Anthropic releases detailed threat intelligence report
This report provides concrete evidence of how Chinese AI companies are using Claude Opus to mimic their own models, potentially stealing user data and training their own models, which is relevant for anyone concerned about AI model security and intellectual property.
Anthropic's 154-page report highlights 'illegal distillation' by Chinese AI teams, with 'China' mentioned over 100 times.
It details how models like Haiku, Sonnet, and Opus were abused, while newer models like Fable and Mythos were not.
The report also claims that Anthropic's own models were not successfully abused, attributing this to stronger security.
It specifically names Qwen 3.5/3.
6/3.7 as a target for illegal distillation, with 150 million interactions and 3,500+ fraudulent accounts.
The report accuses companies like Ali, Moonshot, and DeepSeek of using Claude Opus to mimic their own models, sharing the same proxy infrastructure, and stealing user data for training.
A 社发布迄今最详细的威胁情报报告 154 页原始报告中，“中国” 出现了 100+ 次，中国 AI 团队 “非法蒸馏” 再次被重点 “投诉” 😂 展开 “非法蒸馏” 之前，A 社也为自己模型安全再次叫卖： 被滥用的模型为 Haiku / Sonnet / Opus；报告特别指出，新一代模型（Fable、Mythos 系列）除一起蒸馏事件外未被成功滥用，并将此归功于更强的安全防护 ？！ anthropic.com/threat-intelli… c # Qwen：史上最大规模，且不止于蒸馏 累计 1.5 亿次、峰值每天近 300 万次交互、3500+ 欺诈账户。目标是 Opus 4.6/4.7 的思维链，聚焦智能体任务、软件工程、内核开发、长程任务，产物直接用于训练 Qwen 3.5/3.6/3.7。 更值得注意的是第二个层面：阿里还用 Claude 做自家 AI 研发——强化学习环境和模型架构研究。 账户组织上，阿里维护了两个账户池（近 5000 个账户，住宅代理+一次性邮箱+虚拟卡）；第一个池被封禁后迅速切换到第二个池，而该池同时也在为 DeepSeek 和小米输送流量——三家共用同一批代理网络基础设施。 # 月之暗面与 DeepSeek：最惊人的指控——“用 Claude 冒充自家模型” 这两家的手法在报告中最为震撼：用户以为自己在使用 Kimi 或 DeepSeek，实际响应来自 Claude Opus，而公司同时保存这些交互用作训练数据。 · 月之暗面：10天内转发近 30 万次用户请求，5380 个欺诈账户（多位于新加坡和日本）；还攻破了 Anthropic 的“思维签名”防护——保存 Claude 返回的签名引用，新开一个会话诱导 Claude 把签名还原成完整推理痕迹（跨会话重放攻击）。 · DeepSeek：更精细，检测请求中的特征字符串，专门标记使用 Claude Code、Agent SDK、OpenCode 等编码框架的用户，被标记者的请求转发给 Opus。这实际是在筛选高质量编码流量来收割。 被转发的用户数据本身就构成隐私事件。报告点名了三类： · 一名疑与 jfj 相关的用户提交了成都数百个摄像头（含 PLA 设施、中国电科所属研究院外）对某特定个人的监控分析请求； · 某国企工程师在 Kimi 中暴露多家知名科技公司内部代码和实时凭据； · DeepSeek 侧则包括某 PRC 科技公司旗舰 AI 项目的完整规格与组织架构、俄罗斯国防部关联机构的数据库实时凭据、某市公安局面向公民身份证号的轨迹比对系统。 # 智谱：工程化最深，且直接冲着网络攻击能力来 智谱的独特之处是把 Claude 用作训练流水线的自我改进工具：10天内轮换 273 个账户，77 万次交互专门用于“清洗”推理痕迹，另有 300 万次用于评分、过滤训练数据、编写任务和测试。 最关键的是 GLM 5.3 发布前的行动：智谱用公开漏洞库搭建 CTF 题目，对另一家美国头部实验室的旗舰模型发起蒸馏攻击，同时用 Claude Opus 4.6 来给对方模型的回答评分。它先尝试攻击 Anthropic 的 Fable 模型，因其网络安全防护太强而放弃——报告称观察到智谱员工明确因为评估 Opus 和另一家美国实验室的防护更弱而转向。 # 小米：免费试用作为收割策略 报告的推断相当尖锐：MiMo-V2-Pro 的免费试用期（后被延长）可能有意吸引国际开发者使用，以便将其会话作为蒸馏素材——对 Claude 的大规模蒸馏恰好在试用期结束时开始。40 万次请求中包含十几种语言、数百名用户的姓名、联系方式和企业数据。 Anthropic @AnthropicAI We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies. These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve. We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop. Read the report: anthropic.com/threat-intelli… 🔗 View Quoted Tweet📊 1 ⚡
This report is categorized under AITOP's "Models" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to US-China foundation model benchmarks and commercialization comparison and AI regulation, compliance frameworks, and sovereign compute policy. Key entities and technical topics under continuous tracking include Anthropic, Claude, AI safety.
Source attribution: curated from shao__meng (@shao__meng). Cross-source corroboration: 11 independent sources have covered this development (including Geek, Anthropic, The Rundown AI), confirming industry-wide signal strength.
