Anthropic says three Chinese AI labs used roughly 24,000 fraudulent accounts to generate more than 16 million exchanges with Claude.

In a 23 February report, the company named DeepSeek, Moonshot AI and MiniMax. It alleged that the campaigns sought examples of Claude's reasoning, coding, tool use, computer use and vision capabilities for use in developing rival models.

This is a provider's account of conduct on its own service. Anthropic said it reached its attributions with high confidence from IP correlations, request metadata, infrastructure indicators and, in some cases, corroboration from partners. The report does not show that any laboratory successfully recreated Claude's capabilities.

That evidential boundary makes the story more useful, rather than less. It separates what left through the product interface from what did not, and it shows why an account-by-account view can miss one objective spread across thousands of identities.

What Anthropic Observed

Anthropic described three campaigns of very different sizes: more than 150,000 exchanges attributed to DeepSeek, more than 3.4 million to Moonshot and more than 13 million to MiniMax.

It said the operators used large numbers of accounts obtained through third-party platforms, then distributed prompts across them. Anthropic characterised the activity as model distillation and capability extraction conducted in breach of its terms and regional access restrictions.

The object allegedly collected was output: worked examples of how Claude responded to selected problems. Outputs are not model weights. Observable behaviour is not source code. Anthropic did not report that it took customer data or enterprise prompts.

Those distinctions matter because “the model was stolen” would turn an allegation about interface use into a claim about an entirely different asset and result.

Distillation is a Legitimate Technique for Model Development - Permission is the Real Issue

Anthropic acknowledged that distillation is a common and legitimate technique when a developer uses its own model or has permission from the model provider. It becomes contentious here because Anthropic alleges coordinated account fraud, evasion and prohibited use of Claude's outputs.

That means unusual volume cannot carry the decision on its own. Researchers, evaluators and large customers may automate requests, test broad capability coverage or use distributed infrastructure for legitimate work. A proxy, a burst of prompts or an unfamiliar geography can justify review without proving abuse.

Useful signals come from combinations: related accounts, shared payment or infrastructure evidence, repeated task sequences, coverage of particular capabilities, and attempts to work around restrictions. Even then, a provider is making an enforcement decision under its rules. It should retain the grounds, set an expiry for temporary restrictions and offer a route for a legitimate user to challenge a mistaken block.

For customers, the asset question comes first. If the concern is weights, code, training data, customer information or observable product behaviour, say which one. Each leaves by a different route and produces different evidence.

A Specialised Capability Appeared in Three Kinds of Campaigns

On 3 March, Google Threat Intelligence Group published a separate investigation into Coruna, an iOS exploit kit containing five exploit chains and 23 exploits.

Google said it first captured parts of the kit in February 2025, when a customer of a surveillance company used it. Later that year, it observed the same framework in targeted watering-hole attacks against Ukrainian users by a suspected Russian espionage group. It then retrieved the complete kit from broad campaigns run by a financially motivated actor operating from China.

Google said it did not know how the proliferation occurred. The investigation therefore does not prove a sale, theft or hand-off between those actors. It does show the same specialised collection turning up in operational settings with different purposes.

Coruna is not evidence that the laboratories named by Anthropic succeeded. Its value here is evidential. Distinctive code, exploit chains and infrastructure allowed Google to recognise the same framework across campaigns, even though the route of proliferation remained unknown.

For an AI service, provenance is less exact. Similar model behaviour can come from shared public research, independent development, authorised distillation or prohibited extraction. Resemblance is a lead for investigation, not proof of provenance.

Final Perspective

Anthropic can investigate alleged account fraud and enforce its terms. I would keep a separate commercial question in mind: what makes a capability sticky once its behaviour is exposed through a product designed for people to use? Interface controls can raise the cost of coordinated extraction, but they cannot make observation or imitation impossible.

That moves the leadership conversation beyond volumes and account bans. Durable advantage may sit in proprietary data, integration, service quality, distribution, trust and the ability to keep improving. Anthropic's report does not establish that the named laboratories reproduced Claude's capabilities. It does show why defensibility has to account for the product interface as an observation surface.