Anthropic has publicly alleged that Chinese artificial intelligence companies have been covertly accessing its Claude models, using them to train competing systems in violation of its terms of service. The claim, which surfaced in a recent Anthropic document and was picked up by the South China Morning Post, raises pointed questions about enforcement, evidence, and the broader dynamics of the US-China AI competition.
What Anthropic Is Alleging
The core accusation is that firms based in China have been routing queries through third-party services or using other means to access Claude without authorization, then leveraging those outputs to improve their own models. This practice, known as model distillation or knowledge distillation, involves using a powerful model's responses as training data. Anthropic has detailed these distillation attacks by Chinese AI firms, naming entities connected to Alibaba, Moonshot AI, and DeepSeek in its findings. The company says the pattern of usage is systematic enough to be deliberate rather than incidental.
Key Facts
- Anthropic alleges Chinese firms accessed Claude without authorization to train rival models.
- The technique in question is model distillation, using one AI's outputs as training data for another.
- Named firms reportedly include those linked to Alibaba, DeepSeek, and Moonshot AI.
- Anthropic's terms of service explicitly prohibit using Claude outputs to train competing models.
- Verifying the origin of API queries is technically difficult, complicating any enforcement effort.
Proving the allegation is another matter. AI companies can detect unusual query patterns and flag accounts that appear to be harvesting responses at scale, but definitively attributing that activity to a specific Chinese firm, especially one operating through intermediaries, is genuinely hard. Anthropic has not released its full evidence publicly, which has led some observers to treat the claims with measured skepticism. That said, similar accusations have circulated in AI circles for months, and Chinese regulators have themselves opened probes into DeepSeek and Moonshot AI over Claude routing claims, suggesting the concern is not entirely without foundation.
The integrity of our systems depends on all users operating within our policies. We take violations seriously and are investing in technical and legal measures to address them.Anthropic spokesperson
Why This Matters Beyond the Headlines
The accusations sit at the intersection of commercial IP disputes and geopolitical tension. If Chinese AI labs can effectively shortcut years of training compute by distilling from frontier Western models, it changes the calculus around export controls and API access policies. Alibaba's latest models have already claimed benchmark parity with Claude, a development that takes on a different color if those benchmarks were achieved partly through unauthorized use of Claude's outputs.
For Anthropic, the stakes are both reputational and commercial. The company positions safety and responsible deployment as central to its identity. Discovering that its models may be fueling the development of less safety-focused competitors abroad creates an uncomfortable irony. It also creates pressure to tighten API access, which could frustrate legitimate researchers and smaller developers who rely on open access to Claude's capabilities.
The South China Morning Post's investigation found that the named Chinese companies have either denied the allegations or declined to comment. Independent verification of Anthropic's claims remains elusive. Security researchers note that without access to Anthropic's internal telemetry, it is difficult to assess how solid the evidence actually is.
What is clear is that model distillation as a competitive tactic is real, documented, and increasingly common across the industry. Whether this particular instance rises to the level Anthropic describes, the broader pattern is one the entire AI sector will need to grapple with. Access policies, technical countermeasures, and potentially legal action are all on the table. How Anthropic responds in the coming months will say a great deal about how the company balances openness with protection of its core assets.
