Anthropic, the San Francisco-based artificial intelligence company behind the Claude chatbot, has publicly accused several Chinese AI firms of using its proprietary model outputs to train and refine their own competing systems — a practice known in the industry as “distillation.” The allegations, which surfaced in a detailed policy filing, have reignited a fierce debate over intellectual property, model security, and the geopolitical dimensions of the global AI race.
According to reporting by The Hacker News, Anthropic disclosed that Chinese AI companies systematically queried Claude through its application programming interface (API) to generate massive volumes of high-quality text responses. Those outputs were then allegedly fed into the Chinese firms’ own large language models as training data, effectively allowing them to replicate aspects of Claude’s performance without bearing the enormous computational costs of training a frontier model from scratch. Anthropic reportedly identified at least 16 distinct Chinese entities involved in this activity, though the company has not publicly named all of them.
What Distillation Means — and Why It Matters
Model distillation is not a new concept in machine learning. The technique, originally described in academic literature over a decade ago, involves training a smaller or less capable “student” model to mimic the outputs of a larger, more powerful “teacher” model. In legitimate research settings, distillation is a well-understood optimization method. But when applied to a competitor’s proprietary model without authorization, it raises serious legal and ethical questions — particularly when it crosses international borders and involves companies operating under different regulatory regimes.
Anthropic’s complaint centers on the scale and intent of the alleged distillation. The company said the Chinese firms did not simply experiment with Claude’s outputs in a limited fashion. Instead, they reportedly ran automated pipelines that issued millions of prompts to Claude’s API, harvested the responses, and used them as supervised training data for their own models. This approach can dramatically reduce the cost and time required to develop a competitive AI system. Industry estimates suggest that training a frontier large language model from scratch can cost hundreds of millions of dollars in compute alone; distillation from an existing model can shortcut much of that expense.
The Geopolitical Dimension of AI Model Theft
The allegations arrive at a moment of heightened tension between the United States and China over AI supremacy. The Biden and now Trump administrations have imposed increasingly stringent export controls on advanced semiconductors and AI-related technology, aiming to slow China’s progress in developing frontier AI capabilities. U.S. officials have argued that China’s AI ambitions are closely linked to its military modernization and surveillance apparatus, making the technology a national security concern.
Anthropic’s claims add a new wrinkle to this contest. Even as Washington restricts the flow of physical hardware to China, the distillation allegations suggest that Chinese firms may be finding alternative routes to capability gains — not by acquiring chips, but by extracting knowledge embedded in American-built AI models. If substantiated, this would represent a significant intelligence and industrial espionage vector that existing export controls were not designed to address. As The Hacker News noted, the activity described by Anthropic could violate the company’s terms of service, and potentially run afoul of U.S. trade secret laws, though enforcement across jurisdictions remains deeply complicated.
Industry Reactions and the Broader Implications for AI Providers
Anthropic is not the first major AI company to raise alarms about unauthorized distillation. OpenAI, the maker of ChatGPT, has previously expressed concerns about competitors — including Chinese startups — using its model outputs to bootstrap their own systems. In early 2025, OpenAI flagged suspicious API usage patterns that it attributed to entities linked to DeepSeek, a Chinese AI lab that burst onto the scene with surprisingly capable models despite operating under U.S. chip export restrictions. Microsoft, which has a multibillion-dollar partnership with OpenAI, reportedly assisted in investigating the activity.
The pattern suggests a systemic challenge for any company that offers powerful AI models through cloud-based APIs. By design, these APIs are meant to be accessible — that is their commercial purpose. But that accessibility also creates a vulnerability. Every response generated by a frontier model contains implicit information about how that model was trained, what data it absorbed, and how it reasons. At sufficient scale, harvesting these responses can yield a training dataset that approximates the teacher model’s internal knowledge. For AI companies, this creates an uncomfortable tension between the desire to monetize their models broadly and the need to protect their intellectual property.
Technical Countermeasures and Their Limits
Anthropic and its peers have begun deploying technical countermeasures to detect and prevent large-scale distillation. These include rate limiting on API calls, anomaly detection systems that flag unusual query patterns, and watermarking techniques that embed invisible signatures in model outputs. The idea behind watermarking is that if a competitor trains on watermarked outputs, traces of the watermark will appear in the competitor’s model, providing forensic evidence of distillation.
However, experts caution that these defenses are far from foolproof. Sophisticated actors can distribute their API queries across thousands of accounts to avoid rate limits, use prompt engineering to disguise the systematic nature of their harvesting, and apply post-processing techniques to strip or obscure watermarks. The cat-and-mouse dynamic is familiar to anyone who has followed cybersecurity: defenders must protect against every possible vector, while attackers need only find one gap. Anthropic’s decision to go public with its allegations may itself be a strategic move — signaling to potential distillers that their activity is being monitored and that there will be reputational and possibly legal consequences.
Legal Uncertainty Clouds the Path Forward
The legal framework for addressing cross-border AI model distillation remains underdeveloped. In the United States, companies can pursue claims under the Defend Trade Secrets Act, the Computer Fraud and Abuse Act, and contractual terms of service. But enforcing any of these against entities based in China presents enormous practical difficulties. Chinese courts are unlikely to enforce U.S. judgments, and the Chinese government has shown little inclination to crack down on domestic firms that gain competitive advantages through these methods.
Some legal scholars have argued that the U.S. government should treat large-scale model distillation as a form of economic espionage, potentially triggering sanctions or other diplomatic responses. Others contend that the AI industry needs to develop new technical standards and international agreements — analogous to treaties governing intellectual property in pharmaceuticals or semiconductors — to establish clear rules of the road. For now, the legal ambiguity benefits the alleged distillers, who can operate in a gray zone where the technical activity is difficult to prove and the legal consequences are uncertain.
What Anthropic’s Disclosure Signals About the AI Arms Race
Anthropic’s public accusation is notable not just for its substance but for its timing and tone. The company, which was founded by former OpenAI executives and has positioned itself as a safety-focused AI lab, has generally avoided the kind of aggressive public posturing common among tech companies. Its decision to name the scale of the alleged distillation — 16 Chinese entities — and to frame it as a systemic threat suggests that the company views the problem as severe enough to warrant breaking from its usual restraint.
The disclosure also serves a policy purpose. Anthropic has been actively engaged with U.S. policymakers on AI regulation and national security issues. By documenting the distillation threat in concrete terms, the company strengthens the case for regulatory action — whether in the form of new export controls targeting AI model access, mandatory reporting requirements for API providers, or federal funding for technical countermeasures. The filing effectively puts the issue on the congressional agenda at a time when lawmakers are already grappling with how to govern AI.
The Competitive Fallout for Chinese AI Labs
For the Chinese AI firms allegedly involved, the accusations carry both reputational risk and strategic implications. Several of China’s most prominent AI startups — including DeepSeek, Moonshot AI, and others — have attracted significant venture capital and government support on the strength of their technical achievements. If those achievements are shown to rest in part on distilled knowledge from American models, it could undermine investor confidence and invite closer scrutiny from both Chinese regulators and international partners.
At the same time, the Chinese AI sector has made genuine and substantial progress in recent years, driven by a large pool of engineering talent, massive government investment, and access to enormous domestic datasets. Not all Chinese AI capability can or should be attributed to distillation. The challenge for outside observers is distinguishing between legitimate innovation and capability gains derived from unauthorized use of foreign models — a distinction that is technically difficult to make and politically charged on both sides of the Pacific.
As the AI industry matures and the stakes of the U.S.-China technology competition continue to rise, the questions raised by Anthropic’s allegations are unlikely to fade. How companies protect their models, how governments regulate cross-border AI access, and how the international community establishes norms around AI intellectual property will shape the competitive dynamics of the field for years to come.
Pingback: Anthropic Alleges Chinese AI Labs Quietly Reverse-Engineered Claude To Build Their Own Models - AWNews