Chinese AI firms reportedly distilled Claude via offshore transfer stations using fake accounts and user queries

Anthropic’s report describes a method where Chinese companies Moonshot and DeepSeek allegedly circumvented direct access restrictions to Claude by routing user queries through intermediaries outside China. These 'transfer stations' acted as proxies, funneling data to Claude for distillation, extracting model capabilities without direct interaction. The scale of the operation, involving millions of queries and thousands of fake accounts, suggests a coordinated effort to exploit gaps in Anthropic’s access controls.

For engineers, this raises questions about the effectiveness of geographic or contractual restrictions on AI models. If queries can be routed through third-party infrastructure, enforcement becomes dependent on detecting and blocking indirect access patterns rather than direct API calls. The incident also highlights the difficulty of distinguishing legitimate use from misuse when data flows through intermediaries, complicating compliance and security monitoring.

The disclosure may prompt AI providers to rethink how they enforce access policies. Relying on IP-based restrictions or terms-of-service agreements may no longer be sufficient if users can route queries through offshore proxies. Engineers may need to implement additional layers of authentication, behavioral analysis, or rate-limiting to detect and mitigate such distillation efforts. However, these measures could introduce friction for legitimate users or create new attack surfaces.

The incident also underscores the broader challenge of controlling how AI models are used once they are deployed. Even with safeguards, determined actors can find ways to extract value from models indirectly. For teams building or operating AI systems, this means balancing openness with the need to prevent misuse, particularly in regions where access is restricted for legal or policy reasons.