Anthropic threat-intelligence report details Chinese AI-distillation credential-harvesting campaigns

On Thursday 10 September 2026, Anthropic published its fourth threat-intelligence report, "Detecting and countering misuse of AI: September 2026" (~154 pages; landing page + full PDF + IOCs CSV), documenting misuse of Claude that its Threat Intelligence team disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. All documented misuse involved Claude Haiku, Sonnet, or Opus; none involved the Fable or Mythos-class models except one distillation case.

The headline: industrial-scale illicit distillation by seven China-based labs. Anthropic said it detected and disrupted campaigns (GTG-16001 through GTG-16012 designators) since February 2026:

• GTG-16005 (Alibaba) — "largest distillation attack we have ever measured": 151 million exchanges observed May–July 2026, peaking at ~3 million/day from 3,500+ fraudulent accounts, targeting chain-of-thought (CoT) reasoning transcripts of Claude Opus 4.6/4.7 for agentic tasks, software engineering, kernel development, and long-horizon tasks; outputs fed Alibaba's Qwen model family and broader RL/model-architecture research.
• GTG-16002 (Moonshot AI): 23 million exchanges (May–July); silently rerouted live Kimi customer requests to Claude and displayed Claude's responses as Kimi's; ~300,000 customer requests relayed over one 10-day window through a 5,380-account proxy network (mostly Singapore/Japan); a subset captured to train a CoT model. One documented request asked Claude to assess closed-circuit surveillance footage for "abnormal" behaviour — TechCrunch characterized the sourcing as a request "routed directly from the Chinese military."
• GTG-16001 (DeepSeek): 12.1+ million exchanges over 14 days in July 2026, using the same silent-relay approach and extracting CoT transcripts from real user conversations.
• GTG-16006 (Z.ai / Zhipu): 3.4+ million exchanges over 17 days (June–July) rotating 273 fraudulent accounts in a CoT-extraction-and-replay pipeline; initially targeted Claude Fable, abandoned it after Fable's stronger cyber safeguards, and switched to Opus 4.6 and another US frontier model assessed as having weaker safeguards.
• GTG-16008 (Xiaomi): 400,000+ exchanges over 20 days (March–April 2026) replaying MiMo user conversations/coding sessions through OpenClaw and OpenCode harnesses.
• GTG-16012 (SenseTime): purchased transcripts of user exchanges with Claude from third-party data vendors.
• GTG-16003 (MiniMax): built its own proxy network through a shell company offering access to Anthropic and OpenAI models, likely to collect exchanges for training.

Access methods (per the report): routing through proxy services / "transfer stations" that create thousands of accounts with false identities, fake or stolen credit cards, and stolen API keys; purchasing saved exchange transcripts from resellers; and a new technique — cross-session replay attacks that allowed CoT reasoning transcripts to be harvested. Anthropic says it banned accounts, traced proxy networks, strengthened extraction detection, added identity verification for abuse-signaling accounts, and is introducing new defenses against replay tactics.

The second thread: AI-orchestrated cyber operations with heavy credential harvesting. GTG-20006 (attribution "consistent with public reporting linking the actor to Midnight Blizzard"; Russian-speaking operator "JackPoterz") ran phishing, hotel-Wi-Fi DNS hijacking, ClickFix lures, WhatsApp account takeover, surveillance-camera token theft and credential-database theft (300,000+ national identity records; commercial registry of 500,000+ companies) against Ukrainian/European government, military, diplomatic and drone-supply-chain targets, using AI at every stage including autonomous malware re-tooling to evade detections. GTG-50014 (ShinyHunters-affiliated clusters; e.g., operator "frkoo"/"MeowSHA"/"blazespider" running a 10-worker AWS EC2 pipeline that mass-downloaded 1.8M Android APKs, decompiled and secret-scanned them with TruffleHog, plus a GitHub-Personal-Access-Token harvesting stream) completed multi-victim extortion breaches in hours, including SaaS supply-chain breaches reaching ~200 downstream customers and Azure AD session-store dumps spanning 40+ tenants; stolen AI API keys were reused as attack compute. GTG-50020 (Russian-speaking, financially motivated) prompt-injected an AI vendor's evaluation sandbox to steal production API keys, attacked ~30 AI companies in four days, and repeatedly attempted — and failed — to access a pre-release Claude model. GTG-50021 (Russian/Ukrainian-speaking "kl1zy") ran fraudulent "discounted Claude" resellers that silently proxied traffic to a different model while installing a credential harvester that stole Anthropic credentials.

The third thread: weapons, bioweapons, surveillance, influence. The report details operators in China, Russia and Yemen using Claude to develop software for conventional weapons (firearms, missiles, armed drones, bombs, targeting/control systems) and support weapons-programme intelligence/procurement; five cases of potential biological-weapons-support research (chikungunya, a highly pathogenic avian influenza strain, smallpox/mpox-family viruses, venoms/toxins — the actors were working scientists, not necessarily intending harm); surveillance systems including an Iranian actor's social-media-based identity identification system and a Malian national-security contractor's intelligence-gathering software; and at least nine influence operations involving Russia, China, Iran, Bangladesh and Kenya.

Same-week reaction: Alibaba, Moonshot, DeepSeek, Xiaomi and Anthropic did not immediately respond to CNBC's comment requests. China's Ministry of Foreign Affairs said it was unaware of the report and that AI "should be developed for good," opposing "distortion of facts and smears against the country." The report landed two days after the NSA/FBI/CISA joint advisory AA26-251A (8 Sep) independently warned about the same phenomenon.

• Before (early 2026): Anthropic's February report (23 Feb) named three labs (DeepSeek, Moonshot, MiniMax) using ~24,000 fraudulent accounts for 16M+ exchanges; a June 2026 letter to the US Senate Banking Committee accused Alibaba of a separate large campaign; CNBC reported (6 Jul) Alibaba banned employees from using Anthropic tools, citing "back-door security risks." The threat was framed mostly as structured bulk querying; the adversarial economy around it was opaque.
• Change (event, 10 Sep 2026): Anthropic published the largest, most detailed single-vendor account of AI misuse to date, escalating the distillation claim roughly 10× in volume (151M Alibaba exchanges alone; ~200M exchanges across campaigns vs 16M in Feb), expanding from 3 to 7 named labs, and documenting a genuinely new attack class: live customer-traffic rerouting through "transfer stations," CoT transcript harvesting via cross-session replay, and a resale market for harvested exchanges. In parallel it documented the maturation of AI-orchestrated cyber operations (autonomous malware re-tooling, credential-harvesting pipelines, a stolen-API-key economy) and new misuse categories (conventional weapons, bioweapons-support research, surveillance).
• After: The "AI supply chain" is now an explicit first-class attack surface: AI API keys and session tokens are described as loot, attack compute, and cover; Anthropic states it is moving from network-level detection toward behavioral analysis and response alteration ("subtly alter responses" for suspected distillation). The US government had independently validated the distillation threat two days earlier (AA26-251A); reporting within the week (Chosun English, 17 Sep) tied the report to an emerging US sanctions conversation on Chinese distillation practices. Named companies face lasting reputational/regulatory exposure; the "transfer station" gray market is now publicly documented end-to-end.

Illicit distillation at scale (the Claude side). Knowledge distillation is a legitimate technique — a "teacher" model's outputs train a "student" model. Illicit distillation weaponizes the pipeline:

1. Access via "transfer stations." Because Anthropic does not offer commercial access in China, labs route requests through gray-market proxy services ("transfer stations") that maintain thousands of accounts created with false identities, fake/stolen credit cards, and stolen API keys; traffic is laundered so no single account/identity is a detection point.
2. Harvesting value. The most valuable outputs are reasoning traces: chain-of-thought (CoT) transcripts. Targets: agentic capabilities, tool use, coding and data analysis, software engineering, kernel development, long-horizon tasks, logical reasoning.
3. Extraction techniques. Crafted prompts engineered to elicit CoT; cross-session replay attacks (replaying captured conversation state across sessions to harvest deeper reasoning transcripts); live-request rerouting (feeding real user conversations to Claude, then presenting Claude's answers as the lab's own — the Moonshot/DeepSeek/Xiaomi pattern); and purchasing harvested transcripts on the secondary market (SenseTime pattern).
4. Conversion into training data. Transcripts feed SFT/RL pipelines to train or improve Qwen (Alibaba), Kimi CoT models (Moonshot), DeepSeek, Zhipu, MiMo (Xiaomi), and for broader RL and model-architecture research.
5. Defense shift. Anthropic says detection increasingly relies on what is asked (behavioral fingerprinting, prompt-stream statistics) rather than who asks (account/IP), plus identity verification for abuse-signaling accounts and response alteration for suspected distillation attempts.

Credential harvesting (the cyber-operations side). The report's cases show industrialized pipelines: mass-downloading and decompiling Android APKs and secret-scanning them with TruffleHog, streaming verified findings to Telegram channels; harvesting GitHub Personal Access Tokens; phishing/ClickFix/hotel-Wi-Fi DNS hijacking for browser-credential and token theft; prompt-injecting AI-vendor evaluation sandboxes to exfiltrate production API keys; fake "discounted Claude" resellers installing device-level credential harvesters; and post-breach credential reuse plus session-token replay for lateral movement. Stolen AI API keys function as loot (resale value), compute (attack workloads at the victim's expense), and cover (attribution lands on the credential's legitimate owner).

• Industrial-scale capability transfer. If Anthropic's figures hold, Chinese labs harvested ~200M exchanges in months — enough synthetic training data to shortcut years of frontier training cost; the NSA/FBI/CISA advisory independently assesses that distillation is "the core—not merely a supplement—of their AI development strategy."
• The CoT is the crown jewel. Reasoning transcripts are the most proprietary output of frontier models; replay-based CoT harvesting attacks the exact layer where product differentiation now lives. Safeguard stripping is the stated risk: models distilled without guardrails can feed military, intelligence, surveillance and weapons systems.
• Consumers were exposed unknowingly. Moonshot/DeepSeek/Xiaomi allegedly routed live user conversations (including sensitive data — a CCTV surveillance-analysis request tied to the Chinese military; exchanges involving multinational companies and state-affiliated actors) to Claude without user knowledge — a data-governance and potentially legal event affecting users of Kimi, DeepSeek and MiMo.
• The AI supply chain is now an explicit attack surface. Compromised API keys fund attacker compute and camouflage attribution — directly relevant to every enterprise running agentic AI.
• Policy confluence. Two days before the report, three US agencies issued their own warning naming overlapping companies; within a week a sanctions conversation had attached to distillation. The report supplies a vendor-side evidentiary foundation for US policymakers; Beijing has publicly rejected it as distortion/smear.

• For adversarial AI labs: near-frontier capabilities (reasoning, coding, agentic/tool use) transferable in weeks-to-months at a fraction of the training cost, bypassing chip export controls via data rather than compute.
• For cyber criminals: multi-victim campaigns that "would have required teams of operators" a year ago now run by individuals on agentic frameworks; breaches completing in 2–3 hours; autonomous malware that re-tools itself when detected.
• For espionage operators: AI-driven operations with humans as occasional overseers — automated infrastructure setup, phishing, credential harvesting, exfiltration, and persistence management with AI at every stage.
• For defenders (positive): 209 published indicators, case-study TTPs, and an explicit "behavioral detection + response alteration" playbook give enterprises concrete detection content the same week a government advisory echoed similar mitigations.

1. Will any of the seven named labs (Alibaba, Moonshot, DeepSeek, Z.ai, Xiaomi, SenseTime, MiniMax) respond substantively, and can any independently refute the specific campaign metrics?
2. Do OpenAI, Google and xAI hold matching telemetry for the same campaigns (the AA26-251A advisory attributes extraction from Claude, GPT, Gemini and Grok variants — whose numbers will surface next)?
3. What actual capability uplift did the harvested CoT transcripts deliver to Qwen, Kimi, DeepSeek R-series, MiMo and Zhipu models — and can it be measured independently (e.g., benchmark deltas before/after)?
4. Will the "likely with Chinese government awareness" assessment (AA26-251A) be followed by enforcement — sanctions, export-control amendments covering API outputs, or prosecutions?
5. How will transfer-station operators respond to the report's exposure — fragmentation, relocation, or deeper obfuscation (noise injection against behavioral detection)?
6. What will Anthropic's new replay defenses and response-alteration methods look like, and will they impose measurable fidelity costs on legitimate users?
7. Which Chinese consumers were affected by live-request rerouting, what data reached Anthropic, and will any regulator require notification or redress?
8. Was the "closest-to-military" observed request — the CCTV surveillance assessment routed through Moonshot — an isolated case or evidence of systematic state-service usage of the distillation pipelines?

• Named labs respond (or don't): expect either formal denials/rebuttals (Beijing's line: "neutral technology," "smears") or continued silence; substantively refuting 151M-exchanges telemetry is technically difficult without access to Anthropic's detection systems.
• Other frontier labs publish: OpenAI, Google and xAI face pressure to release matching telemetry (the advisory says GPT, Gemini and Grok variants were also targeted); a composite industry figure may emerge.
• US policy action: the sanctions conversation reported by Chosun English (17 Sep) plus the AA26-251A advisory point toward export-control amendments or targeted sanctions on distillation-enabled practices within weeks-to-months; Senate committees already hold Anthropic's June letter.
• Adversary adaptation: transfer stations will fragment and obfuscate; labs will inject noise into query streams to defeat behavioral detection; cross-session replay defenses will be tested immediately.
• Anthropic's defense rollout: new replay-resistant session handling, CoT hardening and response-alteration measures will ship incrementally; watch for model-level safeguard differences (Fable/Mythos vs Opus/Sonnet) to widen as the weakest-model dynamic plays out.
• Consumer/regulatory fallout: the rerouted-traffic disclosures may trigger consumer-protection review in the EU/Korea/Japan (where the proxy accounts were concentrated) and transparency requirements for chatbot data processing.

The September 2026 Anthropic threat report is less a single story than a status update on a war's second year: frontier AI has simultaneously become the most valuable theft target, the most effective theft tool, and the infrastructure both sides fight over. The headline numbers (151M exchanges; seven labs; CoT transcripts harvested through users' own conversations) are shocking and — pending independent verification — still allegations, which is exactly why this story rewarded discipline: the report's existence and content are FACT; its attributions are COMPANY CLAIM where they name labs and actors, INDEPENDENT EVIDENCE where the NSA/FBI/CISA advisory and Microsoft's CaptiveCrunch independently converge, and INTERPRETATION where we infer what it means. For readers, the actionable takeaways are concrete regardless of which attribution survives scrutiny: AI credentials are now production secrets; agent integrations are attack surface; and any chatbot that secretly routes your words to another model is a data-governance event waiting to be audited. The deeper editorial point: when a vendor's threat report and a three-agency government advisory land within 48 hours naming the same companies, the "AI race" narrative has formally acquired a theft-and-countermeasures chapter — and neither side's framing should be mistaken for neutral history.