Chinese labs harvested 200 million Claude exchanges, Anthropic says

200 million stolen conversations and what distillation costs the industry

Seven China-based AI labs ran coordinated networks of fraudulent accounts to harvest approximately 200 million Claude conversations, using the outputs to train competing models at a fraction of normal R&D cost, according to Anthropic's September 2026 Threat Intelligence Report.^[1] The technique is called model distillation: a smaller model learns from a larger one's outputs, picking up capabilities without the underlying research. At this scale, run through fake accounts, it bypasses export controls and erases billions in development cost for whoever is running the operation.

Alibaba/Qwen led the campaign. Roughly 3,500 fraudulent accounts attributed to the Qwen operation harvested 151 million Claude exchanges between May and July 2026, more than three quarters of the total across all seven labs.^[1] That is 151 million prompt-and-response pairs, a ready-made training dataset built on Anthropic's infrastructure at Anthropic's compute cost, handed directly to a competitor.

The commercial stakes go beyond embarrassment for Anthropic. Chinese frontier labs, Qwen and DeepSeek among them, already compete aggressively on price with Western models. Training on harvested outputs from a frontier system compresses the R&D gap further and gives those labs a pricing weapon: models that approximate frontier capability without frontier R&D bills. Every Western business buying AI services pays, indirectly, for the research that distillation skips.

Bio labs, drone code and a cyber operation across 20 organisations

The distillation finding is the largest single data point in the report, but the range of misuse documented alongside it makes the document unusual. A state military laboratory used Claude to generate and analyse mutations of the chikungunya virus, a mosquito-borne pathogen, in a case the report presents as an example of AI-enabled biological research risk.^[3] A separate actor based in the United States worked on pandemic-grade avian influenza using the same system, raising dual-use concerns that stretch well beyond geopolitical rivals.^[3]

On the weapons side, a freelance Russian operator used Claude Code to develop control software for kamikaze drones.^[4] The report does not describe the operator as state-directed, placing this in the category of individual actors using accessible AI tooling for conventional weapons work.

A Russia-linked cyber espionage operation hit more than 20 organisations, with attackers using Claude Code to automate reconnaissance, exploit vulnerabilities, move laterally through networks and extract data.^[2] Jacob Klein, Anthropic's head of threat intelligence, said that authoritarian states are using AI for surveillance, repression and influence operations today, and that it is no longer hypothetical.^[7] Klein also said that attackers are effectively automating parts of the job within the intelligence apparatus.^[7]

What Anthropic caught, what it missed and how detection works

Anthropic's detection pipeline, combining text watermarking and enhanced safety classifiers, blocked approximately 98% of illicit distillation attempts, with the remaining 2% evading initial safeguards.^[5] On a base of 200 million harvested exchanges, that 2% works out to roughly four million conversations that cleared detection and fed directly into competitor training runs. Four million prompt-and-response pairs is a usable dataset.

The 98% figure also carries an embedded assumption: the denominator is the volume Anthropic detected and measured, not total attempts including those that left no trace. The report does not claim the pipeline observed everything; it claims it blocked 98% of what it identified. How much distillation activity went entirely undetected is not quantified.

Anthropic has published threat intelligence reports since March 2025, each expanding the documented misuse spectrum. The September 2026 edition is the first to publish distillation volumes at this scale and to name specific labs alongside activity windows and account counts.

Three policy asks and why they matter for buyers of AI services

The report closes with three specific requests directed at policymakers: mandatory inter-lab threat information sharing, closure of export-control loopholes on advanced AI chips, and sanctions on the laboratories responsible for industrial-scale distillation campaigns.^[6] Each ask maps to a specific gap the report documents.

The chip export ask connects directly to the distillation finding. Running 200 million inference calls to harvest training data requires substantial compute, and if the labs responsible cannot access advanced chips, the cost of running campaigns at this scale rises sharply. The inter-lab sharing request addresses a structural problem: Anthropic caught these campaigns on its own systems, but a lab running distillation across multiple providers simultaneously would only trigger each provider's detection in partial view.

For businesses that depend on AI tools built on frontier models, the distillation economy creates a quiet price pressure running in the opposite direction to what most procurement teams expect. Cheaper Chinese models trained on harvested frontier outputs will keep arriving, and whether their developers absorbed any of the underlying R&D cost is, in large part, a policy question. Anthropic's report puts a number on what happens when the answer is no: 200 million exchanges, three months, seven labs.