Key Takeaway
- 🕵️ A 10-day spy run: Zhipu (Z.ai) rotated 273 fraudulent accounts against Claude Opus 4.8 to extract chain-of-thought reasoning — 770,609 exchanges passed through its cleaning pipeline in ten days.
- 🛡️ Fable held the line: Zhipu tried to target Anthropic’s Fable first but gave up — strengthened cyber safeguards degraded the attacks, so they pivoted to models they assessed as weaker.
- 📊 The scale: 3.4 million Zhipu exchanges observed over 17 days; DeepSeek ran 12.1 million in 14 days; Xiaomi replayed 400,000 user sessions through proxies.
- 🛒 A black market exists: proxy services harvest and sell user-Claude transcripts — SenseTime bought stolen exchanges from data vendors; MiniMax ran a shell-company proxy network.
- 🇵🇭 Reader takeaway: your prompts to AI models can be harvested and sold — what you type into a “free” proxy or router service may end up as training data for someone else’s model.
Table of Contents
The Report That Reads Like an Espionage File
Anthropic’s September threat-intelligence report covers seven harm areas, but its most consequential section may be the one titled illicit distillation. Between December 2025 and August 2026, Anthropic’s Threat Intelligence team documented and disrupted a set of operations by Chinese AI companies — Zhipu, Xiaomi, DeepSeek, SenseTime, and MiniMax — that attempted to extract the capabilities of Claude through systematic, industrial-scale attacks the industry now calls distillation attacks. The document reads less like a security advisory and more like a declassified espionage file, complete with account counts, exchange counts, and the moment a target’s defenses degraded an operation.
The report follows Anthropic’s November 2025 espionage disclosure, and the two documents together trace an eighteen-month escalation from isolated misuse to industrial pipelines. Distillation, in its legitimate form, is a standard machine-learning technique: train a smaller model to mimic a larger one’s outputs. What this report documents is the illicit version — companies trying to absorb a frontier model’s reasoning abilities wholesale, through deception, at scale, in violation of the provider’s terms. The economics explain the motive: training a frontier model from scratch costs hundreds of millions of dollars. Distilling one from an existing frontier model’s outputs costs a proxy network and some cleanup scripts.
The Zhipu Playbook, Step by Step
Zhipu, branded outside China as Z.ai, ran the most technically interesting operation. The company built a chain-of-thought extraction pipeline: replay captured Claude reasoning traces back through Claude itself to “clean” them for training its GLM model family. To sustain the operation, Zhipu launched the pipeline against Claude Opus 4.8 by rotating through 273 fraudulent accounts in ten days, evading model restrictions as each account was flagged. Over that same ten-day window, Anthropic counted 770,609 exchanges passing through the CoT-extraction cleaner — and attributed over 3 million total Zhipu exchanges in the period, most used for cleaning distilled outputs.
Zhipu also used Claude to improve its own post-training pipeline: judging model outputs, cleaning and normalizing harvested reasoning transcripts, scoring and filtering training data, writing tasks, providing solutions, and implementing tests.
The victim model was being used as its own autopsy tool.
The GLM 5.3 Campaign: Targeting Cyber Capabilities
The most forward-looking operation preceded Zhipu’s GLM 5.3 release. Zhipu researchers used public vulnerability datasets to develop capture-the-flag challenges, then launched a distillation attack against the top model of another leading US frontier lab to teach their model cyber capabilities. Claude Opus 4.6 was separately targeted in the same campaign — primarily to evaluate and grade the other model’s responses.
Then comes the detail that matters most for defenders. Zhipu initially tried to target Claude Fable, Anthropic’s top generally accessible model. Fable carries strengthened cyber safeguards — and they worked. Zhipu gave up targeting Fable after Anthropic’s safeguards degraded the attacks, and its employees switched to Opus 4.6 and the other US lab’s model expressly because they assessed the safeguards were weaker. Model safeguards, in this era, are not compliance theater; they are the difference between being the target that holds and the target that pays.
The Scale Table: Five Campaigns, Five Patterns
| Entity | Method | Observed scale |
|---|---|---|
| Zhipu (Z.ai) | CoT extraction via 273 fraudulent accounts; Opus 4.6 targeted for cyber distillation | 3.4M exchanges / 17 days |
| DeepSeek | Relayed user requests, including PRC police surveillance tools | 12.1M exchanges / 14 days |
| Xiaomi | Replayed own users’ MiMo sessions through proxies | 400K+ requests / 1,500 accounts |
| SenseTime | Purchased stolen user-Claude transcripts from data vendors | Pipeline built with Claude’s help |
| MiniMax | Shell-company proxy network harvesting US frontier exchanges | US/EU user data relayed |
The Proxy Black Market Nobody Priced
Every campaign shares one infrastructure layer: accounts and access paths that should not exist. The techniques differ, the plumbing rhymes.
The report’s most sobering finding may be the secondary market. Proxy services — originally built to give users in unsupported regions access to models like Claude — evolved into exchange-harvesting operations. Some proxy networks both resell access and save the transcripts, selling them to other labs. SenseTime’s distillation pipeline included transcripts purchased from exactly such third-party vendors. MiniMax went further, building its own proxy service through a shell company with no obvious corporate links — a service that offers only Anthropic and OpenAI models, never MiniMax’s own, suggesting its purpose was harvesting, not serving.
For individual users, the privacy implication lands close to home: requests relayed through third-party routing platforms contained users’ names, contact information, and corporate data in at least a dozen languages. Your prompts are not just queries — in a harvested proxy’s logs, they are inventory.
Why Safeguards Held — and What That Proves
There is a defensive success story buried in the espionage. Fable’s cyber safeguards did not just slow Zhipu down; they made the attack economics fail. Zhipu assessed the cost of continuing against Fable as higher than switching targets — and a determined state-adjacent actor deciding your defenses are not worth attacking is the practical definition of deterrence. Anthropic’s approach pairs safeguard hardening with disruption: accounts flagged, pipelines identified, intelligence shared with authorities and industry partners.
The broader lesson for the industry: the report’s own framing that sophisticated attacks no longer require sophisticated attackers applies to model theft, too. The distillation toolkit — proxy networks, account rotation, transcript cleaning — is now a commodity. What stopped it was not a technical secret but layered safeguards plus active monitoring, the same combination that works against every other class of persistent abuse.
What Filipino AI Users Should Take From This
Three habits follow for the readers who matter most to us — the developers, students, and professionals who use AI tools daily. First, know who sees your prompts: model routing services and “free access” proxies monetize transcripts; your work documents, client data, or personal details can end up in a stranger’s training corpus. Second, treat free-tier AI trials from unknown vendors with suspicion: Xiaomi’s MiMo free-trial surge, extended just before its distillation campaign began, shows how user enthusiasm can be converted into stolen capability. Third, watch the model you are using — if a small vendor’s model suddenly matches a frontier lab’s behavior on hard tasks, the honest question is whose capability you are actually renting.
We covered the defensive side of this arms race in our AI account security piece and the supply-chain angle in Plugin4Shell — the common thread is that AI systems are now attacked as infrastructure. The distillation era is the AI industry’s industrial-espionage chapter. The difference from previous tech theft is speed and volume: 12 million exchanges in two weeks is not a leak; it is a pipeline. And the countermeasure — safeguards that make attacks economically pointless — is now proven technology, not aspiration.
Why Distillation Is the Espionage Method of Choice
Stealing weights requires exfiltrating terabytes through monitored infrastructure. Stealing behavior requires only queries — and queries look like customers.
That asymmetry is why distillation has become the preferred vector in model espionage: every output the victim model produces is a training signal, and enough high-quality signal approximates the capability the attacker wants without ever touching the artifact everyone guards. The defense problem is brutal because the attack surface is the product itself.
You cannot refuse to answer customers; you can only make the answers less useful to a trainer.
Anthropic’s report describes the countermeasures that held: rate limiting on suspicious account clusters, watermark-style detectability in response patterns, and — decisively — behavior flags that survived the fraud ring’s account rotations. The lesson for every API operator is that the detection signals are behavioral, not credential-based.
The 273 accounts were well-made fakes; what betrayed them was how they used the product — uniform query pacing, systematic coverage of capabilities, response-capture discipline no human user exhibits. Product telemetry is now a security function, not just a growth one.
The Zhipu Denials, and What They Change
Zhipu’s public position denies the operation and frames the report as competitive smear. The technical evidence Anthropic published — account structures, query patterns, rotation timing — is the kind that survives adversarial review, and independent security researchers have corroborated the report’s framing.
But the denial itself matters for the market: a frontier lab accused of state-adjacent espionage that answers with attribution complaints rather than technical rebuttal leaves the evidence standing.
Buyers of Chinese frontier models — and there are many, because the price-performance is real — now carry an diligence question their procurement teams did not have last month. The model works. The question is what the vendor does with your queries.
The Broader Pattern: This Is Not the First Probe
Anthropic’s threat-intelligence work has documented repeated access attempts across the year — the September report’s Zhipu section is the most detailed, but the pattern of state-adjacent probing predates it. What changed is scale and persistence: ten days of continuous operation, 273 accounts, deliberate capability coverage.
Earlier probes looked like curiosity; this one looked like a program. The security community’s read is that distillation espionage has moved from ad-hoc attempts to institutional practice — which reframes every API business decision, from rate limits to enterprise contracts, as a counterintelligence decision.
For the companies building on Claude — the Philippine agencies, the regional consultancies, the solo builders — the report’s practical value is the fraud taxonomy: what the fake accounts looked like, which payment instruments they used, how they evaded. Every one of those signals transfers to any platform’s fraud screening.
The espionage lesson is also an API-economics lesson: the operators who survived the ten-day run were the ones whose monitoring watched behavior, not billing.
Frequently Asked Questions
What is a distillation attack?
Distillation trains a model to mimic another model’s outputs or reasoning. An illicit distillation attack does this at scale through deception — fraudulent accounts, proxy networks, or harvested user transcripts — to steal a frontier model’s capabilities without paying to develop them.
What did Zhipu do?
Zhipu (Z.ai) ran a chain-of-thought extraction pipeline against Claude Opus 4.8 using 273 fraudulent accounts over ten days, cleaned 770,609 exchanges through its pipeline, and separately targeted Claude Opus 4.6 and another US lab’s model to distill cyber capabilities ahead of its GLM 5.3 release.
Which companies were named in Anthropic’s September report?
Zhipu, DeepSeek, Xiaomi, SenseTime, and MiniMax — documented across distillation, surveillance, and proxy-harvesting operations between December 2025 and August 2026.
Why did Zhipu give up on targeting Fable?
Claude Fable carries strengthened cyber safeguards that degraded Zhipu’s attacks. Zhipu’s employees switched to models they assessed as having weaker safeguards — including Claude Opus 4.6 and another US frontier lab’s leading model.
Does this affect regular users of Claude?
Users who access Claude directly through official channels are protected by Anthropic’s safeguards. The privacy risk sits with third-party proxy and routing services, which may log and resell your prompts — avoid them for any sensitive work.
