Report Chapter 7: Unauthorized Model Distillation (September 2026 Report)
This chapter is the publisher's attribution report on multiple companies and reseller networks. Technical facts, allegations, and legal judgments should be read separately.
p. 143–154 · 6 case units
Key findings
Distillation is a technique; 'unauthorized' is a separate layer of judgment.
GTG-16008 does not find that Xiaomi used Claude replies to directly serve users.
GTG-16012 and GTG-16003 are in the same section but involve different activities.
What happened
Original report pages 143–154. It first explains the concept of distillation, then makes allegations one by one about Alibaba-related activity, Moonshot request forwarding, similar forwarding by DeepSeek, Zhipu capability extraction, Xiaomi's use of training data, and the reseller ecosystem involving SenseTime and MiniMax.
Six article units cover seven GTGs. Public interpretation keeps the 'the report says' framing, does not demonstrate extraction methods, and does not present platform rules as court rulings.
Original report illustration: opening concept for the distillation chapter. Text in the figure is the original English.
According to the Anthropic report, DeepSeek also deployed a strategy similar to Moonshot's: building a CoT extraction pipeline, using the same cross-session replay attack to extract Claude's chain-of-thought records, and silently forwarding conversations to Claude without notifying customers. The report also says DeepSeek routed requests from users of third-party coding tools to Claude Opus, including sensitive data from Chinese tech companies, Russian defense agencies, and Chinese public security surveillance systems. All of the above are the publisher's allegations, not this site's independent findings.
According to the Anthropic report, Moonshot (the developer of the Kimi models) silently forwarded customer requests to Claude and then displayed Claude's responses to users, who thought they were using Kimi. In one ten-day window, nearly 300,000 customer requests were forwarded, the vast majority to Opus; the proxy network had 5,380 fake accounts. The report did not confirm whether users were aware. All of the above are the publisher's allegations, not this site's independent findings, and not a judicial conclusion.
According to Anthropic's September 2026 report, an operator linked to Alibaba is alleged to have launched the largest distillation attack the report has measured, targeting the chain-of-thought reasoning records of Claude Opus 4.6 and 4.7. The report says the data was used to train the Qwen series of models. All attribution and figures come from the report's unilateral allegations; the companies involved have not confirmed them on this site.
According to an Anthropic report, Zhipu (overseas brand Z.ai) ran a chain-of-thought extraction pipeline against Claude, feeding captured Claude reasoning traces back into Claude for cleaning and using them to train its GLM model. The report states that over 10 days, Zhipu ran the extraction pipeline against Opus 4.8 through 273 fraudulent accounts, recording 770,000 exchanges. The report also alleges Zhipu distilled the cyber capabilities of leading US frontier models. All of the above are allegations by the publisher and have not been independently verified by this site.
According to an Anthropic report, Xiaomi replayed user conversations and programming sessions from its own MiMo model to Claude, often routed through third-party programming tools. The investigation did not show that Xiaomi used Claude's responses to directly serve its users; rather, it saved conversations between Xiaomi customers and its own model. Many sessions were routed through third-party routing services commonly used by US and European users. This case differs from the Moonshot / DeepSeek cases of 'substituting its own model's answers': Xiaomi did not use Claude responses to directly serve users, but saved the conversations.
According to an Anthropic report, the proliferation of proxy services has created a secondary market through which labs can buy or obtain records of users' exchanges with Claude. SenseTime's distillation pipeline included user-Claude exchange records purchased from third-party data vendors. MiniMax built a proxy network service through shell companies that only provided access to Anthropic and OpenAI models, not any Chinese models, suggesting its purpose was to collect users' exchanges with US frontier models to train its own model. All of the above are allegations by the publisher and have not been independently verified by this site.
Limits of response
Commercial competition and sensitive allegations are involved; the report's claims are presented as stated.
Numbers and techniques from adjacent sections should not be applied to each other.
