Two days after the US government's distillation advisory, Anthropic put a number on it: 151 million exchanges -- plus a Russian espionage campaign and a bioweapons-adjacent disruption in the same report

Two days after the National Security Agency, CISA, and the FBI jointly accused six China-based AI companies of running industrial-scale campaigns to copy US frontier models, Anthropic put its own numbers on the dispute. The company's fourth threat-intelligence report, published September 10, says operators affiliated with Alibaba ran the largest campaign to extract Claude's capabilities that Anthropic has ever measured -- and, in the same document, discloses two things the government's advisory never touched: a Russia-linked group that used Claude at multiple stages of an espionage campaign against Ukrainian and European targets, and five cases in which working scientists used Claude in ways Anthropic says could plausibly support biological-weapons research.

The report covers activity Anthropic's Threat Intelligence team says it identified and disrupted between December 2025 and August 2026, across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional-weapons development, and illicit distillation. Claude's Haiku, Sonnet, and Opus models were exploited across the cases; Anthropic says its Fable- and Mythos-class models resisted misuse in every instance but one distillation case. This is the fourth such report Anthropic has published since March 2025 -- each has arrived roughly every four to seven months, and each has described a larger, more organized campaign than the one before it.

This is not the first time Anthropic has made this specific accusation. On February 23, the company disclosed that DeepSeek, Moonshot, and MiniMax together had run coordinated distillation campaigns against Claude through roughly 24,000 fraudulent accounts, logging a combined 16 million exchanges. Measured against that baseline, Alibaba's campaign alone -- a different company, a later window -- is nearly ten times the exchange volume from roughly a seventh of the accounts: about 43,000 exchanges per account this time, against roughly 670 per account in February. Anthropic doesn't draw that comparison itself, and a smaller, more efficient set of accounts isn't proof of a more sophisticated operation on its own -- it could just as easily mean Anthropic caught this one later, after more damage was already done. Either reading points the same direction: whatever changed between February and May, the campaigns getting through are moving more data per account, not just more accounts.

What's actually new since Tuesday's government advisory

The NSA/CISA/FBI advisory, issued September 8, named the same three companies -- plus MiniMax, StepFun, and Z.AI -- and said the six had pulled "billions of tokens" from Claude, GPT, Gemini, and Grok since late 2024. That framing was sweeping but generic: no single company's account counts, no dated campaign windows, no named techniques. Anthropic's report is the opposite kind of document -- one company's own telemetry, with specific numbers attached to three named labs, covering a much narrower window (May through July 2026) than the advisory's multi-year claim.

151 million (Alibaba-linked exchanges with Claude, May-July 2026, per Anthropic)

Operators affiliated with Alibaba ran the biggest of the three campaigns Anthropic describes. Between May and July 2026, Anthropic recorded more than 151 million exchanges with Claude tied to the operation, peaking at nearly three million exchanges a day, using more than 3,500 fraudulent accounts set up with disposable email addresses and virtual payment cards. The technique, per Anthropic and independent technical analysis, was chain-of-thought harvesting: extracting Claude's full reasoning traces, not just its final answers, specifically to train successor models. Anthropic says the harvested transcripts were used to help train Alibaba's Qwen 3.5, 3.6, and 3.7 models.

Moonshot AI's campaign was smaller in volume but different in method. Anthropic says Moonshot routed close to 300,000 customer requests through roughly 5,380 accounts over just ten days, silently forwarding the queries to Claude and returning Claude's answers to Moonshot's own Kimi users as if they were native Kimi output -- a technique reporters have called a "transfer station": an intermediary service that relays queries to a rival model and recycles the responses for training data, all invisible to the end user who thinks they're talking only to Kimi.

DeepSeek used a third method again. Anthropic attributes more than 12 million distillation attempts to DeepSeek over 14 days in July 2026, using what CellCog's technical writeup calls a cross-session replay attack: capturing Claude's reasoning signatures across separate sessions, then replaying them through DeepSeek's own training pipeline. The targeting was specific -- Anthropic says it concentrated on users of Claude Code and the Claude Agent SDK, where reasoning traces run longer and richer than in a typical chat exchange.

As of this report, none of the three has responded on the record. CNBC says Alibaba, Moonshot, DeepSeek, Xiaomi, and MiniMax all declined to comment when asked; the South China Morning Post reports the same silence. That leaves Anthropic's account, for now, as the only one in public circulation -- a point worth holding onto through everything that follows.

Put the three campaigns side by side and the scale gap between Alibaba's operation and the other two is the first thing that stands out -- not because the smaller campaigns are less serious, but because it says something about how differently each lab apparently chose to run its extraction, whether by design or by how quickly Anthropic caught it.

Read the two campaigns' accounts against their volume and an odd asymmetry shows up: Moonshot's operation used more fraudulent accounts than Alibaba's -- 5,380 against 3,500-plus -- to produce a tiny fraction of the traffic. That could mean Moonshot's accounts were more aggressively rate-limited or flagged before they could scale, or that Anthropic simply caught this one faster. Anthropic's report doesn't say which, and it's the kind of gap that would matter to anyone trying to judge how much distillation traffic is actually getting through undetected right now.

The incentive behind all three campaigns is straightforward economics. Training a frontier-competitive model from scratch costs hundreds of millions of dollars in compute; distilling a rival's already-trained reasoning is a documented shortcut to most of the capability at a fraction of the cost. That's the same economic argument sitting underneath a separate, related dispute the government's own advisory raised: CISA called DeepSeek's widely cited $5.6 million training-cost figure misleading, on the grounds that it excludes whatever the company's models owe to distilled data from other labs. Nobody -- not CISA, not Anthropic, not DeepSeek -- has published a revised cost estimate that accounts for that gap, which means the number still circulating in most coverage of DeepSeek's efficiency is the one three separate documents now say is incomplete.

The same report also caught a Russian state group -- and a separate criminal one

Distillation is one of seven harm areas in the report, and not the one Anthropic leads with. The company says a group consistent with tradecraft it associates with Russia's Midnight Blizzard -- tracked internally as GTG-20006 -- used Claude at multiple stages of a sustained espionage campaign against more than 20 organizations: government ministries, embassies, intelligence bodies, and defense contractors, concentrated on Ukraine and on companies in the military-drone supply chain. Claude reportedly helped with reconnaissance, initial access through device-code phishing, credential harvesting, data extraction, and maintaining persistence on compromised systems -- and, notably, autonomously modifying and rebuilding detected malware to evade security products once flagged.

The group's targeting reached beyond espionage in the traditional sense: Anthropic says it went after drone-component manufacturers and at least one military drone maker, seeking proprietary vision-system software, unannounced product architecture, and supplier dependencies -- and, separately, used compromised hotel WiFi vendors to distribute malware via DNS hijacking (a technique researchers have nicknamed "CaptiveCrunch"), and stole WhatsApp conversations from senior Ukrainian officials using headless-browser automation. A related operation exfiltrated more than 300,000 national identity records and roughly half a million commercial-registry entries from an unnamed North African government.

Anthropic is careful about how confident it is here, and says so explicitly: it attributes GTG-20006 to Midnight Blizzard based on "public reporting" and consistency with that group's known tradecraft -- the term security researchers use for a threat actor's characteristic tools and methods -- not on forensic proof unique to this case. It applies a similar caution elsewhere in the report: a separate case involving Russian state-media distribution, tracked as GTG-24015, gets a "high confidence" label for the fact of state distribution, but Anthropic says outright it cannot determine what share of that operation's actual published output was Claude-generated.

"A majority of the operations described in this report were enabled by AI via direct execution or orchestration." -- Anthropic's own framing of what has changed since its earlier reports

A second, unrelated case shows a different kind of actor entirely. Anthropic describes a Russian-speaking operator, tracked as GTG-50020, who injected malicious instructions into an AI vendor's evaluation sandbox to extract live production API keys -- then automatically switched to using the stolen keys to attack roughly 30 companies over four days. CellCog's technical analysis frames the shift plainly: across this report's cases, the credential became the target, not the model's own capabilities. An API key that unlocks someone else's account is worth more to an attacker than anything Claude itself would refuse to help with directly.

Anthropic's stated response across every case in the report follows the same three steps: disrupt the specific accounts and infrastructure involved, apply what it learned to tighten its own safeguards, and, where it judges it appropriate, share what it found with law enforcement and industry partners. That's a meaningful step further than simply banning an account -- it implies Claude's own detection systems get updated against each new technique as it's found, and that at least some of this intelligence reaches other AI vendors and governments rather than staying inside Anthropic's own logs. The report doesn't say which specific partners received which specific intelligence, so the actual reach of that sharing -- beyond Anthropic's own products -- isn't independently verifiable from the outside.

Working scientists, and a threshold Anthropic won't spell out

The report's most sensitive disclosure involves biological research. Anthropic says it identified five instances, between December 2025 and August 2026, where Claude was used in ways that could plausibly support biological-weapons development -- research touching chikungunya, highly pathogenic avian-influenza strains, viruses related to smallpox and mpox, and various venoms and toxins. Anthropic is explicit that this is not an accusation of intent: "the people involved were working scientists," the report says, and the company states directly that it is "not claiming they intended to cause harm."

"Research that could potentially contribute to developing a biological weapon could also be used to develop vaccines or treatments." -- Anthropic's September 2026 threat intelligence report

That's the dual-use problem stated as plainly as a company disclosing its own safety interventions is ever likely to state it: the same research that could help build a weapon is, in most cases, indistinguishable on its face from research that helps build a defense against one. Anthropic doesn't name the five research groups, the countries involved, or what specifically it did about each case beyond disrupting the account and citing the pattern as a reason to sharpen its own screening -- and neither this article nor any source it draws on identifies any individual by name in connection with this section of the report.

What Anthropic knows for sure, and what it's asking readers to take on its word

Every one of those four claims rests on Anthropic's own telemetry and Anthropic's own judgment about what it means -- which is exactly the limitation worth weighing before taking any of them as settled.

That's also the throughline connecting this report to the dispute the government advisory escalated two days earlier, and to the White House's own accusation in July that Moonshot had distilled Anthropic's Fable model to build Kimi K3 -- a claim independent researchers said was insufficient on its own to explain Kimi K3's real capability. Three separate documents, three different institutions, and one common feature: every one of them describes distillation as established while relying on evidence the accused party has never had to answer in public. Anthropic's report is the most technically specific of the three, but specificity is not the same thing as independent confirmation.

None of that makes the underlying pattern implausible. Chain-of-thought distillation is a real, well-understood technique -- extracting a larger model's reasoning to cheaply train a smaller one is standard practice across the industry, done openly by plenty of labs on their own outputs. What's contested here isn't whether distillation happens; it's whether these specific companies did it this way, at this scale, without authorization, against these specific safeguards -- and on that narrower question, Anthropic's report, the CISA advisory, and the White House's July claim all currently rest on the accuser's own account.

For the three named Chinese labs, the practical stakes are narrower than reputational damage: every fraudulent account Anthropic identifies gets suspended, cutting off that specific pipeline, whether or not the underlying accusation is ever independently confirmed. For Anthropic and its US rivals, the stakes run the other way -- a credible, well-documented case that frontier reasoning is being harvested at scale strengthens the argument for tighter API-level safeguards and, potentially, for the kind of export-control attention the White House has already started applying to one company. For everyone else watching, the pattern across four reports in eighteen months is the more durable finding: whether or not any single number here turns out to be exactly right, the rate at which frontier labs are trying to copy each other's reasoning, not just their outputs, keeps climbing every time Anthropic checks.