Summary: Anthropic disclosed on February 23, 2026 that it had detected distillation campaigns by DeepSeek, Moonshot, and MiniMax using more than 16 million exchanges across roughly 24,000 fraudulent accounts. The company says it is applying classifiers and behavioral fingerprinting, tightening some verification, and sharing indicators with other labs, cloud providers, and authorities. Legitimate high-volume users may face closer monitoring or more verification because coordinated capability extraction changes API risk models.
Your API traffic is now a place where capability extraction happens. That is the shift behind Anthropic’s February 23, 2026 disclosure of distillation attacks by DeepSeek, Moonshot, and MiniMax — coordinated campaigns that pull reasoning, coding, and agentic skills out of a model at industrial scale, and that change what the defenses mean for people who are using the API legitimately.
The Attack Pattern Is Volume Plus Focus
Distillation is an ordinary training technique. Labs distill their own models into smaller, cheaper versions all the time. What Anthropic describes is a different thing altogether. The three campaigns together produced over 16 million exchanges through roughly 24,000 fraudulent accounts, leaning on proxy services and hydra-cluster architectures that spread the traffic across the API and third-party cloud platforms. One proxy network held more than 20,000 fraudulent accounts at once, blending distillation traffic with unrelated customer requests so that the signal would not stand out.
No single prompt gives a campaign away. The pattern does: tens of thousands of variations aimed at the same narrow capability, arriving from hundreds of coordinated accounts. Take the prompt Anthropic uses as its example — “You are an expert data analyst combining statistical rigor with deep domain knowledge.” On its own it looks benign. Repeat it at scale, with synchronized timing and shared payment methods, and it becomes a fingerprint.
What the Attackers Were After
Each lab went after a Claude capability that was hardest to match elsewhere. DeepSeek aimed at reasoning and rubric-based grading, and some of its prompts asked Claude to articulate the internal reasoning behind a completed response — in effect producing chain-of-thought training data. Moonshot targeted agentic reasoning, tool use, and computer-use development, and its campaign ran past 3.4 million exchanges. MiniMax ran the largest of the three, over 13 million exchanges, focused on agentic coding and orchestration.
Anthropic caught the MiniMax campaign while it was still active, before the model being trained had been released. When Anthropic shipped a new model during the campaign, MiniMax pivoted inside 24 hours, redirecting close to half its traffic to the new system. That responsiveness is the part builders should internalize: distillation campaigns adapt to model releases in real time.
Why This Matters for Your Product
The national security framing is a real one — Anthropic argues that illicitly distilled models lose the safeguards built into the original, which lets dangerous capabilities proliferate. Product teams have a practical stake as well. When your application depends on a frontier model’s reasoning or coding quality, distillation attacks warp the competition: a lab can copy those capabilities for a fraction of the cost and time, then undercut you with a model that carries fewer protections.
On its own side, Anthropic is using classifiers and behavioral fingerprinting to catch chain-of-thought elicitation and coordinated account activity. It has also tightened verification for educational accounts, security research programs, and startup organizations — the paths most often exploited to create fraudulent accounts. Alongside that, it is building product-, API-, and model-level safeguards meant to reduce how useful outputs are for illicit distillation without degrading legitimate use.
What Builders Should Watch
Anthropic is passing technical indicators to other AI labs, cloud providers, and authorities. The practical consequence is that detection signals can travel across platforms, and access controls may tighten for exactly the account types attackers abuse. Anyone on educational or startup-tier access should expect more verification friction.
The broader lesson connects to a theme we’ve covered before: choosing a structured data extraction tool for AI agents in 2026 comes down to understanding how your traffic patterns look to the model provider. Legitimate high-volume use can resemble an attack when it concentrates on one narrow capability. If you run large-scale reasoning or coding workloads, monitor your own request patterns and be ready to explain them.
Anthropic says plainly that no single company can solve this, and that the disclosure is meant to make evidence available to everyone with a stake in the outcome. For product builders, it means the cost of using frontier models now carries an extra variable: your traffic is being watched for signs of extraction, and the defenses around it will keep evolving.