Model distillation is normally an engineering technique: train a smaller system using outputs from a stronger one, reducing cost while preserving useful capability. Anthropic says competitors have turned the same idea into coordinated extraction against Claude at industrial scale.
The company describes three campaigns that generated more than 16 million exchanges through approximately 24,000 deceptive accounts. The alleged operators targeted agentic reasoning, tool use, coding, vision, analysis, and grading behaviour.
This is not conventional theft of model weights. The attackers use the product repeatedly, transforming paid or fraudulently obtained outputs into training material for another model. That makes the API itself both the customer interface and the extraction surface.
Distributed Accounts Hide a Coordinated Objective
Anthropic says proxy networks used “hydra cluster” architectures spread across APIs and third-party cloud services. One network reportedly managed more than 20,000 fraudulent accounts. When one account was removed, another replaced it.
Individual prompts could appear legitimate. The attack becomes visible in aggregate: repeated structures, enormous volume, narrow concentration on a capability, shared payment patterns, synchronised timing, and requests that map closely to a competitor’s development needs.
One campaign produced more than 13 million exchanges focused on agentic coding and tool orchestration. When Anthropic released a new model, the traffic reportedly pivoted within 24 hours, directing nearly half of the operation towards the updated system.
Another generated over 3.4 million requests involving vision, data analysis, and reasoning. A third used more than 150,000 interactions to collect step-by-step reasoning and rubric-based grading material.
The pattern resembles fraud detection more than simple rate limiting. No single request proves abuse; coordinated behaviour across identities and infrastructure reveals the objective.
Distillation Changes Model Economics and Safety
Legitimate distillation can make capable applications smaller and cheaper. Illicit extraction lets a competitor obtain specialised training data without bearing the full cost of independent model development.
Anthropic frames the campaigns as intellectual-property and national-security threats. It blocks commercial access in China, while proxy services can bypass regional restrictions. The company argues that distilled systems may reproduce capability without the safety controls built into the original service.
That claim needs careful attribution: these are Anthropic’s findings and interpretation, not an independent judgment about every competing model. The evidence described nevertheless illustrates a real control problem. Output safeguards do not automatically travel with capability learned from those outputs.
If an extracted model is released openly, both useful and harmful capabilities can spread beyond the original operator. Advanced chips remain relevant because large-scale querying and retraining still require substantial compute.
Defence Requires Cross-Account Visibility
Anthropic recommends behavioural fingerprints and traffic classifiers that identify extraction patterns across accounts. Providers also need stronger verification for programmes commonly targeted by abuse, including educational, startup, and security-research access.
Product and API safeguards can make outputs less useful for illicit training, but aggressive restrictions may degrade legitimate customer work. Detection must balance protection with a usable service.
Teams should monitor repeated attempts to elicit hidden reasoning, highly templated prompts, unusual account creation, coordinated payment methods, infrastructure overlap, and abrupt interest in a newly released capability. Intelligence sharing among model laboratories, cloud providers, payment services, and policymakers can reveal networks that no organisation sees alone.
Regular red-team exercises can also test whether detection survives changes in account identity, prompt wording, proxy provider, and request pacing.
The report shows that frontier-model security extends beyond protecting code, weights, and data centres. Providers must also defend the capability expressed through millions of ordinary-looking answers.
Industrial distillation exploits scale and fragmentation: each request seems small, while the combined dataset becomes valuable. The strongest defence is therefore the reverse—connect identity, payment, traffic, timing, and behaviour until the coordinated campaign becomes visible.
