Anthropic’s head of threat intelligence, Jacob Klein, stated that while his company embraces healthy competition, the output originating from the Chinese market increasingly resembles outright theft.
According to Klein, foreign adversaries are exploiting Anthropic’s Claude models through a process known as distillation. This allows them to train competing technologies and subsequently market imitation versions at a significantly lower cost. While distillation can be a legitimate business practice, Klein asserts that the current methodology employed by these actors is far from legal.
“There’s an entire illicit ecosystem to try to gain access to Claude and other models,” Klein told CNBC. “This ecosystem goes through any means necessary to evade our controls, so they can spin up accounts at extreme scale.”
The practice of AI model distillation has become a contentious issue across the artificial intelligence landscape. Depending on the implementation, distillation can enable a model developer to leverage the output from another company’s proprietary technology to create a competitive offering at a fraction of the development cost. In the United States, segments of the tech industry have urged policymakers to avoid heavy-handed regulations, advocating for a merit-based environment where superior and cost-effective AI solutions naturally prevail. Conversely, other stakeholders are actively campaigning for stricter measures against what they perceive as blatant intellectual property theft.
In an April memo, the Trump administration unequivocally labeled distillation that compromises American research and proprietary information as “unacceptable,” signaling an intent to explore a spectrum of measures to hold accountable those foreign actors responsible.
This escalating threat emerges at a critical juncture for Anthropic. The five-year-old company has achieved a formidable private market valuation approaching $1 trillion and is widely anticipated to pursue an initial public offering as early as October, as previously reported.
Anthropic has specifically identified Moonshot AI, a Chinese AI laboratory, as one of the entities allegedly misappropriating its technology. Moonshot’s Kimi K3 model garnered significant attention in July with its cost-effective, frontier-level AI offering. Its widespread adoption in Silicon Valley has been partly attributed to its competitive pricing and enhanced adaptability for enterprise customization.
Klein contends that the Kimi K3 model was illicitly trained using the latest iteration of Claude.
“We’ve seen a fair amount of this from China,” Klein remarked. “This is something that the industry writ large is dealing with.”
Earlier this year, Anthropic formally accused Moonshot AI, along with two other Chinese AI laboratories, DeepSeek and MiniMax, of distilling its advanced AI models. Anthropic has also leveled accusations against Alibaba, the developer of the Qwen family of models, of orchestrating a substantial “distillation attack” to illicitly capture capabilities from Claude. Both OpenAI and Google have published research detailing their encounters with distillation and assert they are confronting analogous challenges.
Alibaba, DeepSeek, Moonshot, and MiniMax did not provide responses to requests for comment.
‘Fraudulent means’
Cybersecurity experts have informed CNBC that the threat landscape extends beyond China, encompassing countries such as Iran, Russia, and North Korea. In these regions, the use of Claude, Google’s Gemini, and OpenAI’s ChatGPT is often restricted by the companies themselves due to international sanctions.
Klein elaborated that numerous laboratories in these restricted areas “go through illicit means and fraudulent means to try to gain access to a model.”
One prevalent method for circumventing these restrictions involves accessing the dark web. Here, illicit marketplaces offer stolen credit card information and compromised AI accounts. Klein indicated that companies like Moonshot are actively “spinning up tens of thousands, if not hundreds of thousands of fraudulent accounts.”
Upon gaining unauthorized access to Anthropic’s systems, these actors can query the models and systematically collect responses. This data is then used to train their own proprietary models, often referred to as student models, as Klein explained.
A key indicator of distillation activity is the volume of inquiries, with users submitting thousands of questions, rather than the typical dozens, and potentially creating thousands of accounts to execute the same actions. This creates a “whack-a-mole” scenario for AI developers seeking to maintain control, according to Klein.
“It’s very hard to fully stop this as a problem, but I think slowing it down is good and worthwhile,” Klein stated, emphasizing that foreign entities can then leverage the technology with minimal oversight and fewer ethical constraints.
He further highlighted potential national security risks, citing concerns ranging from sophisticated surveillance capabilities to the possible weaponization of AI in programs such as biological weapons development. Klein specifically mentioned a documented campaign by a China-based entity that was engaged in large-scale espionage utilizing Anthropic’s technology.
“There is a national security concern at play if malicious actors, bad actors who we don’t trust are gaining access to a more capable models than they could have otherwise through the act of distillation.”
Travis Lanham, Chief Technology Officer at cybersecurity firm Armadin and a former Google engineer, noted that malicious actors often operate undetected due to the intense pressure on AI companies to maximize platform accessibility amid fierce market competition.
“These companies are serving billions of requests,” Lanham said, referring to the major AI laboratories. “The millions are relatively small compared to everything and it’s just sneaking in and trying to look like the rest of the crowd.”
Klein acknowledged that Anthropic anticipates widespread competition and recognizes the existence of legal distillation methods. These typically involve obtaining explicit permissions and adhering to all relevant laws concerning intellectual property and export controls.
“I think competition is great,” Klein stated. “The concern here is if you are taking our model, distilling it through fraudulent means, creating millions of fake accounts using stolen credit cards and stolen infrastructure, to then produce a model that doesn’t have safeguards in place.”
Original article, Author: Tobias. If you wish to reprint this article, please indicate the source:https://aicnbc.com/25430.html
About Author
