The Attack: What Actually Happened
On February 23, Anthropic publicly accused three Chinese AI laboratories—DeepSeek, Moonshot AI, and MiniMax—of running coordinated "distillation attacks" against its Claude models. The mechanism: over 24,000 fraudulent accounts generated more than 16 million exchanges with Claude, all engineered to extract its capabilities for training rival models.
Distillation, to be clear, is not exotic. Every major AI lab does it internally—training smaller, cheaper models on a larger one's outputs. What Anthropic alleges is the cross-company version: systematic, large-scale prompt engineering designed to clone a competitor's intelligence at a fraction of the development cost.
The forensics are alledgely solid. Anthropic traced MiniMax's 13 million prompts using infrastructure metadata and confirmed the timing against MiniMax's own public product roadmap. The decisive detail: when Anthropic released a new Claude model mid-campaign, MiniMax pivoted within 24 hours, redirecting nearly half its traffic to the newer system. Moonshot AI ran 3.4 million exchanges targeting agentic reasoning and computer vision. DeepSeek, smallest in scale at 150,000 exchanges, deployed the most methodologically sophisticated techniques—prompting Claude to generate its own chain-of-thought training data, and producing censorship-safe alternatives to politically sensitive queries to train its own models toward ideological compliance.
Attribution relied on IP correlation, request metadata, and corroboration from unnamed industry partners. None of the three labs have responded publicly.
The Hypocrisy Problem Anthropic Cannot Escape
Here is where the press release, however factually solid, becomes a strategic liability.
Anthropic recently settled a major copyright lawsuit—reportedly a $1.5 billion agreement—over the use of pirated books in its training data. The court's nuanced ruling: training itself may constitute fair use, but acquiring that data through piracy was wrongful. That distinction, legally meaningful, is politically invisible. The internet correctly noted the irony: a company that ingested the internet's collective output without asking is now outraged that its own output is being ingested.
The sharpest public rejoinder—"they gathered all the information we generated, and now they're complaining about being redistributed"—is rhetorically unfair but emotionally devastating. Anthropic's brand is built on safety, legitimacy, and governance. That brand absorbs shrapnel from every hypocrisy headline, regardless of legal precision.
To be precise about the Chinese labs: what they allegedly did is a terms-of-service violation and regional access circumvention—not copyright infringement in any traditional sense. AI outputs are not copyrighted like human art. The legal architecture Anthropic is implicitly invoking does not yet clearly exist.
The National Security Frame: Shrewd Politics, Questionable Economics
Anthropic's CEO Dario Amodei has been explicit: this is a democratic-vs-CCP issue, and export controls must be tightened. The company argues that distilled models lack safety guardrails—Constitutional AI, bioweapon refusals, cyber-operation restrictions—meaning adversarial actors could access frontier capabilities stripped of protections.
This framing is strategically rational. It repositions Anthropic from "company complaining about competition" to "defender of Western AI security infrastructure," strengthening ties with US policymakers and defense-adjacent buyers. OpenAI has echoed similar claims to lawmakers, suggesting coordinated narrative management across the US AI industry.
But here is the sharpest critique: Anthropic may be inadvertently advertising how close its rivals have gotten. If Chinese labs can clone your most differentiated capabilities—agentic coding, tool use, reasoning traces—within weeks of a model launch, the national security argument and the competitive moat argument are in direct tension. You cannot simultaneously claim Chinese labs are dangerous near-peers and that your lead is durable.
The Only Number That Matters: $380 Billion
Anthropic's post-money valuation after its $30 billion Series G prices in prolonged frontier advantage and durable pricing power. This episode quietly destabilizes both assumptions.
The MiniMax pivot—half their traffic redirected to a new Claude model within 24 hours of release—implies a shrinking commercialization window on every frontier launch. If the capability half-life of a new model is weeks rather than quarters, the economics become brutal: massive capex to train, minimal time to monetize before distillation closes the gap.
The real moat, investors should now conclude, is no longer the model itself. It is enterprise trust, workflow lock-in, compliance certification, distribution partnerships, and proprietary customer data loops. That is a fundamentally different investment thesis than "best model wins"—and a significantly harder one to justify at $380 billion.
Watch three signals: whether Anthropic shifts pricing from tokens to enterprise seats; whether API access becomes meaningfully harder to obtain; and whether enterprise customers demonstrably stay on Claude for production workloads despite cheaper open-weight alternatives from the very labs accused here.
The distillation attack is real. The national security risk is plausible. But Anthropic chose to litigate this in the press—from a glass house, with a $1.5 billion settlement still fresh—and that choice costs credibility with the audiences that determine whether its valuation holds. The Chinese labs, meanwhile, said nothing. In the court of strategic communication, silence from the accused and noise from the accuser is rarely a winning asymmetry.
not investment advice