Anthropic reveals 200 million interactions snatching thinking chains, as the distillation war moves the hunt for agent capabilities to model back ends

A detailed report released by Anthropic revealed a sharp rise in organized campaigns targeting the extraction of reasoning chains and logical capabilities of Claude models, recording roughly 200 million interactions observed across five separate campaigns carried out by Chinese AI labs and companies, including Alibaba, the Kimi model developer Moonshot AI, and DeepSeek.

Distillation attacks rely on coaxing the model to disclose its internal reasoning steps, then using those inference pathways as data to train smaller models through supervised fine-tuning, granting them advanced reasoning abilities at a computational cost far lower than that of foundational training. Although the platforms conceal internal reasoning chains and only provide brief summaries, the attackers have devised deceptive prompting techniques to bypass protections, such as directing the model to translate prior working-memory contents into another language to capture raw inference steps.

The report’s data showed that the bulk of these operations was led by a campaign linked to Alibaba, which Anthropic described as the largest comprehensive distillation attempt observed to date. The campaign comprised 151 million interactions between May and July 2026, peaking at roughly three million interactions per day across about 3,500 independent accounts, all using a fixed command template to extract reasoning and employ it in producing training material for the Qwen model family.

In contrast, another campaign associated with Moonshot directed roughly 300 thousand requests through a network of 5,000 accounts over ten days, targeting the most advanced Opus model. The report noted that some of those requests appeared to forward queries linked to Chinese military entities, including a request to assess closed-circuit television footage to determine whether the target exhibited abnormal behavior.

Targeted these attacks atExploiting agent capabilities and tool useIt is the area where today’s fiercest development battles occur, alongside dataIt is the area where today’s fiercest development battles occur, alongside data analysis, programming, and logical reasoning. Model replication attempts no longer focus on gathering superficial answers; they have become a systematic draining of the mental architecture that major labs constructed to tackle complex tasks.

This conflict imposes a new reality on engineering teams and technical leadership in the Gulf, Egypt, and the Arab region. The region’s growing reliance on open-weight models, especially the “Qwen” family which is a core component of many self-hosting and sovereign computing projects, will face broader scrutiny concerning the safety of training data sources and the legal implications for intellectual property. At the same time, this escalation is prompting API providers to tighten oversight and expand security filters against agent queries, requiring enterprise solution developers in our markets to review model-communication architectures to avoid having their repeated calls classified as suspicious patterns or to endure longer response times due to intensified security-inspection layers.