Anthropic Accuses DeepSeek, Moonshot, and MiniMax of Large-Scale Distillation Attacks on Claude

16 Million Exchanges via 24,000 Fake Accounts

Anthropic publicly accused three Chinese AI companies — DeepSeek, Moonshot AI, and MiniMax — of coordinated campaigns to illegally extract Claude's capabilities through model distillation, the company revealed on February 24, 2026.

Scale of the Attack

The numbers are staggering:

• Total exchanges: Over 16 million
• Fraudulent accounts: Approximately 24,000
• Largest offender: MiniMax, with over 13 million exchanges
• Focus areas: Complex reasoning, coding assistance, and tool use — areas Anthropic considers key differentiators for Claude

What is Distillation?

Distillation is a technique where a less capable model is trained on the outputs generated by a stronger AI system. In this case, the Chinese firms allegedly used commercial proxy services and fraudulent accounts to access Claude at scale while avoiding detection, then used the outputs to train their own models.

flowchart TD
    HUB(("16 Million Exchanges via<br/>24,000 Fake Accounts"))
    HUB --> L0["Scale of the Attack"]
    style L0 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    HUB --> L1["What is Distillation?"]
    style L1 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    HUB --> L2["National Security<br/>Implications"]
    style L2 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    HUB --> L3["Industry-Wide Problem"]
    style L3 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    style HUB fill:#4f46e5,stroke:#4338ca,color:#fff

flowchart LR
    IN(["Input prompt"])
    subgraph PRE["Pre processing"]
        TOK["Tokenize"]
        EMB["Embed"]
    end
    subgraph CORE["Model Core"]
        ATTN["Self attention layers"]
        MLP["Feed forward layers"]
    end
    subgraph POST["Post processing"]
        SAMP["Sampling"]
        DETOK["Detokenize"]
    end
    OUT(["Generated text"])
    IN --> TOK --> EMB --> ATTN --> MLP --> SAMP --> DETOK --> OUT
    style IN fill:#f1f5f9,stroke:#64748b,color:#0f172a
    style CORE fill:#ede9fe,stroke:#7c3aed,color:#1e1b4b
    style OUT fill:#059669,stroke:#047857,color:#fff

flowchart TD
    HUB(("16 Million Exchanges via<br/>24,000 Fake Accounts"))
    HUB --> L0["Scale of the Attack"]
    style L0 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    HUB --> L1["What is Distillation?"]
    style L1 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    HUB --> L2["National Security<br/>Implications"]
    style L2 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    HUB --> L3["Industry-Wide Problem"]
    style L3 fill:#e0e7ff,stroke:#6366f1,color:#1e293b
    style HUB fill:#4f46e5,stroke:#4338ca,color:#fff

National Security Implications

Anthropic framed the attacks as national security threats, expressing concern about "authoritarian governments deploying frontier AI for offensive cyber operations, disinformation campaigns, and mass surveillance."

Industry-Wide Problem

OpenAI has reported similar distillation attacks from Chinese firms. The revelation comes as the U.S. debates AI chip export controls and the broader implications of Chinese AI development.

Anthropic said it has implemented new detection systems and banned the accounts involved.

Source: CNBC | The Hacker News | TechCrunch | CNN | Anthropic

Anthropic Accuses DeepSeek, Moonshot, and MiniMax of Large-Scale Distillation Attacks on Claude — operator perspective

Treat Anthropic Accuses DeepSeek, Moonshot, and MiniMax of Large-Scale Distillation Attacks on Claude the way you'd treat any other dependency change: pin the version, run it through your eval suite, watch p95 latency for a week, and only then promote it from canary. For an SMB call-automation operator the cost of chasing every new release is real — re-baselining evals, re-pricing per-session economics, retraining the on-call team. The ones that ship adopt slowly and on purpose.

What AI news actually moves the needle for SMB call automation

Most AI news is noise. A new benchmark score, a leaderboard reshuffle, a leaked memo — none of it changes whether your AI receptionist books appointments without dropping the call. The handful of things that do move production AI voice and chat are concrete: realtime API stability (does the WebSocket survive 5+ minutes without a stall?), language coverage (does it handle 57+ languages with usable accents, or is English the only first-class citizen?), tool-use reliability (does the model actually call the right function with the right argument types under load?), multi-agent handoffs (do specialist agents receive structured context, or just transcripts?), and latency under load (p95 first-token under 800ms when 200 concurrent calls hit the same endpoint?). The CallSphere rule on news is: if it doesn't move at least one of those five numbers in a measurable eval, it's a blog post, not a product change. What to track: provider changelogs for realtime endpoints, tool-call schema changes, language-add announcements, and any deprecation that pins your stack to a sunset date. What to ignore: leaderboard wins on tasks that don't map to your call flow, "agentic" benchmarks that don't measure tool latency, and demos that work because the prompt was hand-tuned for the demo. The teams that ship fastest treat AI news the same way ops teams treat CVE feeds — read everything, act on the small fraction that touches your runtime, archive the rest.

FAQs

Q: Why isn't anthropic Accuses DeepSeek, Moonshot, and MiniMax of Large-Scale Distillation Attacks on Claude an automatic upgrade for a live call agent?

Explore a live demo and compare current plans to find the right fit for your business.

Q: How do you sanity-check anthropic Accuses DeepSeek, Moonshot, and MiniMax of Large-Scale Distillation Attacks on Claude before pinning the model version?

A: The eval gate is unsentimental — a regression suite that simulates real call traffic (noisy ASR, partial inputs, tool-call timeouts) measures four numbers, and a candidate has to win on three of four without losing badly on the fourth. Anything else is treated as a blog post, not a stack change.

Q: Where does anthropic Accuses DeepSeek, Moonshot, and MiniMax of Large-Scale Distillation Attacks on Claude fit in CallSphere's 37-agent setup?

A: In a CallSphere deployment, new model and API capabilities land first in the post-call analytics pipeline (lower stakes, async, easy to roll back) and only later in the live realtime path. Today the verticals most likely to absorb new capability first are IT Helpdesk and After-Hours Escalation, which already run the largest share of production traffic.

See it live

Want to see it helpdesk agents handle real traffic? Walk through https://urackit.callsphere.tech or grab 30 minutes with the founder: https://callsphere.ai/book.