Anthropic Paid $1.5B for Pirated Data

Then Accused China of Doing the Same.

Anthropic accused three Chinese AI labs carried out large-scale distillation attacks on Claude, using roughly 24,000 fake accounts and generating about 16 million interactions.

They are not alone in raising concerns. That same month, other frontier labs reported similar activity. OpenAI sent a memo to the U.S. House Select Committee on China accusing DeepSeek of free-riding on U.S. frontier model capabilities. Google also published findings of a 100,000-prompt campaign aimed at extracting reasoning traces from Gemini.

Notably, all three reports were released within an 11-day window, from February 12 to February 23, 2026.

Here’s what’s behind these accusations, and the legal history that makes Anthropic appear less straightforward than its report suggests.

The Hydra Cluster

In Anthropics report, It calls out DeepSeek, Moonshot AI, and MiniMax running large-scale distillation operations against Claude.

According to the report, these labs used thousands of fake API accounts, organized into what Anthropic calls a “Hydra cluster”, distributed networks routed through proxy services. One such network allegedly managed over 20,000 accounts simultaneously. When accounts were banned, new ones replaced them, and distillation traffic was mixed with legitimate usage to avoid detection.

Each lab focused on extracting different capabilities.

What Each Lab Was Targeting

DeepSeek accounted for around 150,000 of the 16 million total exchanges, less than one percent, but its use cases were the most revealing.

First, reasoning extraction. Deepseek designed prompts that force Claude to explain its internal reasoning step by step. While Claude does not normally expose chain-of-thought, this effectively generated synthetic reasoning traces at scale, the kind of data used to train reasoning models like DeepSeek R1.

Second, rubric-based grading. DeepSeek fed its own outputs back into Claude and asked it to evaluate them against defined criteria. This turns Claude into a reward model, outsourcing reinforcement learning from human feedback to a competitor’s API.

Third, censorship-safe alignment. Deepseek used Claude to generate politically “safe” alternatives to sensitive topics, using an American model to shape how a Chinese model handles restricted content.

MiniMax on the other than drove an even bigger bulk of the activity, with over 13 million exchanges, focused on agentic coding, tool use, and orchestration. When Anthropic released a new Claude model mid-campaign, MiniMax reportedly redirected nearly half its traffic to the new version within 24 hours, suggesting a live, actively monitored operation.

Moonshot AI also ran 3.4 million exchanges targeting agentic reasoning, computer-use agents, and vision capabilities. Anthropic claims the traffic could be linked to specific researchers based on metadata.

In January 2026, Moonshot released Kimi K2.5, an open-source model that outperformed Claude 3.5 Sonnet on some coding benchmarks at 90 percent lower cost. If the allegations are accurate, that performance becomes easier to explain.

How Distillation Actually Works

Knowledge distillation was formalized in 2015 by Geoffrey Hinton and collaborators. The core idea is simple, train a smaller “student” model to match the probability distribution of a larger “teacher” model, capturing not just outputs but uncertainty across tokens.

That method requires access to model weights. These labs do not have Claude’s weights, only API outputs.

Instead, they use a weaker variant. The student system queries the teacher millions of times, collecting outputs, explanations, code, refusals, and judgments, then trains on those patterns. It is less efficient than weight-level distillation, but at sufficient scale, especially in focused domains like coding, it still transfers a large portion of capability.

Importantly, every major lab uses distillation internally. Models like Gemini Flash and Claude Haiku are distilled from larger models within their own organizations.

The controversy is not the technique itself, it is using a competitor’s closed model as the teacher.

Earlier Examples of API Distillation

This is not the first time this has happened.

In 2023, Stanford released Alpaca, a 7B model fine-tuned on 52,000 instruction examples generated from OpenAI’s API, costing about 600 dollars to train. It performed surprisingly close to ChatGPT on many tasks. Soon after, Vicuna and WizardLM followed with similar claims.

In 2025, DeepSeek released R1, claiming parity with OpenAI’s o1 at a fraction of the cost, around 5.6 million dollars, using older GPUs. The release triggered a 17 percent drop in Nvidia’s stock, wiping out roughly 589 billion dollars in market value in a single day.

Whether R1 relied heavily on distillation was widely debated and never conclusively resolved.

Meanwhile, the cost of reproducing frontier-level capability continues to fall, roughly 70 percent per year.

P.S. I’ve been posting videos every week for 6 years, and I’m going all in on AI engineering content. Subscribing is free and it helps a lot. Thank you for being part of the journey: https://m.youtube.com/c/WhatsAI?sub_confirmation=1

Anthropic’s Own Copyright History

So, is Anthropic the victim here?

Well, Anthropic’s position is complicated by its own legal history.

In September 2025, Anthropic settled a copyright lawsuit for 1.5 billion dollars, related to training on roughly 7 million pirated books.

Court documents revealed an internal operation called Project Panama. Anthropic purchased physical books, removed bindings, scanned them at scale, and destroyed the originals. The legal argument was that scanning purchased books qualifies as fair use. In June 2025, Judge William Alsup accepted this reasoning for legally acquired books. The settlement covered the pirated portion.

Five months later, Anthropic published its report accusing the three Chinese labs.

Critics were quick to respond. Elon Musk called the company “sanctimonious and hypocritical.” Additional legal exposure remains. In January 2026, Reuters reported claims from music publishers alleging infringement of over 20,000 songs, with potential damages exceeding 3 billion dollars. That case is ongoing.

Where This Leaves Builders

The legal foundation behind these accusations is weaker than it appears.

The U.S. Copyright Office requires human authorship for copyright protection, meaning AI-generated outputs are not easily protected. That shifts the argument from intellectual property to terms-of-service violations, a much narrower claim.

Labs understand this. Increasingly, they are moving value away from raw models and into products, workflows, and infrastructure layers.

Anthropic’s own Claude Code is a good example. The moat is not just the model, but the extensive wrapper engineering around it.

The bigger concern is safety. A distilled model can inherit capabilities, such as reasoning about chemical or biological systems, without inheriting the original model’s safety constraints. That gap is real, regardless of legal positioning.

The Bigger Question

Distillation has been happening openly since Alpaca demonstrated it for 600 dollars in 2023. Terms of service alone are unlikely to stop it.

If labs can replicate frontier capabilities at a fraction of the cost, that benefits users and builders. But distilled models tend to mirror their teachers rather than surpass them, so their ceiling is still bounded.

The real question is not whether cross-company distillation is happening. It clearly is.

The question is simpler, and harder:

Who actually owns intelligence trained on everyone’s data?

For the full walkthrough, the video is here. I would be interested to hear your view in the comments.