Anthropic accuses seven Chinese AI labs of copying Claude via fraud

Anthropic's fourth threat intelligence report, published 10 September 2026, puts a commercial edge on what had been framed mainly as a security disclosure: seven Chinese AI labs, including Alibaba, DeepSeek, Moonshot, Xiaomi, Zhipu, SenseTime and MiniMax, stand accused of using thousands of fraudulent accounts to harvest Claude's outputs and train rival models on them. That is a direct allegation that some of China's best-funded model builders are cutting training costs by distilling Anthropic's work rather than paying for it.

The report covers misuse detected and stopped between December 2025 and August 2026, spanning cyber operations, influence campaigns, surveillance, scams, weapons-related misuse and distillation. Anthropic's central finding is a shift in how attackers use its models: not for isolated advice or snippets of code, but as an orchestrator running multiple stages of an operation end to end.

The clearest example is a Russia-linked espionage campaign, GTG-20006, with activity consistent with the group known as Midnight Blizzard. It used Claude to automate reconnaissance, build malware and rebuild tools after each detection, hitting more than 20 organisations including drone makers and Ukrainian officials. Anthropic said the attackers' agents monitored security products and rewrote malware in a loop until it evaded detection.

A separate China-based operation, GTG-14010, used Claude to convert chatter from more than 100 monitored WhatsApp groups and dozens of Telegram channels into structured data tracking Uyghurs in Syria, and to draft restricted briefings cataloguing dissidents and diaspora communities. Anthropic also flagged nine influence campaigns originating from Turkey, Iran, Russia and elsewhere, the ShinyHunters criminal group using Claude to speed up system takeovers, and two Chinese undergraduates running an automated exploit "foundry". All flagged accounts were banned. The misuse cases involved older Claude Haiku, Sonnet and Opus models; Anthropic's Fable and Mythos-class models were implicated in only one distillation case.

The distillation allegations matter more commercially than the espionage findings. If Anthropic's account holds, it suggests Chinese labs are still leaning on Western frontier models to close capability gaps cheaply, even as they promote homegrown alternatives. That undercuts the narrative of fully independent Chinese model development and gives Anthropic grounds to tighten access controls and pursue account-level enforcement against commercial rivals, not just criminal groups.

For enterprise and government buyers, the cyber findings are the more immediate concern: state-linked actors using Claude as an autonomous attack orchestrator raises the bar on what any foundation model vendor must monitor and disclose. Anthropic's decision to publish detailed campaign names and targets, rather than quietly banning accounts, signals it wants to be seen setting the enforcement standard the rest of the industry gets measured against. Watch whether OpenAI or Google DeepMind match that level of disclosure, and whether the named Chinese labs respond to the distillation claims.