Anthropic: 151 Million Transactions Attributed to Alibaba

Key Takeaways

1Anthropic claims to have detected five distillation campaigns targeting Claude

2The largest campaign is attributed to Alibaba with 151 million exchanges between May and July 2026

3Another campaign, attributed to Moonshot AI, reportedly targeted Opus through about 5,000 accounts in 10 days

4Specific techniques allowed for the extraction of the thought chain despite protections

Why it matters : These campaigns illustrate the extent of industrial attempts to extract advanced capabilities from American models and train competitors.

Anthropic claims to have identified five distillation campaigns targeting Claude, totaling nearly 200 million exchanges. According to the company, the largest is attributed to Alibaba, while another, attributed to Moonshot AI, reportedly targeted Opus primarily through thousands of accounts. Techniques were designed to force the disclosure of thought chains that the company does not normally expose.

Alibaba attributed with 151 million exchanges from May to July 2026

Anthropic states that it has attributed the majority of distillation attempts to Alibaba, describing this set as the "largest bulk distillation effort" ever observed by the company. Between May and July 2026, the company claims to have recorded 151 million exchanges related to this campaign, with a peak approaching three million per day. The requests were spread across 3,500 accounts sharing a fixed thought chain extraction prompt, leading Anthropic to view it as a unique effort to produce training material for the Qwen model family.

Moonshot AI reportedly targeted Opus via 5,000 accounts over 10 days

Anthropic attributes another campaign to Moonshot AI, the maker of Kimi, noting that it appeared to convey requests from the Chinese military. The company cites, for example, a request aimed at evaluating surveillance videos to detect abnormal behavior. Over a period of 10 days, it reports nearly 300,000 requests sent to Claude through a network of about 5,000 accounts, primarily targeting the Opus model.

Le brief IA que lisent les pros

Le brief IA que les pros lisent chaque soir

Les 7 actus IA du jour, décryptées en 5 min. Gratuit.

Inclus dès l'inscription : notre sélection des meilleurs guides & comparatifs IA.

Choisissez votre rythme

Gratuit · Pas de spam · Désabonnement en 1 clic

Dedicated techniques to extract the thought chain

Anthropic does not typically expose the internal thought chain of its models and instead presents summarized thoughts. However, the company reports that campaigns have used specific techniques to push the model to deliver its reasoning traces. In one example, the attacker reformulated the solicitation as a translation task into Japanese in katakana to deceive the system. Generally, these operations aim to extract the thought chain from a response to subsequently exploit it in the supervised training of a smaller model with general reasoning.

Five campaigns in total and a recent escalation

In total, Anthropic claims to have observed nearly 200 million exchanges attributed to five distinct campaigns. The company has released a new report alleging persistent distillation attacks conducted by actors based in China and an escalation in recent months, with unauthorized labs developing more sophisticated methods to bypass its defenses and exploit cutting-edge models. According to Anthropic, the campaigns targeted several capabilities of Claude, such as agentic functions and tool usage, programming, data analysis, and logical reasoning. Anthropic had previously mentioned these attacks in February, and OpenAI has similarly attributed similar activity to DeepSeek. The new document presents them as broader and more aggressive than those described earlier.