Anthropic’s distillation allegations: access and permission in AI competition
An AI model’s answer can become training material for another model. That possibility raises questions both about building more efficient systems and about how a company can protect its capabilities from competitors. The allegations involving distillation from Claude need to be considered along both dimensions.
The timeline of the allegations
On February 23, 2026, Anthropic accused DeepSeek, Moonshot and MiniMax of conducting more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts. The company alleges that the traffic violated its terms of service and sought to transfer capabilities such as reasoning, coding and tool use to other models.
On September 8, 2026, the NSA, FBI and CISA issued a joint advisory alleging industrial-scale distillation activities by China-based companies targeting US models. The debate that resurfaced in October therefore draws on separate announcements made at different times.
In its September response, China’s Ministry of Commerce called the allegations groundless. It argued that distillation is a common technique and that the United States was turning it into a means of political pressure and restricting competition. These are the parties’ stated positions. I have not independently audited who controlled the accounts or which training processes used the collected answers.
What does distillation do?
Distillation is an approach to training one model using another model’s outputs. It can transfer some capabilities of larger systems into smaller models that are cheaper to run. The student model attempts to learn the teacher’s behaviour from examples.
That technical description does not, by itself, explain how access was obtained or what permissions govern the use of the outputs. This is the distinction I focus on: a method’s usefulness and whether a particular use complies with its conditions should be examined separately. Obtaining model weights and using generated answers for training are also different technical events.
Why is competition becoming more contentious?
The US agencies argue that these activities help close the technology gap by reducing research, computing and energy costs. That framing extends the competitive debate to the economic value of individual model outputs.
In my view, providers face a difficult product decision. Giving users more useful, detailed answers can also make those outputs valuable as training material. Broad restrictions introduced in response could make access harder for researchers and ordinary users. Assessing defensive measures should include the cost of false positives for those users.
What would I examine as a developer?
When building a product on a model, I want to understand its data and access chain alongside its performance. Where the training data came from, the scope of the relevant permissions and the service’s dependence on other providers should all inform a long-term product decision.
Similarly, I would not judge a capable model solely by its country of origin. Reproducible tests, clearly explained data processes and responses to specific allegations are more meaningful criteria.
For this debate to lead somewhere useful, I believe technical evidence and usage boundaries need to become more visible. The distinction between gaining efficiency through distillation and circumventing another service’s access rules should be explained clearly enough for developers to understand.