{"schema_version":"0.10.0","id":"LR-2026-0753","record_version":1,"title":"Chinese labs distillation attacks against Claude","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":2.56,"unhedged_language":4.09},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Only a republished copy: BigGo Finance · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Only a republished copy: BigGo Finance · subject to change"}]},"sources_hash":"a4e30d51eabab60db6bbba664e4e826b81e6ca1947b6a6cc87f7db3228913233"},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-10","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Anthropic reported that it disrupted distillation campaigns against its Claude models by seven China-based AI labs between December 2025 and August 2026, tracking nearly 200 million exchanges across five campaigns. The labs sought to extract Claude's capabilities for training competing models, reaching the service through fraudulent accounts and proxy networks because Anthropic does not offer commercial access in China. Moonshot silently relayed customer conversations through Claude, and some of those conversations contained sensitive information. When Anthropic banned one pool of fraudulent accounts, traffic shifted to a second pool. Anthropic published the findings in a threat intelligence report on 2026-09-10, and Beijing rejected the allegations.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major tier: many third parties, a stated count of hundreds of end users whose sessions contained names, email addresses, company data and other sensitive data.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://finance.biggo.com/news/067536f0-851a-4f10-989e-d0f6cd5e99d2","publisher":"BigGo Finance","date":"2026-09-10","type":"press","title":"Anthropic Says It Broke Up 200 Million-Strong AI Distillation Attacks From Chinese Labs, Russian Hackers - BigGo Finance","archived_url":null,"attachment":"first_report","independence":"derivative"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Anthropic said on Thursday that it had dismantled a series of coordinated efforts over the past eight months to extract the capabilities of its Claude models, including what it described as the largest \"illicit distillation\" operation it has ever observed, allegedly tied to Alibaba, as well as campaigns from several other Chinese AI labs and a suspected Russia-linked cyber espionage group."}],"system.developer":[{"source_index":0,"quote":"Anthropic said on Thursday that it had dismantled a series of coordinated efforts over the past eight months to extract the capabilities of its Claude models, including what it described as the largest \"illicit distillation\" operation it has ever observed, allegedly tied to Alibaba, as well as campaigns from several other Chinese AI labs and a suspected Russia-linked cyber espionage group."}],"event.incident_class":[{"source_index":0,"quote":"Over the last several months, unauthorized labs have developed increasingly sophisticated methods to circumvent our defenses and harvest the capabilities of US frontier models,\" the report reads."}],"impact.severity":[{"source_index":0,"quote":"Many of the relayed exchanges came from users of third-party model routing services commonly used in the United States and Europe, and those sessions contained names, email addresses, company data, and other sensitive data of hundreds of end users in at least a dozen languages."}],"impact.severity_because":[{"source_index":0,"quote":"Many of the relayed exchanges came from users of third-party model routing services commonly used in the United States and Europe, and those sessions contained names, email addresses, company data, and other sensitive data of hundreds of end users in at least a dozen languages."}],"event.summary":[{"source_index":0,"quote":"The San Francisco-based company detailed the findings in its latest Threat Intelligence report, saying it tracked nearly 200 million exchanges linked to distillation attacks across five separate campaigns."},{"source_index":0,"quote":"Anthropic does not offer commercial access to Claude in China, or to subsidiaries of Chinese companies located outside the country, so the labs reached it through proxy networks registered elsewhere."},{"source_index":0,"quote":"Moonshot, the maker of the Kimi chatbot, silently forwarded customer requests to Claude and displayed Claude's answers to users who believed they were talking to Kimi, according to the report."},{"source_index":0,"quote":"Anthropic said some of those conversations included sensitive information."},{"source_index":0,"quote":"When Anthropic banned that pool, the traffic quickly shifted to the second, some of whose accounts were also funneling requests from DeepSeek and Xiaomi, an indication that the same proxy networks serve multiple labs."},{"source_index":0,"quote":"Beijing has rejected the accusations."}]},"notes_on_gaps":"Single source: an Anthropic threat report as reported by a press outlet, so the figures are the report's claims and were not independently verified. No single incident date, detection method, dollar loss, reversibility or count of records is stated; those fields are left out. The attackers were external labs, not the Claude system acting autonomously, so agent_involved, failure_class and failure_class_detail are left out although multi-agent frameworks were used on the attacker side. Root cause 'guardrail' is my judgement from the report's statement that defenses were circumvented. Severity 'major' is my judgement that hundreds of stated end users are many third parties. Model version (Opus 4.6 and 4.7 were named as relayed targets, not a single version) and deployment context are not stated cleanly and are left out. The ShinyHunters, Midnight Blizzard and weapons activity are separate incidents in the source and are excluded. The Moonshot and DeepSeek relay details are included only as they bear on this distillation incident. Context fields are left out because the country of the incident is not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Only a republished copy: BigGo Finance · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Some of the relayed customer conversations included sensitive information.","quote":"Anthropic said some of those conversations included sensitive information.","source_index":0,"grade":"C"},{"step":"reached","text":"Because Anthropic offers no commercial access in China, the labs reached Claude through proxy networks registered elsewhere.","quote":"Anthropic does not offer commercial access to Claude in China, or to subsidiaries of Chinese companies located outside the country, so the labs reached it through proxy networks registered elsewhere.","source_index":0,"grade":"C"},{"step":"done","text":"After Anthropic banned the first pool of fraudulent accounts, traffic shifted to a second pool.","quote":"When Anthropic banned that pool, the traffic quickly shifted to the second, some of whose accounts were also funneling requests from DeepSeek and Xiaomi, an indication that the same proxy networks serve multiple labs.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://finance.biggo.com/news/067536f0-851a-4f10-989e-d0f6cd5e99d2"]},"analysis":{"sections":{"timeline":[{"text":"Period covered by the report of disrupted distillation activity.","quote":"The report, which covers activity disrupted between December 2025 and August 2026, identifies the other three as Zhipu, which operates as Z.ai outside China, SenseTime, and MiniMax.","source_index":0,"when":"December 2025 to August 2026"},{"text":"Anthropic banned the first pool of fraudulent accounts and traffic shifted to a second pool.","quote":"When Anthropic banned that pool, the traffic quickly shifted to the second, some of whose accounts were also funneling requests from DeepSeek and Xiaomi, an indication that the same proxy networks serve multiple labs.","source_index":0,"when":null},{"text":"Anthropic said it had dismantled the coordinated efforts in its threat report.","quote":"Anthropic said on Thursday that it had dismantled a series of coordinated efforts over the past eight months to extract the capabilities of its Claude models, including what it described as the largest \"illicit distillation\" operation it has ever observed, allegedly tied to Alibaba, as well as campaigns from several other Chinese AI labs and a suspected Russia-linked cyber espionage group.","source_index":0,"when":"Thursday"},{"text":"Beijing rejected the accusations.","quote":"Beijing has rejected the accusations.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://finance.biggo.com/news/067536f0-851a-4f10-989e-d0f6cd5e99d2"]}}