China extracted 190 million Claude queries. US export controls missed it entirely.

Anthropic’s September 10 threat report documents roughly 190 million unauthorized Claude exchanges by seven Chinese AI labs between May and July 2026, a twelve‑fold increase from February. The labs—including Alibaba, Moonshot AI, and DeepSeek—used fraudulent accounts, stolen credentials, and proxy networks to extract frontier model capabilities at industrial scale.

The campaigns sidestepped US hardware export controls entirely, operating at the software layer. The disclosure lands two weeks before Xi Jinping’s Washington visit, with sanctions legislation still pending.

The US strategy for containing China’s AI ambitions was built around denying advanced chips. It turns out the capabilities can be extracted without a single GPU crossing a border. Anthropic’s 154‑page misuse report, released September 10, documents what the company attributes to seven Chinese labs that ran nearly 190 million unauthorized queries against its Claude models from May through July 2026—using nothing more than fake accounts, proxy relays, and stolen API keys.

The campaigns exploited a blind spot in Washington’s export‑control architecture. Hardware restrictions cannot stop software‑layer distillation, and the policy machinery has yet to catch up. The White House designated adversarial distillation a national‑security threat in April, but imposed no new sanctions. The Commerce Department restricted access to Anthropic’s most advanced models in June, but the labs targeted generally available versions instead. The main legislative remedy, the Deterring American AI Model Theft Act, remains stalled in the House. The report arrives two weeks before President Xi Jinping’s scheduled Washington visit, compressing technical disclosure, diplomatic pressure, and legislative debate into a single month. The numbers are now bargaining material.

The software hole in a hardware wall

The campaigns operated entirely at the application layer. Operators created thousands of fraudulent accounts using stolen credit cards and compromised API keys, then routed prompts through commercial VPN nodes and residential IP relays to evade Anthropic’s regional blocks. The goal was not to steal model weights but to capture chain‑of‑thought reasoning traces—the intermediate steps a model takes before delivering an answer—and use them as training data for domestic models.

According to Anthropic’s report, Alibaba‘s Qwen division accounted for more than 151 million exchanges, peaking at nearly three million interactions in a single day. Anthropic documented that Moonshot AI and DeepSeek together accounted for another 35 million exchanges, often by relaying their own customers’ prompts through Claude without those customers’ knowledge or consent. Zhipu, already on the US Entity List, employed a refined technique that involved replaying Claude’s reasoning traces back through Claude to improve the captured data quality, according to Anthropic’s findings.

The sequence below shows how the extraction pipeline turns API queries into training data.

The joint advisory from the NSA, CISA, and FBI on September 8 named six of the same labs and described the activity as “aggressive, malicious, targeted distillation activities at an industrial scale.”The advisory recommended detecting anomalous prompts, subtly altering responses to reduce their payoff, and establishing cross‑organization intelligence sharing. Anthropic says it has disrupted all documented campaigns and added defenses including organization‑level account bans and reduced detail in chain‑of‑thought outputs.

A policy architecture built for chips, not code

The mismatch is structural. US export controls were designed to deny physical semiconductors. Distillation attacks transfer capability through inference traffic—logs, reasoning traces, and API outputs—without moving hardware. The White House memo acknowledged the threat but offered no enforcement. The Commerce Department’s June order covered only two advanced models that the campaigns largely avoided. The result is a policy framework that treats the symptom while leaving the vector open.

Chinese labs operate under a different legal architecture. Anthropic argues that China’s National Intelligence Law Article 7 obliges organizations to support intelligence work, meaning any data that reaches a Chinese company can be demanded by the state. In the US, privacy and security for routed AI traffic rely on sectoral laws and platform terms, leaving a gap around cross‑border distillation and data exposure.

The competitive landscape is shifting. While OpenAI’s ChatGPT still holds a large share of global AI assistant usage, Chinese models from Alibaba, DeepSeek, and Moonshot are rapidly building user bases in Asia. Distillation compresses development timelines, turning US investment into a subsidy for competitors. The closest Western analogue—supervised distillation under license—operates with consent and control. These campaigns removed both.

The next test is whether Washington can close the software gap before the next generation of models makes the question academic. With DAAMTA still pending and Xi’s visit imminent, the window for action is measured in weeks, not quarters.

Beyond the headline

The Bigger Picture

These campaigns expose a deeper structural tension: Washington’s AI strategy is still built around controlling physical compute, while competitive advantage in frontier systems increasingly flows through software and data supply chains. Distillation turns inference traffic—logs, reasoning traces, and API outputs—into the real strategic asset. As long as policy focuses primarily on chips, labs that can cheaply harvest US model behavior will keep narrowing capability gaps without ever importing a single GPU.

What Isn’t Being Said

Much of the official narrative treats distillation as a security and IP problem, but it largely sidesteps the question of user trust in AI intermediaries. Security analysts and Anthropic have flagged as particularly concerning the fact that some labs relayed unsuspecting customers’ prompts through foreign models without disclosure. The omission matters: without clear rules on disclosure and routing, Western enterprises may keep feeding sensitive workflows into opaque chains they cannot audit.

The Timing

The threat report arrives just after US agencies publicly accuse China‑based labs and just before Xi Jinping’s Washington visit, compressing technical disclosure, diplomatic pressure, and legislative debate into the same month. That sequencing turns Anthropic’s numbers into bargaining material: lawmakers can point to them to justify sanctions and new controls, while Beijing frames them as politicized. The window before new rules take hold is precisely when distillers have strongest incentives to accelerate extraction.

What the distillation campaigns mean for Western enterprises, investors, and developers

With the report exposing a policy gap and Xi Jinping’s Washington visit days away, Western organizations face immediate decisions.

• Western Enterprise AI User with Chinese Vendor Exposure

  You must audit all AI router services and third‑party intermediaries used by your organization. Verify their data routing practices, request written confirmation of which models and jurisdictions receive your prompts, and secure or rotate any potentially compromised API keys. Review logs for traffic to unauthorized endpoints during the May–July 2026 window.

• US Policy Analyst on AI Export Controls

  Re‑evaluate the current hardware‑focused framework. The report demonstrates that software‑layer distillation bypasses chip controls, so consider supporting legislative approaches like DAAMTA or new regulatory tools that address capability transfer through inference traffic. Monitor Commerce and Treasury announcements for potential Entity List or sanctions additions.

• US Investor with AI Sector Holdings

  Assess the potential for new US sanctions or export controls on the named Chinese AI entities. The industrial‑scale IP theft detailed in the report could erode the competitive moat of US frontier developers, while introducing regulatory risk for Chinese AI companies in your portfolio. Watch for legislative movement on DAAMTA and any Treasury designations.

• Western AI Model Developer or Provider

  Implement enhanced security protocols immediately: robust identity verification for high‑risk regions, anomalous prompt detection, and targeted response alterations that reduce the payoff of distillation attempts. Share threat intelligence with peers and government agencies, as the advisory recommends, and treat API keys like database credentials.

FAQ

Explainer

Illicit distillation

Unauthorized extraction of a frontier model’s capabilities by sending massive volumes of queries through fraudulent accounts and capturing the outputs. Chinese labs used the method to train student models without bearing the original training costs. Anthropic’s September 2026 report is the first to quantify the practice at industrial scale, documenting roughly 190 million unauthorized exchanges.

Chain‑of‑thought

Intermediate reasoning steps a model generates before producing a final answer. When captured as training data, these traces transfer problem‑solving patterns without requiring access to the model’s weights or underlying hardware. Zhipu refined the technique by replaying Claude’s own reasoning traces back through Claude to improve the captured data quality.

Entity List

A US Commerce Department list of foreign parties subject to export restrictions because of national‑security concerns. Zhipu (Z.ai) was added in January 2025 for advancing Chinese military modernization through AI. Being on the list did not prevent the lab from running millions of unauthorized Claude queries.

DAAMTA

The Deterring American AI Model Theft Act, a bill that would require the Commerce Department to identify and sanction entities using improper query‑and‑copy techniques. The House Foreign Affairs Committee advanced it unanimously on April 22, 2026, but it awaits a full House vote. Policy analysts warn its broad definition of model extraction could sweep in legitimate research.

NSTM‑4

National Security Technology Memorandum‑4, issued by the White House Office of Science and Technology Policy on April 23, 2026. It designates adversarial distillation of US AI models a national‑security threat and directs intelligence sharing, but includes no new sanctions or access bans. The memo preceded the peak of the documented campaigns.

National Intelligence Law Article 7

A provision of China’s 2017 National Intelligence Law that obliges all organizations and citizens to support, assist, and cooperate with national intelligence work. Anthropic argues this means any data that reaches a Chinese AI lab can be demanded by the state, raising privacy and national‑security stakes for Western users whose prompts were relayed.