As Chinese AI models accelerate in capability, a new battle is taking shape behind the scenes—one that’s less about who has the fastest chips and more about who controls the “brains” of today’s most powerful large language models. Anthropic, the company behind the widely praised Claude AI, says it has uncovered a sustained effort by multiple Chinese firms to copy Claude’s internal decision-making methods and use them to advance competing models.
Anthropic’s core allegation is not simply that rivals are learning from publicly available research or benchmarking results. Instead, it claims these companies are using a technique commonly referred to as “distillation” at industrial scale—sending massive volumes of carefully designed prompts to Claude, collecting the outputs, and using those responses to train their own systems to behave in similar ways. According to Anthropic, this isn’t casual experimentation. It’s organized, high-volume extraction meant to replicate Claude-like capabilities without the same development investment or safety constraints.
Why does Anthropic see this as especially dangerous? The company argues that when Claude’s behavior is copied, its safety guardrails often aren’t copied with it. Claude is built with restrictions intended to reduce harmful or malicious use. Anthropic warns that distilled models can end up as powerful AI agents that lack comparable protections, potentially making them easier to weaponize for cyber abuse, disinformation, or other high-risk applications—especially if released openly or distributed widely.
DeepSeek is singled out as a notable example. The company drew major attention in the AI world by demonstrating impressive efficiency—achieving strong results with less computing power than many rivals. Anthropic alleges that DeepSeek removed important protective elements related to free-expression safeguards while also redirecting the model’s behavior away from sensitive topics that conflict with Chinese government censorship priorities. The broader concern: a model shaped this way could become more permissive for certain harmful uses while being selectively restrictive on politically sensitive subject matter.
Anthropic also points to rising geopolitical tension around AI governance and defense use. The company recently faced scrutiny and negotiations involving the U.S. Department of Defense over how Claude could be used. Anthropic says it does not want Claude used to control unmanned weapons systems or for surveillance targeting American citizens. At the same time, the Pentagon reportedly wants more flexibility and fewer limitations—highlighting how contested the idea of “AI guardrails” has become even among allied institutions.
In Anthropic’s view, this makes distillation-based plagiarism even more urgent. If a competitor can harvest Claude’s reasoning patterns through large-scale query networks—using distributed proxy systems, large volumes of accounts, and millions of requests—it may be possible to build a “Claude-like” agent that can then be deployed by state militaries or intelligence services without the restrictions Anthropic insists on.
The company says it traced significant distillation activity back to three Chinese AI firms: DeepSeek, MiniMax, and Moonshot. Anthropic claims the scale of activity tied to MiniMax was particularly striking, alleging it detected more than 13 million query exchanges with Claude. It also suggests the extraction effort coincided with periods when Anthropic was releasing major updates, meaning the competitor could have been improving its own model in near real time as Claude evolved.
To counter this, Anthropic says it has introduced new safeguards designed to spot distillation attempts that might look harmless on the surface. These can include seemingly benign prompts crafted to elicit structured reasoning and transparent logic—responses that can be parsed and reused as training signals. Anthropic says the challenge is that a single query might look normal, but millions of near-identical “innocent” requests can form a pipeline for automated model copying.
Even with new detection methods, Anthropic is warning that it can’t solve the problem alone. The company wants broader cooperation across the AI industry—especially from other leading model developers—to align on defensive standards and push policymakers toward stronger rules. Rather than relying mainly on hardware-focused export controls, Anthropic argues that governments should consider targeted anti-distillation measures aimed at preventing large-scale extraction of model behavior and internal decision processes.
The bigger message behind Anthropic’s warning is clear: in the race to build the next generation of AI assistants and autonomous agents, copying isn’t just a business dispute—it could reshape global AI safety overnight. If powerful models can be replicated at scale while stripping out guardrails, the result may be advanced AI tools that are harder to control, easier to misuse, and far more widely available to actors with fewer constraints on how they deploy them.
