On 23 February 2026, Anthropic published a report that should concern every organisation deploying or depending on AI systems. Three Chinese AI laboratories — DeepSeek, Moonshot AI, and MiniMax — allegedly created over 24,000 fraudulent accounts and submitted more than 16 million queries to Anthropic's Claude model in what amounts to industrial-scale intellectual property theft through a technique called model distillation.

This is not an abstract geopolitical concern. It is a concrete demonstration of how AI models have become high-value targets, and why AI security governance is no longer optional for any organisation building on or consuming AI services.

What Happened: The Anatomy of a Distillation Attack

Model distillation is a technique where an attacker systematically queries a target AI model, collects its outputs, and uses those responses to train a cheaper, smaller model that replicates the original's capabilities. Think of it as reverse engineering through conversation — except at industrial scale.

The three companies employed distinct but coordinated approaches:

DeepSeek: Stealing the Reasoning

DeepSeek conducted over 150,000 exchanges specifically targeting Claude's reasoning capabilities. Their technique was sophisticated: prompts asked Claude to "imagine the internal reasoning behind a completed answer and write it out step by step" — effectively generating chain-of-thought training data at scale. They also extracted responses to politically sensitive queries about dissidents and authoritarianism, likely to train their own models to handle censorship.

MiniMax: The Largest Campaign

MiniMax executed the most aggressive operation with over 13 million queries focused on agentic coding and tool orchestration capabilities. Perhaps most telling: they pivoted within 24 hours of new Claude version releases, suggesting a dedicated team monitoring Anthropic's deployments and rapidly adapting their extraction strategy to target new capabilities.

Moonshot AI: Broad Capability Extraction

Moonshot AI distributed 3.4 million queries across hundreds of fraudulent accounts, targeting agentic reasoning, tool use, coding, and computer vision. The breadth of their campaign suggests an attempt to replicate Claude's full capability set rather than specific features.

The Hydra Architecture: How They Evaded Detection

The attackers employed what Anthropic calls a "Hydra cluster" architecture — a sprawling network managing over 20,000 fraudulent accounts simultaneously with no single point of failure. The infrastructure mixed distillation traffic with unrelated customer requests to complicate detection, using proxy services to obscure origins and evade geographic access restrictions.

Anthropic eventually detected the campaigns through a combination of behavioural classifiers, IP correlation, and traffic pattern analysis. As they noted: "The volume, structure, and focus of the prompts were distinct from normal usage patterns, reflecting deliberate capability extraction rather than legitimate use."

Why This Matters Beyond Anthropic

The immediate reaction might be to file this under "big tech geopolitics" and move on. That would be a mistake. Here is why this matters for your organisation:

1. AI Models Are Now Critical Assets

If state-affiliated laboratories are willing to deploy 24,000 fake accounts to steal model capabilities, the models clearly have enormous strategic value. Any organisation that has fine-tuned a model on proprietary data, built custom AI workflows, or invested in prompt engineering has created intellectual property that is similarly vulnerable to extraction.

2. Distilled Models Strip Safety Guardrails

Anthropic warned that "illicitly distilled models lack necessary safeguards, creating significant national security risks." When capabilities are extracted without the safety layer, the resulting models can be used for offensive cyber operations, disinformation campaigns, and surveillance without the ethical constraints that responsible AI providers implement. This is not theoretical — it is the explicit concern of security researchers.

3. API Security Extends to AI Endpoints

Traditional API security focuses on authentication, rate limiting, and data protection. AI model APIs require an additional layer: detecting systematic capability extraction. If your organisation exposes AI models via API — even internal ones — you need to consider whether your usage monitoring can distinguish legitimate queries from distillation attempts.

4. The Export Control Debate Has Real Consequences

Anthropic specifically noted that rapid Chinese AI progress is "mistakenly cited as evidence that export controls are ineffective" when those capabilities actually "depend significantly on capabilities extracted from American models." For organisations operating across jurisdictions, AI export controls and compliance obligations are becoming as complex as traditional arms export regulations.

The Hypocrisy Question

A fair objection: didn't these same AI companies train on publicly available data, much of it copyrighted? Yes. And that legal and ethical question remains unresolved. But there is a meaningful distinction between:

• Training on publicly available data — legally ambiguous, subject to ongoing litigation, but does not involve identity fraud or terms of service violations
• Distillation through coordinated fraud — 24,000 fake accounts, deliberate evasion of geographic restrictions, systematic extraction designed to circumvent security controls

One can acknowledge the legitimate debate about training data while recognising that industrialised fraud against a live system is qualitatively different. The means matter, not just the ends.

What Organisations Should Do Now

Whether you are consuming AI services, building on AI platforms, or developing your own models, this incident highlights governance gaps that need addressing:

For AI Consumers

• Evaluate your AI provider's security posture. How do they detect and prevent model distillation? What happened to your data if their model was compromised?
• Review your terms of service exposure. If your proprietary data trained a model that was subsequently distilled, what are the contractual and regulatory implications?
• Assess supply chain risk. Are any of your AI tools or services built on models of uncertain provenance?

For AI Builders

• Implement behavioural analytics on API usage. Move beyond rate limiting to pattern detection that can identify systematic extraction.
• Deploy output watermarking where feasible, making it detectable when your model's outputs have been used for training.
• Consider differential privacy techniques that limit what can be learned from individual queries while maintaining model utility.

For All Organisations

• Include AI model security in your risk register. Treat AI capabilities as intellectual property assets with corresponding protection requirements.
• Update your AI governance framework to address model provenance, supply chain integrity, and distillation risk.
• Train your security team on AI-specific threats. Traditional cybersecurity frameworks do not adequately cover model-level attacks.

The Bigger Picture

This incident is a preview of a new category of cyber threat. As AI models become more capable and more central to business operations, they become more valuable targets. The methods will evolve — from API-based distillation to side-channel attacks, model inversion, and adversarial extraction techniques that we have not yet imagined.

The organisations that take AI security governance seriously now — who treat their AI assets with the same rigour they apply to their network infrastructure and data protection — will be the ones still standing when the next wave arrives.

The 24,000 fake accounts were just the beginning.