Anthropic accuses DeepSeek, MiniMax of data copying, distillation attacks

Anthropic said that DeepSeek, MiniMax Group Inc, and Moonshot AI violated its terms of service by generating more than 16 million exchanges with its Claude models through 24,000 fraudulent accounts

US-based artificial intelligence (AI) firm Anthropic said that three leading AI developers in China carried out large-scale “distillation” campaigns to illicitly extract outputs from its Claude models, in what it describes as a coordinated effort to bolster rival systems.

 

In a detailed blog post, the San Francisco-headquartered company said DeepSeek, MiniMax Group Inc, and Moonshot AI violated its terms of service by generating more than 16 million exchanges with its Claude models through 24,000 fraudulent accounts.

 

Anthropic warned that such campaigns are “growing in intensity and sophistication,” adding that “the window to act is narrow, and the threat extends beyond any single company or region,” and will require rapid, coordinated action among industry players, policymakers and the global AI community.

 

 

What did Anthropic find?

 

Anthropic said it identified three distinct distillation campaigns, each marked by abnormal usage patterns. The volume, structure and focus of the prompts were unlike legitimate customer activity and instead reflected deliberate capability extraction.

 

Each campaign specifically targeted Claude’s most differentiated capabilities, including agentic reasoning, tool use and coding. 

We’ve identified industrial-scale distillation attacks on our models by DeepSeek, Moonshot AI, and MiniMax.  These labs created over 24,000 fraudulent accounts and generated over 16 million exchanges with Claude, extracting its capabilities to train and improve their own models.

— Anthropic (@AnthropicAI) February 23, 2026

 

What was DeepSeek accused of doing?

 

According to Anthropic, DeepSeek generated more than 150,000 exchanges, primarily targeting reasoning capabilities across diverse tasks.

 

The company detected synchronised traffic across accounts, with identical usage patterns, shared payment methods and coordinated timing. These indicators suggested “load balancing” tactics aimed at increasing throughput, improving reliability and avoiding detection.

 

In one notable technique, DeepSeek’s prompts asked Claude to imagine and articulate the internal reasoning behind a completed response and write it out step by step. This effectively generated large-scale chain-of-thought training data, a valuable resource for improving reasoning performance in AI models.

 

What was the scale of Moonshot AI’s campaign?

 

Anthropic said Moonshot AI carried out over 3.4 million exchanges with Claude. The operation targeted:

 

• Agentic reasoning and tool use
• Coding and data analysis
• Computer-use agent development
• Computer vision

 

The scale and scope of the prompts indicated an attempt to systematically extract advanced capabilities for model training and reinforcement learning workflows.

 

How extensive was MiniMax’s activity?

 

MiniMax’s campaign was the largest, accounting for over 13 million exchanges.  The operation focused on:

 

• Agentic coding
• Tool use and orchestration

 

Anthropic said that when it released a new model during MiniMax’s active campaign, the company pivoted within 24 hours. Nearly half of its traffic was redirected to capture capabilities from the latest system, underscoring what Anthropic described as a highly adaptive extraction strategy.

 

How did distillers access frontier models despite restrictions?

 

Anthropic emphasised that it does not provide commercial access to Claude in China, nor to subsidiaries of the companies located outside the country.

 

So how did the distillation campaigns gain access?

 

The firm explained that some labs use commercial proxy services that resell access to Claude and other frontier AI models at scale. These services operate what Anthropic calls “hydra cluster” architectures, sprawling networks of fraudulent accounts that distribute traffic across its API as well as third-party cloud platforms.

 

When one account is banned, another replaces it. In one instance, a single proxy network managed more than 20,000 fraudulent accounts simultaneously.  Once access is secured, labs generate large volumes of carefully crafted prompts designed to extract

specific capabilities.

 

How is Anthropic responding?

 

In response to the large-scale distillation campaigns it uncovered, Anthropic said it has rolled out a comprehensive, multi-pronged strategy, which involves:

 

• Detection: Built classifiers and behavioural fingerprinting systems to identify distillation patterns in API traffic
• Intelligence sharing: Sharing technical indicators to develop a more holistic view of the distillation landscape
• Access controls: Strengthened verification for accounts,  programmes commonly used to create fraudulent accounts
• Countermeasures: Developing model-level safeguards to curb illicit distillation without affecting legitimate users

 

Was this the first distillation controversy involving a US AI company?

 

Anthropic’s claims are not the first instance of concerns over distillation practices. According to a report by Bloomberg, Anthropic’s rival OpenAI recently warned US lawmakers that DeepSeek had used distillation techniques as part of “ongoing efforts to free-ride on the capabilities developed by OpenAI and other US frontier labs.”

 

White House AI czar David Sacks, have also expressed concerns that DeepSeek employed similar methods.