Anthropic Accuses Chinese AI Firms of Siphoning Proprietary Data to Clone Claude Models

The global race for artificial intelligence supremacy has entered a contentious new phase following a detailed disclosure from Anthropic, which alleges that three prominent Chinese AI laboratories have systematically siphoned data from its Claude models to bolster their own systems.[1][2][3][4][5][6][7][8] According to the San Francisco-based firm, DeepSeek, Moonshot AI, and MiniMax engaged in industrial-scale campaigns to extract the proprietary reasoning and coding capabilities of Claude through more than 16 million unauthorized exchanges.[8] The accusations highlight a growing rift in the international AI community, pitting the originators of frontier models against rivals who are accused of using "distillation" techniques to bypass the immense research and development costs associated with building modern large language models. This development occurs against a backdrop of tightening export controls and intensifying geopolitical competition over the future of generative intelligence.

At the heart of Anthropic’s allegation is a technical process known as model distillation.[9][10][3][6][11][1][2][12][4][7] In a legitimate context, distillation is a standard industry practice where a developer uses a larger, more capable "teacher" model to train a smaller, more efficient "student" model within their own ecosystem.[12][2][5][1][13][14][11][3][6] However, Anthropic contends that the three Chinese labs crossed a critical ethical and legal line by treating Claude as an external teacher model without authorization. By prompting Claude millions of times and recording its highly sophisticated responses, these companies were allegedly able to "clone" the internal logic and behavioral patterns of the model. Anthropic reports that the campaigns involved approximately 24,000 fraudulent accounts created to mask the identity and location of the users, effectively siphoning years of American research into Chinese-developed alternatives at a fraction of the original cost.

The scale of the extraction efforts varied significantly across the three named entities, suggesting different strategic focuses for each lab. MiniMax, a startup that recently gained significant traction in the Chinese market, was identified as the most aggressive actor, responsible for more than 13 million exchanges. Anthropic noted that MiniMax’s operation was particularly focused on agentic coding and tool orchestration.[3][5][13][6] In one instance, when Anthropic released an updated version of its model, MiniMax allegedly redirected nearly half of its automated traffic to the new system within 24 hours, illustrating a highly reactive and sophisticated monitoring operation. Moonshot AI, another unicorn-status lab backed by major Chinese tech conglomerates, was linked to 3.4 million exchanges targeting multi-step reasoning, computer vision, and data analysis. DeepSeek, while responsible for a smaller volume of roughly 150,000 queries, reportedly targeted the most sensitive areas of Claude’s architecture, including its foundational logic and the "chain-of-thought" reasoning processes that allow the model to explain its internal steps before arriving at a conclusion.

To execute these massive data harvests while avoiding detection, the labs allegedly employed a "hydra cluster" architecture.[2][8][12] This method uses sprawling networks of fraudulent accounts distributed across various API access points and third-party cloud platforms, making it difficult for automated security systems to identify a single source of the traffic.[2] Anthropic’s security team was eventually able to trace the activity back to the Chinese firms through a combination of IP address correlation, request metadata, and infrastructure indicators. In some cases, the metadata on the chatbot requests reportedly matched the public profiles of senior staff members at the accused labs.[14][15] Furthermore, the queries themselves were often highly structured and repetitive, designed to elicit high-signal training data. For example, some prompts specifically asked Claude to articulate its internal reasoning for completed tasks or to provide alternatives to politically sensitive queries, which could then be used to align the Chinese models with local regulatory requirements.

Beyond the immediate commercial impact, Anthropic has framed these activities as a significant national security risk.[2][11][7][6] The company argues that when models are developed through illicit distillation, they rarely inherit the complex safety guardrails and alignment procedures designed by the original developers.[6][2] This "free-rider" approach allows foreign entities to create highly capable models that lack the necessary restrictions to prevent them from being used for malicious cyber activities, the development of biological weapons, or large-scale surveillance.[11] Moreover, Anthropic points out that the rapid progress often cited as proof of the ineffectiveness of US export controls may actually be a byproduct of this systematic extraction of American intellectual property. By siphoning capabilities from frontier models like Claude and ChatGPT, these labs can achieve high performance levels without needing the massive computational resources or advanced chips that the United States has sought to restrict.

The allegations from Anthropic are not isolated; they mirror recent complaints from OpenAI, which told US lawmakers that its own models had been subjected to similar distillation attacks by DeepSeek.[14][4][6][5] This unified front among American frontier labs signals a transition from an era of open experimentation to one of heightened defensive posture. As these companies seek to protect their investments, they are increasingly calling for coordinated action between industry players, cloud providers, and policymakers.[5] Recommendations include the development of more robust API monitoring standards and international agreements on the ethical boundaries of model distillation. However, the path forward is complicated by the fact that many of these same US companies have faced criticism for their own data collection practices. Some industry observers have pointed out the irony of AI giants complaining about data scraping when their models were originally trained on massive amounts of copyrighted content from the open web without explicit permission from creators.[8]

The response from the broader AI community and the targeted companies will likely shape the next generation of AI development and safety policy. If distillation is viewed as a form of intellectual property theft rather than a competitive research technique, it could lead to much more restrictive access to AI interfaces and a "closing" of the ecosystem that has, until now, benefited from significant transparency. For the Chinese labs named in the report, the allegations could lead to increased scrutiny from international partners and a further hardening of US trade policies. As the industry moves toward more "agentic" models that can perform complex tasks autonomously, the value of the underlying training data only grows, making the battle over who owns that data the defining conflict of the coming years.

Ultimately, the dispute highlights the fragility of trust in the global AI landscape. While the technology promises to solve complex global challenges, the underlying competition is increasingly defined by zero-sum maneuvers and digital espionage. Anthropic’s disclosure serves as a stark warning that the window for establishing international norms is rapidly closing. Without a consensus on what constitutes fair play in the training of artificial intelligence, the industry risks fracturing into isolated, nationalized silos, where innovation is driven more by the ability to extract data from rivals than by genuine scientific breakthroughs. The resolution of these claims will not only determine the future of Claude, DeepSeek, and MiniMax but will also set the legal and ethical precedents that will govern the development of artificial general intelligence for decades to come.