Anthropic says the battle over frontier artificial intelligence is increasingly moving beyond benchmarks and chatbot features into model extraction, espionage and cyber operations.
In its latest threat intelligence findings, the Claude developer said it disrupted several allegedly malicious campaigns over the past eight months, including attempts it attributed to China-based AI labs to extract or replicate Claude’s capabilities and a Russia-linked cyber espionage operation targeting Ukrainian government, military and diplomatic interests.
What Anthropic says happened
One of the most striking allegations concerns accounts Anthropic associated with Alibaba. The company says it observed more than 151 million exchanges between May and July 2026 in what it described as an illicit distillation campaign designed to extract capabilities from Claude and potentially improve competing AI systems.
Anthropic also named Moonshot and DeepSeek in separate allegations, saying some activity involved routing live customer conversations through Claude and using the resulting responses in model development. These are Anthropic’s allegations; the findings should not be treated as independent proof of wrongdoing by the companies named.
Reuters independently reported Anthropic’s disclosures on September 10 and noted that Alibaba did not immediately respond to its request for comment.
Claude is also becoming part of the cyber battlefield
The report goes beyond competition between AI laboratories. Anthropic said a group whose methods were consistent with the Russia-based threat actor tracked by Microsoft as Midnight Blizzard used AI throughout operations targeting Ukrainian government, military and diplomatic sectors.
According to Anthropic, the activity included phishing, attempts to compromise hotel Wi-Fi and WhatsApp accounts, and software designed to repeatedly rewrite malware when security systems detected it.
That distinction matters. Generative AI is no longer useful to attackers only for drafting convincing emails or explaining code. More capable models can increasingly participate across multiple stages of an operation, leaving humans to supervise work that previously required substantially more hands-on involvement.
Why model distillation matters
Training frontier AI systems costs enormous amounts of money and computing power. Distillation can legitimately be used to transfer capabilities from a larger model into a smaller, cheaper one, but using another provider’s proprietary outputs at industrial scale raises questions about intellectual property, terms of service and the competitive advantage created by expensive model training.
The wider dispute is becoming geopolitical as well. US authorities have recently accused Chinese AI companies of aggressive extraction of capabilities from American models. China has rejected such accusations as groundless and argued that restrictions are being used to protect US dominance in artificial intelligence.
Anthropic’s new findings therefore land in a much larger contest over who owns the knowledge embedded in frontier models and how easily that knowledge can be reproduced.
What it means for AI users
For ordinary users, the immediate consequence is not that Claude or other mainstream AI services suddenly become unsafe to use. The more important change is happening behind the scenes.
AI companies increasingly need systems capable of distinguishing normal customer activity from automated extraction, fraud and cyber operations. Businesses sending sensitive information to AI services also have another reason to examine where their data travels and how third-party models are incorporated into applications.
The issue becomes even more significant as AI agents gain the ability to browse websites, execute code and interact with external systems. A chatbot that generates text presents one security problem. An autonomous system capable of carrying out a sequence of actions presents a very different one.
The AI race now has a security front
Anthropic itself has recently disclosed incidents in cybersecurity evaluations where Claude models reached real external systems after evaluation environments were incorrectly connected to the open internet. The company has since expanded monitoring, hardened evaluation environments and commissioned independent investigation of those incidents.
Taken together, the developments point to a broader shift. The contest between OpenAI, Anthropic, Google, Meta, DeepSeek and other AI developers is no longer simply about which model scores highest or responds fastest.
Frontier models are becoming valuable strategic assets worth protecting, potential targets for capability extraction and increasingly powerful tools that malicious actors want to incorporate into cyber operations.
That makes security — both protecting the models and controlling what they can do — one of the defining competitive challenges of the next phase of artificial intelligence.
Sources: Anthropic threat intelligence disclosures and security research; Reuters reporting, September 10, 2026.
