Anthropic accuses three rival labs of extracting 16 million Claude exchanges through fake accounts

Divide the alleged volume by the alleged accounts and the average account produced about 667 exchanges ^[16]. That is a modest figure for a single account. The pattern Anthropic describes becomes visible only above the account level. It shows up by correlating IP ranges, request metadata and infrastructure indicators across thousands of accounts, and in some cases by comparing notes with industry partners who saw the same actors on their own platforms ^[4].

Anthropic puts the DeepSeek campaign at more than 150,000 exchanges ^[6], under 1 percent of the 16 million it alleges in total ^[17]. That leaves roughly 15.8 million exchanges inside the Moonshot and MiniMax campaigns ^[18]. The DeepSeek detail is the specific part of the account. The prompts, Anthropic said, asked Claude to imagine and articulate the internal reasoning behind a completed response and write it out step by step, producing chain-of-thought training data at scale ^[9]. Rubric-based grading tasks, according to the same post, "made Claude function as a reward model for reinforcement learning" ^[7]. Accounts shared payment methods and ran on coordinated timing, which Anthropic described as load balancing to increase throughput and avoid detection ^[8].

Anthropic wrote that it "has consistently supported export controls to help maintain America's lead in AI" ^[13]. It uses this finding to argue that restricted chip access limits both direct model training and the scale of illicit distillation ^[14]. The company is accuser and evidence custodian, and it has an interest in the policy inference. Its account does not include a response from DeepSeek, Moonshot or MiniMax ^[19]. What makes the claim testable is that other vendors hold the same class of logs, and Anthropic said some partners had already observed the same actors and behaviors ^[4].

The detection signals are what buyers should read against their own usage. Anthropic said the campaigns used fraudulent accounts and proxy services, and that the volume, structure and focus of the prompts differed from normal patterns ^[10]. Those descriptors also fit legitimate deployments: a reseller pooling keys under one payment instrument, or an evaluation harness firing structured prompts at high volume from one address range. The violations cited are terms of service and regional access restrictions ^[2], both contract terms.

This quarter the change is contractual and detection-side. Vendors tighten account provenance, and the customers who resemble an extraction ring by accident absorb the friction of proving they are not one. Whether illicit distillation acquires a legal definition is a question of years. Anthropic wrote that "the window to act is narrow, and the threat extends beyond any single company or region" ^[11]. Addressing it, the company said, "will require rapid, coordinated action among industry players, policymakers, and the global AI community" ^[12].