Anthropic has detailed what it describes as distillation campaigns aimed at its own models by three Chinese AI labs, and the DeepSeek distillation claims sit at the centre of the disclosure. TechCrunch reports that Anthropic named Alibaba, Moonshot AI and DeepSeek in its account of the activity, while Quartz frames the same disclosure more bluntly, reporting that Anthropic is accusing Chinese AI labs of illicit distillation attacks. For developers weighing frontier API models against cheaper open-weight alternatives, this is less a security story than a provenance story — and provenance is now a procurement question.
Key takeaways
- Anthropic has named Alibaba, Moonshot AI and DeepSeek in a disclosure about distillation campaigns targeting its models, according to TechCrunch.
- Quartz reports Anthropic is characterising the activity as illicit distillation attacks rather than ordinary competitive benchmarking.
- The Guardian reports the same round of disclosures also covers bad actors’ attempts to misuse Anthropic’s AI for bioweapons work. None of the reports link those attempts to the named labs.
- The published snippets carry no volumes, dates, account counts or technical method, so the scale of the alleged campaigns should be treated as unquantified.
- The commercial backdrop is stark: Convly lists DeepSeek V4-Pro at $0.435 in / $0.87 out per 1M tokens against Claude Opus 5 at $5.00 in / $25.00 out — roughly an order of magnitude apart.
- For most teams, exposure here is contractual rather than technical: provider terms generally prohibit using model outputs to train competing systems.
What Anthropic Says About the DeepSeek Distillation Claims
The reported substance is narrow but pointed. TechCrunch’s account is that Anthropic has set out details of distillation campaigns originating from Alibaba, Moonshot AI and DeepSeek — three of the most visible developers of competitively priced frontier and open-weight models. Quartz’s framing sharpens the language, reporting that Anthropic is accusing Chinese AI labs of illicit distillation attacks, which positions the activity as a terms-of-service and possibly legal matter rather than a research curiosity.
What the available reporting does not contain matters just as much. The snippets circulating do not specify how the alleged distillation was carried out, over what period, through which accounts or intermediaries, or how much output was harvested. They do not quantify any effect on the resulting Chinese models, and they do not include responses from Alibaba, Moonshot AI or DeepSeek. Any figure attached to these DeepSeek distillation claims — a token count, a percentage, a date range — is not in the reported material, and readers should be sceptical of coverage that supplies one.
What Model Distillation Actually Is
Distillation, in general terms, is the practice of training a smaller or cheaper “student” model on the outputs of a stronger “teacher” model. Rather than learning only from raw text, the student learns from the teacher’s completions, reasoning traces or preference signals, which can compress a great deal of expensive capability into a much smaller package. This is standard, well-documented technique — several openly published models advertise it in their names, including DeepSeek R1 Distill Llama 70B, which Convly lists at $0.80 in / $0.80 out per 1M tokens with roughly 40 GB of VRAM at 4-bit.
The distinction the industry draws is about consent, not method. Distilling from your own teacher model, or from a model whose licence permits it, is unremarkable. Distilling from a commercial API whose terms forbid using outputs to train rival systems is what turns the technique into an allegation. Anthropic’s usage policies are the primary document that defines what is and is not permitted on its platform, and that contractual line is the mechanism through which claims like these are normally pursued — not a technical exploit.
Why Alibaba, Moonshot AI and DeepSeek Are the Named Labs
The three named labs are not a random selection: they are the developers whose recent releases have done most to compress the price of capable inference. Alibaba’s Qwen3 line spans small local models through to large mixture-of-experts systems; Convly lists Qwen3 8B at $0.04 in / $0.14 out per 1M tokens and Qwen3 235B-A22B at $0.45 in / $1.80 out. Moonshot AI’s Kimi K3 is listed at $3.00 in / $15.00 out with a 1M-token context, with Kimi K2.7 Code at $0.60 in / $2.50 out. DeepSeek’s V4 generation is listed at $0.14 in / $0.28 out for V4-Flash and $0.435 in / $0.87 out for DeepSeek V4-Pro.
That pricing is the reason accusations of illicit distillation land as commercial claims rather than academic ones. If a lab can reach comparable behaviour on a fraction of the training spend, the pricing gap it then offers customers is not merely a business-model choice — it becomes, in the accuser’s telling, a transfer of value. Nothing in the reported material establishes that any specific capability in these models came from Anthropic’s outputs, and that gap between allegation and demonstrated provenance is exactly what remains unresolved.
How the Named Models Compare on Price and Context
The table below uses Convly’s own published listings for the models developed by the parties named in the reporting. These are catalogue figures for comparison, not benchmark results — Convly has not tested distillation provenance or model quality here.
| Model | Developer | Context | Price per 1M (in / out) | VRAM at 4-bit |
|---|---|---|---|---|
| Claude Opus 5 | Anthropic | 1M | $5.00 / $25.00 | Not published |
| Claude Sonnet 5 | Anthropic | 1M | $2.00 / $10.00 | Not published |
| DeepSeek V4-Pro | DeepSeek | 1M | $0.435 / $0.87 | ~800 GB |
| Qwen3 235B-A22B | Alibaba | 128K | $0.45 / $1.80 | ~140 GB |
| Kimi K3 | Moonshot AI | 1M | $3.00 / $15.00 | ~1.4 TB |
Anthropic publishes its own current rate card on its pricing page, which is the primary reference to check before modelling any migration. If you want to see what those differences do to a monthly bill at your own volumes, our AI API cost calculator and the wider AI models database hold the same figures in comparable form.
The Bioweapons Misuse Thread in the Same Disclosure
Reported alongside the distillation material, The Guardian says Anthropic has also detailed efforts by bad actors to misuse its AI for bioweapons purposes. It is important to keep the two strands separate: none of the three reports we have connects those misuse attempts to Alibaba, Moonshot AI or DeepSeek, and treating them as one accusation would misrepresent all four parties.
As context rather than reported fact, disclosures of this kind have become a recognisable genre for large model providers, which increasingly publish accounts of attempted misuse they say they detected and blocked. Their value to developers is indirect but real: they indicate what a provider monitors, what it logs and what behaviour it is prepared to act on. The reported snippets do not say how many attempts were involved, who was behind them, or whether any succeeded, and that detail should not be assumed.
What the DeepSeek Distillation Claims Mean for Buyers and Self-Hosters
For teams shipping products, the practical questions are contractual and operational rather than dramatic. First, read the outputs clause in whichever provider agreement you are on: the restriction that usually matters is on using outputs to train, fine-tune or evaluate a competing model, and that clause binds your own fine-tuning pipeline as much as anyone else’s. Second, if you are distilling internally, keep records of which teacher produced which dataset — provenance is far cheaper to document as you go than to reconstruct under scrutiny.
Third, an allegation is not a sanction. Nothing in the reporting indicates that any of the named models faces restricted availability, so procurement decisions should still turn on cost, latency, context and licence terms. If part of your interest in Chinese open-weight models is running them yourself, note the hardware end of the table: Qwen3 235B-A22B lands near 140 GB at 4-bit while Kimi K3 sits closer to 1.4 TB, a difference that decides whether a deployment is a single server or a cluster. Our free VRAM calculator sizes that, and the open vs closed AI cost study covers how durable the price gap between the two camps has actually been.
Frequently asked questions
What exactly has Anthropic accused the three labs of? According to TechCrunch, Anthropic has detailed distillation campaigns involving Alibaba, Moonshot AI and DeepSeek. Quartz reports that Anthropic characterises the activity as illicit distillation attacks. The specific technical mechanics are not in the reported material.
Do the DeepSeek distillation claims mean DeepSeek’s models are copies of Claude? No. The reporting describes alleged campaigns to extract outputs; it does not establish which capabilities in any shipped model derive from them, and the named labs’ responses are not in the snippets available.
Is distillation illegal? Distillation is a legitimate, widely published technique. What makes it contentious is the source: commercial providers typically prohibit using their outputs to train competing models, so disputes tend to be contractual rather than criminal.
Are the bioweapons misuse attempts connected to the Chinese labs? Not according to anything reported. The Guardian’s account concerns bad actors attempting to misuse Anthropic’s AI. No source links those attempts to Alibaba, Moonshot AI or DeepSeek.
Should this change which model I ship on? Not on its own. Compare current published pricing, context limits and licence terms, and check your provider’s outputs clause if you fine-tune. Cost and capability remain the decisive inputs.
The bottom line
Anthropic has moved a long-running industry suspicion into named, on-the-record territory, and the DeepSeek distillation claims — alongside those involving Alibaba and Moonshot AI — will shape how buyers ask about model provenance for the rest of the year. But the reported detail is thin: no volumes, no method, no timeline, no responses from the accused. The economics behind the dispute are documented and unambiguous, with Convly listing DeepSeek V4-Pro roughly an order of magnitude below Claude Opus 5 per token. Until more of the underlying evidence is public, the defensible position is to treat this as a serious allegation with unquantified scope, and to make sure your own distillation and fine-tuning records would survive the same question.
Sources: news.google.com. Reported September 11, 2026.