Anthropic’s Distillation Allegations and the Debate Over AI Training Data

Anthropic has named DeepSeek, Moonshot AI and MiniMax in an allegation that they extracted data from Claude through what it calls industrial-scale distillation attacks. These labs have produced widely discussed open-weight models, but the story is more complicated than a single accusation: the response online also challenged Anthropic’s own training practices.

In its February 23, 2026 announcement, Anthropic said the three labs created more than 24,000 fraudulent accounts and generated over 16 million exchanges with Claude to extract capabilities for their own models. That is Anthropic’s account and attribution; the public announcement is not a court finding that the labs used the resulting data as alleged.

Distillation is a common technique: a smaller model is trained using outputs from a stronger model. It can trade some quality for speed and lower cost, making models useful in settings such as local deployment or faster versions of frontier services. Distillation itself is not inherently improper; the dispute concerns how the other model was accessed and used.

Anthropic argues that a lab can use another model’s answers to obtain capabilities more quickly and cheaply, and warns that a model trained on those outputs might not preserve the original safeguards. It raises possible military, intelligence, surveillance, biological and cyber risks. Those are the company’s stated concerns, not evidence that these specific uses occurred.

My interpretation is that instead of independently collecting and preparing all the data needed for a training run, a competitor might obtain high-quality question-and-answer material from an existing model. Anthropic also argues that distillation can weaken the effect of US chip export controls; I think its concern is that models can gain capabilities through another route even when access to hardware is restricted.

Anthropic says the activity used fraudulent accounts and proxy services and differed from ordinary usage. The company says it attributed campaigns with high confidence using IP correlations, request metadata, infrastructure indicators and, in some cases, information from industry partners. These are the indicators Anthropic reports; outsiders cannot independently inspect the underlying evidence from the announcement alone.

For DeepSeek, Anthropic reported more than 150,000 exchanges, a number I initially find surprisingly small. The company says requests targeted reasoning, rubric-based grading that could act as a reward signal, and alternatives to politically sensitive questions. It also described synchronized account traffic and shared payment methods as signs of coordinated load balancing.

Anthropic highlights prompts asking Claude to imagine and articulate step-by-step reasoning behind a completed answer. Such responses could supply synthetic reasoning-style training material, although a model’s imagined explanation is not proof that it reveals its actual hidden internal reasoning. Anthropic infers a training purpose from its observations; the public description does not independently establish the downstream training or its effect.

Anthropic says the Moonshot campaign involved more than 3.4 million exchanges and targeted agentic reasoning, tool use, coding, data analysis, computer use and vision. It describes hundreds of accounts across access pathways and says request metadata matched public profiles of senior Moonshot staff. I wonder whether distillation could help explain strong tool use in some models, but that connection is my speculation, not a measured causal result.

For MiniMax, Anthropic reported more than 13 million exchanges focused on agentic coding, tool use and orchestration. It says that it observed the activity while the campaign was underway and saw requests shift toward a newer Claude model. The company says its response includes better detection, intelligence sharing, access controls and other countermeasures.

The online reaction turned to Anthropic’s own training data. A proposed community note accused it of using stolen material, and people pointed to litigation over books and songs. The cases need careful separation: in 2025, a federal judge found the use of books to train models at issue was fair use while holding that Anthropic’s retention of a central library of pirated books was not. A $1.5 billion books settlement was proposed; a separate music-publisher lawsuit sought damages and was an allegation, not a $3 billion settlement.

Elon Musk also criticized Anthropic and was challenged over the training practices of his own company, xAI. I see a broader argument about whether AI companies have relied on copyrighted material without permission. My sweeping claim that every frontier lab uses stolen data is an opinion, however, and copyright status, licensing, piracy and legal liability cannot all be inferred from that generalization.

I point to research in which an earlier Claude model was prompted to reproduce much of the Harry Potter text, and treat this as evidence in the training-data debate. Reproduction of text can raise serious questions about memorization, but it does not by itself establish the exact training corpus or resolve the legal status of its sources.

Developer Theo challenged Anthropic’s report, arguing that DeepSeek’s reported 150,000 exchanges could be consistent with ordinary benchmarking; he compared the volume with daily usage of his own T3 Chat service. He accused Anthropic of lying and invited the company to share more information privately if he had missed something. His accusation is a claim, not proof of deliberate deception, and raw volume alone cannot establish either benchmarking or distillation.

I note that Theo does not have the underlying requests and argue that detailed requests for reasoning may be hard to explain as ordinary benchmarking. Even so, the public evidence available in the video does not establish the precise purpose of each request. The dispute concerns both the observed patterns and what conclusions can reasonably be drawn from them.

I say the allegation would not surprise me and offer a broad characterization of business competition in China, while acknowledging that American companies have also faced accusations involving intellectual property. Those national and cultural generalizations are my opinion and cannot establish what any particular company did.

I then discuss a post citing a senior US government official who alleged that DeepSeek obtained restricted Nvidia Blackwell chips, used them to train a future model and intended to conceal evidence. This is a separate, attributed allegation; neither the post nor this video establishes that a violation occurred or proves the claimed plans.

I speculate that the allegations might mean American labs have a larger lead than I thought and suggest Chinese open-weight firms depend heavily on American models and hardware. That inference goes beyond the evidence presented: the company’s allegations and the chip claim do not establish that Chinese labs lack their own research or determine the overall balance of AI capability.

The remaining question is how to judge an AI company’s objections to another lab’s use of its outputs while that company faces criticism over the material used to train its own model. I think people are reacting to what they perceive as hypocrisy. The factual and legal questions in the two situations are distinct, even when both deserve scrutiny.