Distillation and model custody

In 2026 Anthropic reported detecting large-scale distillation attacks: it stated that actors linked to DeepSeek, Moonshot and MiniMax used roughly 24,000 fraudulent accounts to generate more than 16 million Claude interactions aimed at extracting model capabilities.

What the disclosure is, and is not

It is a company’s account of its own investigation: detailed, but not a court finding. Anthropic itself distinguished illegitimate extraction from ordinary, legitimate model distillation. It must not be generalized into a claim about all Chinese models, and this site does not make that claim.

Source: Anthropic: Detecting and preventing distillation attacks ·  reported here as that company's account, per the sourcing rules.

Capabilities have a supply chain too

The disclosure makes one custody point unavoidable: a model’s capabilities have a supply chain of their own. Who currently publishes a model, who trained its base, whose outputs shaped its behavior, and whose infrastructure serves it are four different custody questions with four different answers.

A supplier questionnaire that asks only “which model do you use?” collects a brand name, not a provenance record.