If you’re building on top of a frontier model, your API traffic is now a target for capability extraction. Anthropic’s February 23, 2026 disclosure of distillation attacks by DeepSeek, Moonshot, and MiniMax shows how coordinated campaigns can pull reasoning, coding, and agentic skills out of a model at industrial scale—and why the defenses matter for legitimate users.
The Attack Pattern Is Volume Plus Focus
Distillation itself is a normal training technique: labs routinely distill their own models into smaller, cheaper versions. What Anthropic describes is different. The three campaigns generated over 16 million exchanges through roughly 24,000 fraudulent accounts, using proxy services and hydra-cluster architectures to spread traffic across the API and third-party cloud platforms. One proxy network managed more than 20,000 fraudulent accounts simultaneously, mixing distillation traffic with unrelated customer requests to hide the signal.
The tell isn’t any single prompt. It’s the pattern: tens of thousands of variations on the same narrow capability, arriving across hundreds of coordinated accounts. Anthropic’s example prompt—“You are an expert data analyst combining statistical rigor with deep domain knowledge”—looks benign once, but becomes a fingerprint when repeated at scale with synchronized timing and shared payment methods.
What the Attackers Were After
Each lab targeted Claude’s most differentiated capabilities. DeepSeek focused on reasoning and rubric-based grading, including prompts that asked Claude to articulate the internal reasoning behind a completed response—effectively generating chain-of-thought training data. Moonshot went after agentic reasoning, tool use, and computer-use development, with over 3.4 million exchanges. MiniMax ran the largest campaign at over 13 million exchanges, targeting agentic coding and orchestration.
Anthropic caught the MiniMax campaign while it was still active, before the model being trained was released. When Anthropic shipped a new model during the campaign, MiniMax pivoted within 24 hours and redirected nearly half its traffic to the new system. That speed is the part builders should internalize: distillation campaigns adapt to model releases in real time.
Why This Matters for Your Product
The national security framing is real—Anthropic argues that illicitly distilled models lose the safeguards built into the original, enabling dangerous capabilities to proliferate. But there’s a practical angle for product teams too. If your application relies on a frontier model’s reasoning or coding quality, distillation attacks create a competitive distortion: labs can copy those capabilities at a fraction of the cost and time, then undercut you with a model that has fewer protections.
Anthropic’s response includes classifiers and behavioral fingerprinting to detect chain-of-thought elicitation and coordinated account activity, plus stronger verification for educational accounts, security research programs, and startup organizations—the pathways most commonly exploited for fraudulent accounts. They’re also developing product, API, and model-level safeguards to reduce the efficacy of outputs for illicit distillation without degrading legitimate use.
What Builders Should Watch
Anthropic is sharing technical indicators with other AI labs, cloud providers, and authorities. That means detection signals may propagate across platforms, and access controls could tighten for the account types attackers abuse. If you use educational or startup-tier access, expect more verification friction.
The broader lesson connects to a theme we’ve covered before: choosing a structured data extraction tool for AI agents in 2026 requires understanding how your traffic patterns look to the model provider. Legitimate high-volume use can resemble an attack if it’s concentrated on a narrow capability. Builders who run large-scale reasoning or coding workloads should monitor their own request patterns and be ready to explain them.
Anthropic is clear that no single company can solve this. The disclosure is meant to make evidence available to everyone with a stake in the outcome. For product builders, that means the cost of using frontier models now includes a new variable: your traffic is being watched for signs of extraction, and the defenses will keep evolving.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.