Seven PRC Labs Ran 190 Million Exchanges Against Claude to Copy Its Reasoning. That Is Tokentheft at Industrial Scale, and the Detector Anthropic Describes Is the One We Named: Shape, Not Volume.
Two weeks ago we named a category: tokentheft, theft whose objective is metered inference capacity rather than the data behind it. The examples then were a research non-profit that lost about $600,000 of inference to someone who asked its agent for the API key, and infostealers replaying session cookies. Small operators, stolen credentials, a monthly invoice as the only sensor. On September 11 Anthropic published the version of this story that has a nation's AI industry on the other end of it.
Anthropic's September threat intelligence report attributes, with what it calls high confidence, unauthorized distillation campaigns to seven PRC-based labs: Alibaba's Qwen and Tongyi Lab (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu, sold abroad as Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012) and MiniMax (GTG-16003). The Hacker News carried the summary the same day. Everything below with a number attached is Anthropic's; the framing is ours.
The numbers, in Anthropic's own units
Alibaba: over 151 million exchanges between May and July 2026, peaking at nearly 3 million a day from more than 3,500 fraudulent accounts, targeting the chain-of-thought transcripts of Opus 4.6 and 4.7 for supervised fine-tuning of Qwen 3.5, 3.6 and 3.7. Anthropic calls it the largest distillation attack it has ever measured. A first pool of nearly 5,000 accounts used residential proxies, disposable email and virtual cards; when that pool was banned, traffic moved to a second pool within days, and some of those accounts were also carrying requests for DeepSeek and Xiaomi.
Moonshot: over 23 million exchanges in the same window through 5,380 fraudulent accounts, mostly presenting from Singapore and Japan. The part that matters more than the count: Moonshot silently forwarded its own customers' Kimi requests to Claude and served Claude's answers back as Kimi. In one ten-day span, almost 300,000 customer requests were relayed this way, most to Opus. Those customers included a user Anthropic assesses as PLA-affiliated running CCTV analysis on a single tracked individual across hundreds of Chengdu cameras, and an engineer at a major state-owned enterprise pasting live credentials for several large PRC technology companies. None of them knew their prompts had left Moonshot.
DeepSeek: over 12.1 million exchanges in 14 days of July. Same relay pattern, with a twist: DeepSeek string-matched inbound requests for third-party coding harnesses, Claude Code, the Claude Agent SDK, OpenCode, and selectively relayed those users to Opus. Relayed traffic included a flagship AI program's full specifications from a PRC technology company, live credentials for a Russian Ministry of Defense-associated database, and a municipal Public Security Bureau case-management tool that compares a citizen's movements against police records by national ID.
Zhipu: over 3.4 million exchanges across 17 days in June and July, rotating 273 fraudulent accounts against Opus 4.8; 770,609 of those exchanges went through a pipeline that replayed captured Claude reasoning back through Claude to clean it for GLM training. Zhipu first targeted Fable's cyber capabilities, found the safeguards degraded the attack, and, per Anthropic, moved to Opus 4.6 and another US lab's top model expressly because they judged those safeguards weaker.
Xiaomi: over 400,000 requests across more than 1,500 accounts over 20 days in March and April, replaying its own MiMo users' sessions, many arriving via OpenClaw and OpenCode and third-party model routers popular in the US and Europe, through Claude to manufacture SFT and RL data. Anthropic suggests the MiMo-V2-Pro free trial, and its extension, were timed to generate the sessions that were then distilled.
SenseTime bought transcripts of user-Claude exchanges from third-party data vendors, harvested by intermediaries that logged and resold them. MiniMax built a proxy service through a shell company with no disclosed link to its parent, offering access only to Anthropic and OpenAI models, none of MiniMax's own. Neither of those two has an exchange count, because the theft happened one step removed from Anthropic's meter.
Why this is the same category as a $600,000 API key
The METR case and the Alibaba case look nothing alike in scale and everything alike in structure. In both, the objective is inference, not data. In both, the access is a valid credential making well-formed requests, so identity, DLP and EDR see nothing wrong. In both, the bill is the sensor. The difference is who paid it: METR paid with credits it had been granted; Anthropic paid in compute it never billed, because the cards were stolen or virtual and the accounts were fraudulent by construction.
That is tokentheft at scale, and it explains why the relay cases are the ugliest part of the report. When Moonshot and DeepSeek forward a customer's prompt to Claude, the customer is not a victim of Anthropic; the customer is the raw material. Their prompts, their credentials and their state's surveillance data were shipped to a US provider without their knowledge because the lab wanted Claude's answer to that specific prompt for its training set. The resale layer, SenseTime buying transcripts and MiniMax running a shell proxy, is the secondary market we predicted in the first tokentheft post: one stolen unit of inference, monetized onward.
The detector is shape, and Anthropic says so
Read what Anthropic says it actually did. It did not catch Alibaba on volume; 3 million exchanges a day spread over 3,500 accounts is under a thousand per account per day, well inside what a busy developer team looks like. It says it used metadata and irregular-activity signals to identify accounts belonging to proxy networks, then attributed the whole network to an organization and banned it as a unit rather than key by key, and it built classifiers for adversarial extraction, the request shape that a distillation pipeline produces and a human never does: a fixed injected prompt forcing inline reasoning tags on every call, a reasoning signature from one session replayed into a fresh session to be decoded, the same task distribution thousands of times.
That is the detectability law we stated two weeks ago, now with the largest possible worked example. Your AI spend is only monitorable if you know the shape of your normal. Our chart above makes the point with Anthropic's own numbers: on volume, Alibaba is the story and everyone else is a rounding error. On per-account rate, Alibaba and Zhipu are the same animal, a pipeline, and Moonshot's 5,380 accounts at roughly 46 exchanges a day each are indistinguishable from real customers, which is exactly why a relay attack is the hard one. You do not catch a relay on rate. You catch it on the fact that a Singapore account's prompts contain Chengdu CCTV telemetry and PLA facility camera IDs.
The two mitigations Anthropic shipped are both shape defenses, not volume caps. Claude now summarizes its internal reasoning before answering, which makes a harvested transcript worth less as training data. And preserved thinking in Fable 5.1 stops a new API account from editing the system prompt, tools or prior messages ahead of the model's reasoning in a multi-turn conversation, which closes the cross-session replay trick Moonshot and DeepSeek used to turn an encrypted reasoning signature back into text. We wrote about that signature layer in August, when researchers decoded 315,320 supposedly encrypted reasoning blocks and pulled credentials out of them; the two stories are the same seam viewed from two sides.
What a small team can actually instrument
Most of our readers are not Anthropic. They are the METR-shaped org: a handful of keys, spiky usage, no spend caps, and the quota that makes them a target is the same thing that makes their normal illegible. Here is what transfers.
Per-key, per-day rate of change, not absolute volume. A key that goes from 40 calls a day to 700 is the Zhipu shape regardless of what your total looks like. Alert on the derivative.
Prompt-prefix cardinality. A distillation pipeline injects the same instruction into every request. If one key's requests share a fixed leading string thousands of times, that is a pipeline, and if you did not write it, it is someone else's.
Harness fingerprints in the wrong place. DeepSeek selected victims by string-matching Claude Code and OpenCode signatures. Those same strings, seen on a key that is supposed to be a chat product, mean your traffic is being relayed from somewhere.
Reasoning-signature replay. If your integration ever sends a thinking signature from one conversation into a different one, that is the exact primitive two of these labs abused. Do not do it, and log it if a downstream partner does.
Geography that disagrees with the contract. Anthropic's enforcement lever was identity verification for unsupported regions and reseller bans. Yours is smaller but the same: if a key you issued to a US team presents from Singapore residential proxies, that is not a VPN, that is the first pool.
We should disclose an interest. We have paying relationships in on-premises AI infrastructure, and this story is worth money to that argument, because distillation is a disease of metered inference: on your own hardware there is no meter to steal from. It does not make you immune. An intruder on owned GPUs still runs jobs and you pay in throughput, and a relay attack against a model you host does not need Anthropic's meter at all. It changes the denomination of the loss, not the existence of it.
What we are not saying
We are not saying we saw this first. Anthropic measured it on its own infrastructure and no external party could have. Our contribution is the category name, the two-week-old detectability law that this report confirms at nine orders of magnitude above our first example, and the shape chart above, which is derived arithmetic on Anthropic's published counts and rounds accordingly.
The report names no network indicators for any of the seven campaigns: no proxy-service domains, no IP ranges, no reseller names, no shell-company name for MiniMax. There is nothing here to ingest into the feed, and we are saying so explicitly rather than laundering a lab name into an indicator. The account pools are Anthropic's to attribute and they have. If proxy-network infrastructure is published later, it goes into the feed under a campaign source with the actor GTG identifiers attached and we will say when it landed.
The Sunday post on Anthropic's cyber cases, ShinyHunters as the operator and the 1.8 million Android apps, covers the same report's other half. The fake Claude installer cluster we found in July is the same market from the other end: if you cannot get Claude's capability, sell someone a download that says Claude on it. Read those two alongside this one and the picture is complete: the capability is the asset, and every layer between a user and the model is now a place someone is standing with a bucket.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=seven-prc-labs-ran-190-million-exchanges-against-claude-to-copy-its-reasoning-that-is-tokentheft-at
Comments