Cases › security breach › LR-2026-0753
Chinese labs distillation attacks against Claude
Preliminary Why: Only a republished copy: BigGo Finance · subject to change
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, agent tool, could do, deployer, industry.
Severity major: tier: many third parties, a stated count of hundreds of end users whose sessions contained names, email addresses, company data and other sensitive data.
Anthropic reported that it disrupted distillation campaigns against its Claude models by seven China-based AI labs between December 2025 and August 2026, tracking nearly 200 million exchanges across five campaigns. The labs sought to extract Claude's capabilities for training competing models, reaching the service through fraudulent accounts and proxy networks because Anthropic does not offer commercial access in China. Moonshot silently relayed customer conversations through Claude, and some of those conversations contained sensitive information. When Anthropic banned one pool of fraudulent accounts, traffic shifted to a second pool. Anthropic published the findings in a threat intelligence report on 2026-09-10, and Beijing rejected the allegations.
What happened
What was done
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 4 items from the primary sources
What happened, in order
- December 2025 to August 2026 Period covered by the report of disrupted distillation activity.
Not dated in the sources:
- Anthropic banned the first pool of fraudulent accounts and traffic shifted to a second pool.
- Anthropic said it had dismantled the coordinated efforts in its threat report.
- Beijing rejected the accusations.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The ShinyHunters, Midnight Blizzard and weapons activity are separate incidents in the source and are excluded. The Moonshot and DeepSeek relay details are included only as they bear on this distillation incident.
LR-2026-0753 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON