Jacob Klein, who leads threat intelligence at Anthropic, says he's pro-competition but what he's seeing from parts of the Chinese market looks more like theft than rivalry. He says foreign adversaries are accessing Claude and using its outputs to train rivals through distillation.
Distillation can be legitimate if it is done with the right permissions and in line with IP and export-control laws. Klein argues that is not what is occurring here. "There's an entire illicit ecosystem to try to gain access to Claude and other models," he told CNBC. "This ecosystem goes through any means necessary to evade our controls, so they can spin up accounts at extreme scale."
A telltale sign, he added, is users firing off thousands of prompts instead of a few dozen, sometimes with thousands of separate accounts.
Anthropic has singled out Moonshot AI, saying its Kimi K3 model learned unlawfully from the latest release of Claude. The model drew widespread attention in July for delivering frontier-level performance at a lower price and for being easier for companies to tailor. Earlier this year, Anthropic also alleged that Moonshot, DeepSeek and MiniMax distilled its frontier systems, and it said Alibaba, which builds the Qwen models, mounted a large-scale "distillation attack" aimed at unlawfully extracting Claude's abilities. Both OpenAI and Google have released write-ups on distillation and report they are confronting the same problem.
"We've seen a fair amount of this from China," Klein said. He added that companies like Moonshot are "spinning up tens of thousands, if not hundreds of thousands of fraudulent accounts." Alibaba, DeepSeek, Moonshot and MiniMax did not reply to inquiries for comment.
Even when news shifts attention elsewhere, steady contributions build wealth over time, so get the free Always Be Buying E-Book
Cybersecurity specialists told CNBC that outside China, they also see operations originating in Iran, Russia, and North Korea, and the firms behind Claude, Google's Gemini, and OpenAI's ChatGPT restrict access there because of sanctions. According to Klein, groups in those regions "go through illicit means and fraudulent means to try to gain access to a model."
One workaround runs through the dark web, where marketplaces offer stolen credit cards and compromised AI logins. Once in, operators query models and harvest responses for training a student model, creating a whack-a-mole enforcement loop for AI labs. "It's very hard to fully stop this as a problem, but I think slowing it down is good and worthwhile," Klein said.
Klein also warned that some foreign firms run with few guardrails. He pointed to surveillance risks and potential bio-weapons support, and said one China-based group ran a targeted operation that leveraged Anthropic's tools to carry out large-scale espionage. "There is a national security concern at play if malicious actors, bad actors who we don't trust are gaining access to a more capable models than they could have otherwise through the act of distillation."
Travis Lanham, the CTO at the cybersecurity company Armadin and previously an engineer at Google, said the volume makes it hard to spot as AI platforms remain open. "These companies are serving billions of requests," he said. "The millions are relatively small compared to everything and it's just sneaking in and trying to look like the rest of the crowd."
The policy fight is heating up. Some in tech want regulators to back off so the most affordable and capable systems win on merit. Others are pressing for tougher rules to curb what they view as IP theft.
This is all landing as Anthropic's profile spikes. According to CNBC, the company's private valuation is close to $1 trillion, and it could debut on public markets as soon as October. Put it together and you get an AI market where access, pricing, and safety features could shift quickly as labs crack down and rivals push back. As Klein put it, "I think competition is great.
