News / Model Watch · Distillation dispute
Anthropic's New Threat Report Names Alibaba, Moonshot AI and Xiaomi in Claude Distillation Campaigns
On September 10, 2026, Anthropic published its latest threat intelligence report — "Detecting and countering misuse of AI" — and its illicit-distillation section reads as a second escalation in this year's running dispute: Alibaba is now named for what Anthropic calls the largest illicit distillation source it has found (151M+ attributed exchanges), Moonshot AI is described serving Claude responses instead of Kimi while collecting exchanges for training, and Xiaomi appears for the first time, accused of replaying 400k+ real user sessions through Claude. These are Anthropic’s allegations, not independently established findings. This article has not independently verified the named companies’ responses or tested their API availability.
What happened: Anthropic's Sep 10, 2026 report (covering Dec 2025–Aug 2026) attributes industrial-scale Claude distillation to Alibaba, Moonshot AI and Xiaomi — new names and mechanisms beyond its Feb 2026 report (DeepSeek, Moonshot, MiniMax). The claimed scale: Alibaba — 151M+ exchanges from 3,500+ accounts (May–Jul 2026, peaking near 3M/day); Moonshot — routed live user traffic through Claude and reconstructed deleted reasoning traces via reasoning-signature replay; Xiaomi — 400k+ requests across 1,500+ accounts via proxy services. Builder takeaway: The report is evidence of allegations, not an endpoint health check or a pricing announcement. Check your vendor’s current documentation and status before changing a production integration.
What the report actually says (from the primary source)
- Scope: the report covers operations Anthropic disrupted between December 2025 and August 2026, across seven harm areas — cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. All cases used Claude Haiku, Sonnet, or Opus; the report states no misuse was found on its Fable/Mythos-class models with one distillation exception.
- Alibaba (GTG case, "largest illicit distillation"): Anthropic attributes more than 151 million exchanges to Alibaba between May and July 2026, peaking at nearly 3 million per day from more than 3,500 accounts it describes as fraudulent. The stated goal: extract Claude capabilities to improve Qwen models.
- Moonshot AI (GTG-16002): rather than bulk querying, Moonshot is described as routing live customer conversations through Claude — serving Claude answers where Kimi was expected — and collecting the exchanges as training data. The report also describes a reasoning-trace reconstruction technique: saving the reasoning signature from a Claude response, starting a new session, and eliciting Claude to expand the signature back into full reasoning — circumventing a control that stripped visible chain-of-thought.
- DeepSeek (GTG-16001): also described as serving Claude instead of its own models and collecting exchanges, including data the report says contained sensitive information — "full specifications, organizational structure, and strategic objectives of a flagship AI program." DeepSeek was named in February's report too.
- Xiaomi (GTG-16008) — first time named: Xiaomi is accused of saving full request/response pairs from its own users and replaying those sessions through Claude for SFT and RL data. Anthropic counted more than 400,000 requests routed across more than 1,500 accounts via proxy services.
What this article can and cannot establish
- The primary source establishes what Anthropic alleges and the evidence it says it observed. It does not independently establish responsibility, legal liability or the named companies’ position.
- No API availability or pricing conclusion follows from this report alone. This article did not conduct endpoint tests or a comprehensive search for company responses.
- Future policy or licensing changes are possibilities to monitor, not outcomes established by this report. Check the exact license of any model version you plan to deploy.
The builder's read: trust, routing, and hedging
- For production workloads: favor endpoints with clear upstream identity and data-use terms. Use your own availability checks and current vendor documentation when deciding whether to change a production route.
- For data-sensitive teams: the Moonshot and Xiaomi cases — real user traffic allegedly replayed through a competitor's model — are a reminder that the terms-of-service and data-residency story of your model vendor matters, whichever vendor you pick. Read the data-use clause before shipping user conversations to any API.
- For hedgers: keep the open-weights hedge but pin the license of whatever you download. MIT (DeepSeek) and Apache-2.0 (Qwen small/mid models) remain the builder-friendly defaults; anything newer from the named companies deserves a license read before you standardize on it.
Access from outside China — and the usual disclaimer
This site tracks Chinese model APIs for international builders — official endpoints, pricing and open-weights status — so policy shocks like this one get covered with the builder impact separated from the headlines. Qwen, Kimi, DeepSeek and GLM guides are linked below.
Independence disclaimer: ChinaModelAPI is an independent information site, not affiliated with Anthropic, Alibaba, Moonshot AI, Xiaomi or any model vendor. The allegations summarized here come from Anthropic's own publication (Sep 10, 2026) and press coverage of it; they are contested-or-unanswered claims, not established facts, and no purchase or routing decision should rest on them alone.
Primary sources
FAQ (2026)
What does the September 2026 report claim?
Eight months of disrupted Claude misuse (Dec 2025–Aug 2026), with distillation campaigns attributed to Alibaba (151M+ exchanges from 3,500+ accounts), Moonshot AI (Claude served instead of Kimi, reasoning traces reconstructed) and Xiaomi (400k+ replayed user requests across 1,500+ accounts). One side's allegations.
Different from February's report?
The February report named DeepSeek, Moonshot and MiniMax. The September report includes Alibaba and Xiaomi and describes additional alleged data-collection mechanisms. The figures cover different scopes and periods, so they should not be read as a directly comparable growth series.
Does it affect the Chinese APIs I call?
The report itself does not establish an API outage, price change or migration requirement. This article has not tested the named endpoints. Check current vendor documentation and your own service monitoring before changing an integration.
What should builders watch next?
Look for attributable responses from the named companies, actual vendor service notices, and the license of the exact model release you use. Treat predictions about policy or licensing as scenarios rather than confirmed changes.
Have the companies responded?
This article has not independently verified the named companies’ response status. Absence of a response in the source material reviewed here should not be treated as proof that no response exists.
Why does this matter for open weights?
The dispute can inform questions about provenance and data-use terms, but it does not change the license of a model by itself. Review the license attached to the exact weights you intend to use.