Anthropic names Chinese labs in AI distillation report

Anthropic published its threat intelligence report on September 10, and one finding should change how you buy inference. Two Chinese labs, the report says, quietly forwarded their own customers' requests to Claude and handed back Claude's answers as their own. If you were a customer of those labs, your prompts went to a vendor you never signed a contract with. That is the AI distillation story worth your attention, and it is a supply-chain problem, not a geopolitics problem.

What actually happened

The report covers activity Anthropic disrupted between December 2025 and August 2026 across seven harm categories, including a category Anthropic calls illicit distillation: harvesting a frontier model's outputs to train a competitor.

Per CyberScoop's coverage, seven China-based labs ran distillation campaigns starting in February. Operators linked to Alibaba ran the largest, peaking at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts. DeepSeek and Moonshot AI went further: the report says they silently forwarded customer requests to Claude and returned its responses, behavior Anthropic describes as likely inconsistent with privacy laws and with those labs' own terms of service.

The same report documents how fast credential theft now moves. CyberScoop cites ShinyHunters affiliates dumping 2,100 cloud access tokens across 40 corporate tenants in 34 hours, and one intrusion going from a single stolen developer token to full control of a cloud environment in roughly three hours, with AI agents doing nearly all the work.

Why your token supply chain matters for your business

Most small teams pick a model provider on price per million tokens. That number tells you nothing about who runs the GPU. A reseller, a proxy, or a "compatible endpoint" can sit between you and the model, and the cheapest tier is exactly where that happens. When it does, your customer data crossed a border and a contract boundary that nobody in your vendor chain will admit to.

Ask your provider one question in writing: do you serve this model on your own infrastructure, or do you route it? Get the answer in the contract, next to data residency and retention. If a vendor will not answer, that is the answer.

Then treat API keys like the cash they are. Scope each key to one service, rotate on a schedule, keep them out of repos and images, and alert on billing anomalies — a key that starts costing money at 3 a.m. is the cheapest breach signal you will ever get. Three hours from stolen token to owned cloud means your detection window is a shift, not a quarter.

Sources: Anthropic: Countering misuse of AI, September 2026, CyberScoop.