior.
Distillation attacks typically bypass standard defenses by tricking models into revealing their internal reasoning. While Anthropic usually hides these traces, attackers utilized specific prompts, such as translation requests, to force the model to output its thinking process. These efforts represent a significant escalation in unauthorized attempts to harvest capabilities from US-based frontier models.
