One Alibaba-linked operation ran 151 million exchanges through Claude between May and July, peaking at nearly 3 million queries a day across more than 3,500 fraudulent accounts. It is the largest distillation campaign Anthropic says it has ever measured.
Here is the part shareholders need to sit with: at the API level, every one of those queries was a paying customer.
Last week we tracked how Washington polices China-origin AI at the chip layer — whether a chipmaker-owned inference hub can ever be treated as neutral. This week that same question moved up the stack, from silicon to the models themselves. On September 8, the NSA, CISA, and FBI jointly named six Chinese firms — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — accused of "industrial-scale" distillation of Claude, GPT, Gemini, and Grok since late 2024. Three days later, Anthropic put numbers to it.
The reflex is to read this as a security story. It isn't. For anyone who owns Anthropic, OpenAI, or the frontier labs through their private markups or their partners, this is a business-model story, and an uncomfortable one.
Start with the mechanics, because they define the whole problem. Distillation runs through the exact same paid inference API that books revenue. The Alibaba swarm didn't breach anything. It bought subscriptions — reportedly through a gray market of proxies — and hammered the endpoint with "identical or similar prompt texts" at volumes "far exceeding legitimate research."
The leak is the product. The thing that generates the revenue is the thing being siphoned.
The leak is the product. The thing that generates the revenue is the thing being siphoned.
This is why chip export controls miss it entirely. You can gate GPUs at the border; you cannot gate a query that arrives dressed as a customer paying full retail. The agencies themselves flagged the tell — Chinese firms rely on "bulk procurement of the US AI companies' premium subscriptions shared across teams of developers." The distiller isn't stealing compute. It's renting yours.
Moonshot's method is the cleanest illustration of how thin the wall is. It silently forwarded some of its own Kimi users' requests to Claude, showed those users Claude's answers as if they came from Kimi, and saved the exchanges — including the reasoning transcripts — to train on. In one ten-day window it relayed roughly 300,000 requests, most to Claude Opus, through 5,380 fraudulent accounts. More than 23 million exchanges were attributed to Moonshot over the quarter. DeepSeek ran a similar play — reportedly over 12 million distillation attacks in 14 days in July.
Some of those forwarded requests contained sensitive information from individual users and multinational companies. Anthropic says it doesn't know whether Moonshot ever told its customers their prompts were being shipped to a competitor's model. Sit with that: the enforcement problem and the privacy problem are the same problem.
Now the legal reality. Anthropic's own framing is that these practices are "likely inconsistent with privacy laws and the labs' own terms of service." Read that carefully. A terms-of-service violation, routed through shell accounts registered in Singapore and Japan, against a Beijing counterparty, is legally close to toothless. There is no cross-border TOS remedy that stops 3 million queries a day.
So the labs are left with a technical fix, not a legal one — and this is where the fork that matters for margins opens up.
The agencies' recommended mitigation is remarkable. US firms should get better at detecting the swarms — flag accounts with suspicious subscription-to-usage ratios, new accounts that instantly max out usage, and harden identity verification. Then, for suspected distillers, "subtly" degrade the output: correct answers with different reasoning, added stylistic inconsistencies, shallower reasoning depth. Or just secretly switch the account to an inferior model.
And do it silently. The advisory's exact recommendation is to "avoid informing" suspected users of the downgrade.
Here is the tax. The agencies concede that legitimate users caught in the dragnet "could suddenly receive shorter responses or experience withheld capabilities" — and be "switched to a dumber model without receiving any alert." The detection machinery — identity verification, enterprise-user tracking — lands hardest on exactly the paying enterprise customers whose spend justifies the premium these companies command.
You degrade product quality and trust to protect a product whose entire value proposition is quality and trust. That's the trap.
And it's not hypothetical. The advisory itself points to the precedent: last year OpenAI faced swift backlash and quickly made changes to an automatic routing system that "consistently defaulted to less capable variants unless users explicitly added phrases like 'think harder.'" Paying users noticed instantly. The advisory notes Chinese firms have automated QA that can tell "service issues from defensive data degradation," and that some can detect when a smarter model is available and switch within 24 hours.
Translation: the fix reliably annoys your real customers and gets routed around by the distillers within a day. The sophisticated adversary detects the degradation; the loyal enterprise account just experiences a worse product and doesn't know why.
Against this stands Garry Tan, who would rather absorb the leak than pay that tax. "I would do nothing" about distillation, he told CNBC at Y Combinator's Demo Day. "We could argue that there should be an American distillation regime." He calls open-weight models "the ideal case" and thinks the real job for regulators is preserving a price premium that keeps the frontier business model feasible — not policing the API.
The three paths each cost something different. The NSA/CISA/FBI path taxes product quality and user trust. Tan's path concedes the leak and bets the moat lives in staying enough ahead that distillation only ever produces a lagging copy. OpenAI's 2024 routing episode is the warning label on the middle path: try to be clever about who gets the good model, and your best customers revolt.
Which brings us to the accountability question shareholders should actually price.
The labs are demanding IP protection for model outputs while their own training data is the subject of open litigation over other people's IP. The New York Times is reportedly suing OpenAI. Anthropic reportedly settled with a consortium of book authors in 2025. Tan named this hypocrisy directly — much of the training data these models were built on "may be covered under copyright law."
So the frontier labs are asking for legal protection on outputs they built by ingesting content they didn't clearly have the right to ingest. That argument is not going to hold as a legal right. What that means for investors is blunt: the moat here is not a statute. There is no court order coming that stops a query from Singapore.
The moat is a capability — subscriber verification, anomaly detection, and the ability to identify a distiller without breaking the experience for the CFO's team on an enterprise seat. That is an operational competence, and it is the thing to judge the next quarterly print on.
One more line worth holding, because it captures the whole strangeness: Alibaba is, simultaneously, one of Anthropic's paying API customers, an accused distiller running 151 million exchanges through Claude, and a competitor now reportedly shipping a substantially more cost-efficient e-commerce agent against Anthropic's own. The customer, the thief, and the rival are the same company.
So watch for three things next quarter. Whether identity-verification and routing changes show up as churn or downgrade complaints from enterprise accounts. Whether the labs quantify distillation losses at all, or keep them in a threat report rather than a filing. And whether anyone builds detection good enough to stop 3 million queries a day without the paying customer ever noticing.
That last one is the entire business. Everything else is a press release.