Anthropic Details Large-Scale Claude Distillation Campaigns
Anthropic identifies seven China-based labs in Claude extraction activity
Anthropic said it identified and disrupted illicit, industrial-scale attempts to distill the capabilities of its Claude models by seven China-based AI labs. The company named Alibaba, Moonshot AI, DeepSeek, Z.ai, also known as Zhipu, MiniMax, Xiaomi and SenseTime. It said the activity involved proxy networks, fraudulent accounts and, in some cases, the collection of user interactions for training purposes.
The largest campaign, tracked as GTG-16005 and attributed to a cluster of Alibaba-affiliated operators, produced 151 million observed exchanges from May through July 2026. Anthropic described it as the largest distillation attack it has measured. The operation peaked at roughly 3 million exchanges per day, used more than 3,500 fraudulent accounts, and targeted chain-of-thought reasoning transcripts from Claude Opus 4.6 and 4.7.
Anthropic said the Alibaba-linked activity focused on agentic tasks, software engineering, kernel development and long-horizon tasks. Knowledge distillation is a legitimate machine-learning method in which a larger model teaches a smaller or faster model. Anthropic distinguished that practice from unauthorized extraction intended to replicate a model’s capabilities without permission.
Proxy networks and rerouted requests created collection paths
Anthropic said unauthorized operators commonly routed requests through proxy, transfer or relay services. These networks can create thousands of accounts using fictitious identities, fake or stolen payment cards, and illegally obtained API keys belonging to companies or individuals. The company also said some resellers retain conversations without users’ knowledge or consent and sell the transcripts to other labs.
GTG-16002 involved 23 million exchanges between May and July 2026. Anthropic said Moonshot AI covertly relayed customer requests to Claude instead of processing them through Kimi, returned Claude responses to customers, and retained part of the activity to train a chain-of-thought model. Over 10 days, the company said, nearly 300,000 requests were sent through a proxy network using 5,380 fraudulent accounts, most located in Singapore and Japan.
Anthropic attributed more than 12.1 million exchanges over 14 days in July to DeepSeek, which it said used a similar request-relaying approach. It said Zhipu operated a chain-of-thought extraction pipeline involving more than 3.4 million exchanges over 17 days and 273 fraudulent accounts. Xiaomi was linked to more than 400,000 exchanges involving MiMo conversations and coding sessions sent through OpenClaw and OpenCode harnesses.
Anthropic changes access controls and reasoning protections
The company said SenseTime bought Claude user-exchange transcripts from third-party data vendors. MiniMax allegedly built a proxy service through a shell company offering access to Anthropic and OpenAI models, potentially creating a channel to gather interactions with U.S. frontier models.
Anthropic said it bans reseller accounts and accounts operating in unsupported regions, including China, Iran and Russia, when identity verification fails. It has also changed Claude to summarize internal reasoning before answering, a measure intended to make captured transcripts less useful for subsequent training. The company added that Fable 5.1 introduced preserved thinking, which prevents new API accounts from altering the system prompt, tools or messages before Claude’s reasoning in multi-turn conversations.
For businesses using frontier-model APIs, the disclosure makes identity verification, API-key protection and monitoring for unusual relay patterns operational priorities. Organizations should also assess whether third-party services can retain, redirect or resell their AI conversations before sending sensitive customer, corporate or research data through them.
GTG-16002 and GTG-16005: what the campaign IDs mean
GTG-16002 and GTG-16005 identify separate campaigns in Anthropic’s account. Distinguishing them helps readers connect each reported scale, method and operator to the correct case.
A quick guide to the two identifiers
According to the details summarized above, GTG-16002 concerned the alleged relaying of customer requests to Claude and retention of some activity for model training. GTG-16005 referred to the larger campaign attributed to Alibaba-affiliated operators and focused on extracting reasoning across technical and agentic tasks.
- GTG-16002 was associated with 23 million observed exchanges from May through July 2026.
- GTG-16005 was associated with 151 million observed exchanges over the same period.
- The two labels refer to different reported operators, methods and collection volumes.
Why searches use different spellings
The identifiers may appear without punctuation as GTG16002 and GTG16005, or with spaces as GTG 16002 and GTG 16005. These are spelling variants of the hyphenated campaign labels, not additional campaigns described on this page.
- GTG16002 and GTG 16002 refer to GTG-16002 in this context.
- GTG16005 and GTG 16005 refer to GTG-16005 in this context.
- Using the hyphenated form makes the campaign references easier to distinguish.
Operational questions for businesses using AI APIs
The reported activity highlights the need to understand every service between an organisation and its model provider. Before sensitive information enters an AI workflow, teams can review how access is authenticated, where requests are routed and whether an intermediary may retain conversations.
- Confirm whether the service connects directly to the stated model provider.
- Restrict API keys by environment, purpose and authorised user where supported.
- Monitor unexpected request volumes, locations and relay patterns.
- Review conversation-retention terms before sharing customer or corporate data.
- Prepare a process for rotating credentials and investigating unusual activity.
Frequently asked questions
What is GTG-16002?
GTG-16002 is Anthropic’s identifier for a reported campaign involving 23 million observed exchanges from May through July 2026. The page describes alleged request relaying and retention of part of the activity for training.
What is GTG-16005?
GTG-16005 is the identifier for the larger reported campaign attributed to Alibaba-affiliated operators. Anthropic associated it with 151 million observed exchanges from May through July 2026.
Are GTG16002 and GTG-16002 different campaigns?
No. On this page, GTG16002 and GTG 16002 are search and formatting variants of GTG-16002. The same applies to GTG16005, GTG 16005 and GTG-16005.
What should a business check when using an AI intermediary?
Check who processes each request, whether traffic can be rerouted, how conversations are retained, how API keys are protected and whether unusual usage can be detected.