On 10 September, Anthropic published a threat intelligence report covering activity it says it disrupted between December 2025 and August 2026. Most of the press attention went to the espionage and influence-operation case studies. The passage that matters most for anyone reasoning about how safety properties travel between models sits near the end of the document, in a section on illicit distillation.
The robust safeguards that prevent Claude from being misused by bad actors do not transfer when our models are distilled by an unauthorized lab.
That sentence does a lot of work. What the report documents and what it asserts are two different things, and they carry very different evidentiary weight.
The mechanics the report describes
Distillation is ordinary practice. A large "teacher" model generates responses to a set of inputs, and those exchanges train a smaller "student" model to imitate it. Anthropic defines the illicit version as "an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization," typically carried out through networks of fraudulent accounts created with stolen credit cards, login credentials and API keys.
The report says that since a first disclosure in February, Anthropic has identified and disrupted distillation campaigns against Claude from seven China-based labs, attributed "with high confidence" to specific organisations. The case studies are granular. Accounts the report attributes to Alibaba injected a fixed prompt into every request that forced Claude to write its reasoning into inline text tags before answering. Those transcripts were converted into supervised fine-tuning data which, the report says, was used to distill Claude's capabilities into Qwen 3.5, 3.6 and 3.7. That campaign peaked at nearly three million exchanges a day from more than 3,500 fraudulent accounts, and the report's figure caption puts the May-to-July total above 150 million exchanges.
Two of the cases are stranger than scraping. The report says Moonshot AI silently forwarded customer requests to Claude instead of running them on its own Kimi models, displayed Claude's answers to users who believed they were using Kimi, and saved the exchanges for training. In one ten-day window it puts the volume at almost 300,000 relayed requests through 5,380 fraudulent accounts, most apparently located in Singapore and Japan. DeepSeek, the report says, did something similar, inspecting inbound requests for strings that identified users of coding harnesses such as Claude Code and OpenCode, then relaying those sessions to Claude Opus. A smaller campaign attributed to Zhipu ran 770,609 exchanges through a chain-of-thought extraction pipeline over ten days in June using 273 fraudulent accounts. MiniMax, the report says, built a proxy service through a shell company that sells access to Anthropic and OpenAI models and to no Chinese model, including MiniMax's own.
If accurate, the rerouting cases are the more serious finding, and not mainly because of the training data. Users who thought they were talking to a Chinese model were sending their prompts to an American one. The report describes relayed sessions containing live credentials and internal code, and in one instance, from a user it assesses was likely affiliated with the People's Liberation Army, surveillance footage drawn from hundreds of cameras in Chengdu.
The load-bearing claim has no public evidence
The volume figures are Anthropic's own telemetry, and they are at least the kind of thing a platform operator is well positioned to measure. The safeguards claim is a different sort of statement. The report puts it this way: "In our own research on distillation, we find that a model distilled from a frontier model can help achieve dangerous capabilities, including those in the biological or cyber domains, even when the harvested exchanges contain little about those subjects."
No methodology accompanies that finding. There is no benchmark, no comparison of refusal rates between teacher and student, and no description of what "dangerous capabilities" was operationalised as. The February disclosure made a weaker version of the same argument and also presented no experiment. None of this shows the claim is wrong, and the mechanism is plausible on its face, since refusal behaviour is trained into one specific model by processes a distiller cannot observe, while capability rides along in the outputs the distiller does have. A claim about the proliferation of biological and cyber capability is nonetheless the kind of claim that should arrive with numbers attached, and this one has not.
Anyone who has followed the argument that alignment does not come free with capability will recognise the shape of it. If the finding holds, it sharpens a point long made about the limits of preference-based training: whatever those methods buy is a property of a particular artefact rather than of the capability itself, and it stays behind when the capability is copied.
The defence against theft is opacity
The report closes with countermeasures, and one of them deserves more scrutiny than it has had. "Claude now summarizes its internal reasoning before responding, which makes stolen transcripts less useful for training another model." Anthropic also describes a feature shipped with Fable 5.1 that it calls preserved thinking, which stops new API accounts from altering the system prompt, tools or preceding messages in a multi-turn conversation, closing a route attackers used to make the model surface raw reasoning. That reasoning, the report says, is encrypted.
These are reasonable anti-theft measures. They also reduce how much model reasoning anyone outside the company can see, and the people outside the company include external safety researchers. Watching a model's chain of thought has been one of the few oversight techniques that works on systems nobody can interpret directly, and its value was already contested on the grounds that a stated reasoning trace need not reflect the computation that produced the answer. A summarised, encrypted trace is weaker still. The commercial case for hiding reasoning and the safety case for exposing it now point in opposite directions, and only one of them has a budget behind it.
That tension is not evidence of bad faith. It is an ordinary competitive dynamic landing on a safety-relevant variable. A lab that leaves reasoning traces visible subsidises its rivals. A lab that hides them becomes harder to audit from outside. Nothing in the present arrangement rewards the first choice.
What one party can see
Almost everything above comes from a single source with an interest in the outcome. Anthropic is a commercial competitor of every company it names. The enforcement actions it describes were taken unilaterally on its own platform. The attribution rests on telemetry nobody else can inspect, and the report gives no indication that the named companies were contacted before publication. Those companies had not responded publicly to the technical claims as of writing. Press accounts report that China's Ministry of Commerce called the allegations groundless, described distillation as common industry practice, and warned of countermeasures if they are used as a pretext against Chinese firms.
There is one partial external corroboration. On 8 September, two days before the report, the NSA, CISA and the FBI issued a joint cybersecurity advisory, AA26-251A, describing industrial-scale distillation of US frontier models by China-based AI companies, naming an overlapping but not identical set of firms. The agencies and the lab are not independent in the sense that matters here, since both sit inside the same policy coalition, and the advisory's own evidentiary basis is not public either. Corroboration is not verification.
The detail that complicates the framing
One line in the report cuts against reading it as a story about frontier capability being stolen. The campaigns targeted Anthropic's generally available models, and the report states that it has "not observed attempts against Mythos 5 or Mythos Preview, which are not accessible to the general public."
Theft followed availability rather than capability. That is a useful fact for anyone modelling how capability spreads, because it suggests the binding constraint on this route is API access rather than model strength, which in turn suggests the channel can be narrowed by access policy in ways that hardware controls cannot manage. It also means the lab's most capable systems were never in the sample, so nothing here establishes whether the safeguards claim holds at the frontier.
If that claim is right, it changes what a safety case can promise. A frontier developer can currently argue that a model is safe to deploy because of the refusal training, classifiers and monitoring wrapped around it. That argument is about a deployment. Where the capability can be copied out from behind the wrapper at industrial scale, the safety case covers the original and nothing downstream of it, and the copy arrives in the world carrying the capability without the constraint. Testing whether that is true is not an academic exercise, which is why the absence of published evidence is the most consequential gap in a 154-page document.