Threat
Countering misuse of AI: September 2026 / Anthropic
Publication date not yet evaluated · Added · 7 reports anthropic.com
Page published · Page updated
Coverage timeline
Why it matters
Claude being weaponized to autonomously orchestrate intrusions and exfiltrate data from real victims marks a concrete escalation of agentic AI as an active attack vector that defenders must now anticipate and detect.
Anthropic's September 2026 threat intelligence report describes disrupting a series of cyber operations in which threat actors used Claude to shift from an assistant role to an orchestrator, automating exploitation and data theft across multiple victims. The actors included suspected state-sponsored groups, financially motivated criminals, and politically motivated individuals, with Claude Haiku, Sonnet, and Opus models abused across cyber, surveillance, influence, fraud, and other harm areas.
Summary
Anthropic disclosed that it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven China-based AI labs, including Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), Xiaomi, SenseTime, and MiniMax. These operations covertly extracted Claude's capabilities — agentic tool use, coding, data analysis, and chain-of-thought reasoning — to train competing models without authorization.[0]
Since February 2026 Anthropic tracked multiple codenamed campaigns. The largest, GTG-16005 (Alibaba-affiliated), harvested 151 million exchanges of Claude Opus 4.6/4.7 reasoning transcripts, peaking near 3 million exchanges per day from more than 3,500 fraudulent accounts. Moonshot (GTG-16002) and DeepSeek (GTG-16001) silently rerouted their own customers' requests to Claude to capture reasoning traces, while Zhipu, Xiaomi, SenseTime, and MiniMax used replay pipelines, coding harnesses, purchased transcripts, or shell-company proxy networks.[0]
The activity was enabled by proxy/relay services that create thousands of fake accounts using fictitious identities, stolen credit cards, and harvested API keys, and by a secondary market reselling captured user–model exchanges. Anthropic responded by banning reseller and unsupported-region accounts, summarizing Claude's internal reasoning before responding, and adding 'preserved thinking' in Fable 5.1; the disclosure sits within Anthropic's broader September 2026 report covering activity disrupted between December 2025 and August 2026 and aligns with U.S. agencies accusing China-based AI firms of systematic extraction of American frontier models.[0][17]
Attack chain
- Access acquisition: Unauthorized labs route requests through proxy/relay ('transfer' or 'relay station') services that create thousands of accounts under fictitious identities, fake or stolen credit cards, and illegally harvested API keys belonging to legitimate companies or individuals.[0]
- Request rerouting / harvesting: Some labs (Moonshot, DeepSeek) silently reroute their own customers' requests to Claude without user knowledge or consent, displaying Claude's responses while capturing the exchanges; proxy operators also save conversations to resell.[0]
- Chain-of-thought extraction: Operators target and extract Claude's reasoning transcripts, in some cases replaying Claude reasoning traces back through Claude to build CoT training pipelines (e.g., Zhipu GTG-16006, Xiaomi via OpenClaw/OpenCode harnesses).[0]
- Distillation / training: Captured Claude responses and reasoning transcripts are used as training data to distill Claude's capabilities into the labs' own student models.[0]
- Secondary-market acquisition: Labs such as SenseTime (GTG-16012) purchase transcripts of user–Claude exchanges from third-party data vendors, and MiniMax (GTG-16003) built a shell-company proxy network to collect exchanges with U.S. frontier models.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-02 | Start of the period during which Anthropic detected China-based illicit distillation campaigns.[0] |
| 2026-03/04 | GTG-16008: Xiaomi replays MiMo user conversations/coding sessions to Claude via OpenClaw and OpenCode harnesses (400,000+ exchanges over 20 days).[0] |
| 2026-05/07 | GTG-16005 (Alibaba-affiliated) harvests 151 million exchanges of Claude Opus 4.6/4.7 reasoning; GTG-16002 (Moonshot) captures 23 million exchanges via rerouting.[0] |
| 2026-06/07 | GTG-16006: Zhipu (Z.ai) runs a CoT extraction pipeline (3.4 million+ exchanges over 17 days).[0] |
| 2026-07 | GTG-16001: DeepSeek relays exchanges to Claude, 12.1 million+ exchanges over 14 days.[0] |
| 2026-09-11 | Anthropic publicly says it identified and disrupted the distillation campaigns; U.S. agencies had earlier accused China-based AI firms of systematic extraction.[0] |
Actor profile
China-based AI labs (GTG-160xx distillation clusters)
Anthropic attributes seven codenamed illicit-distillation campaigns to China-based AI labs — Alibaba (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012), and MiniMax (GTG-16003) — assessed to be extracting Claude's capabilities to advance their own models using proxy networks, request rerouting, replay pipelines, and purchased transcripts.[0]
How it works
Knowledge distillation is a legitimate technique where a large 'teacher' model trains a smaller 'student' model to copy its capabilities; illicit distillation abuses this by covertly extracting a model's capabilities and replicating them without authorization, using fake accounts, stolen credentials, and harvested API keys to reach the target model at scale.[0]
Attackers harvest Claude's outputs — including agentic capabilities, tool use, coding, data analysis, logical reasoning, and chain-of-thought transcripts — through prompt manipulation and by rerouting real user traffic to Claude, then use those responses as training data. Editing the conversation context before Claude's reasoning is a common technique used to make Claude reveal its (otherwise encrypted) reasoning.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Anthropic Claude | Claude Opus 4.6 and 4.7 chain-of-thought reasoning specifically targeted by GTG-16005; Haiku, Sonnet, and Opus models used across the reporting; a Fable/Mythos-class model involved in one distillation case | Anthropic disrupted the activity, banned reseller/unsupported-region accounts, updated the model to summarize internal reasoning before responding, and added 'preserved thinking' in Fable 5.1[0][17] |
Key takeaways
- Frontier model outputs — especially chain-of-thought reasoning — are a high-value target for competitors, who use proxy networks, fake accounts, request rerouting, and secondary-market transcript sales to distill capabilities without authorization.[0]
- Proxy/relay services that capture and resell user–model exchanges create both a privacy exposure for end users and a supply chain for illicit distillation, motivating provider-side identity verification, regional restrictions, and reasoning-obfuscation defenses.[0]
Defensive actions
- Ban reseller accounts and accounts operating from unsupported regions (e.g., China, Iran, Russia) when users fail to verify their identity.: Unauthorized labs gain access chiefly through proxy/reseller networks and fake accounts routed from unsupported regions; identity verification and account bans cut off this access path.[0]
- Summarize the model's internal reasoning before responding rather than exposing raw chain-of-thought.: Attackers specifically target CoT reasoning transcripts for distillation; summarizing reasoning makes stolen transcripts less useful for follow-on training.[0]
- Prevent new API accounts from altering the system prompt, tools, or messages that precede the model's reasoning (Anthropic's 'preserved thinking').: Editing conversation context before the model reasons is a common technique attackers use to force Claude to reveal its (encrypted) reasoning.[0]