By Global Technology & Defense Desk
Published: September 2026
Main Facts
A landmark threat intelligence report published by artificial intelligence pioneer Anthropic in September 2026 has brought to light a sweeping, multi-pronged exploitation of its flagship AI model, Claude, by hundreds of China-linked threat actors. Despite Beijing’s aggressive push for domestic technological self-reliance and its claims of fielding competitive, sovereign generative AI architectures, state-backed entities, military-industrial researchers, and major commercial tech enterprises repeatedly bypassed their own domestic tools to leverage Claude.
According to the disclosures, these entities covertly funneled requests through thousands of fraudulent accounts, proxy networks, and third-party brokers to fuel at least five distinct malicious programs. These initiatives span two military engineering applications—including anti-torpedo fire control and electronic warfare targeting software—alongside complex transnational surveillance operations targeting the Uyghur diaspora. Furthermore, the report details industrial-scale "model distillation" campaigns mounted by high-profile Chinese artificial intelligence firms, such as Alibaba and DeepSeek. These companies allegedly harvested millions of Claude data exchanges to bootstrap and supercharge the reasoning, coding, and agentic capabilities of their own frontier models at a fraction of standard development costs.
Chronology of Operations
While unauthorized usage of Western frontier models by foreign adversaries has been a growing concern within intelligence circles, Anthropic’s September 2026 threat report documents a concentrated surge of malicious activity occurring predominantly between late 2024 and mid-2026.
- Late 2024 – 2025: Initial indicators of systematic model distillation begin to surface across the industry. Chinese tech entities experiment with proxy-based access to harvest "chain-of-thought" data from Western AI platforms, aiming to close the capability gap in advanced reasoning and coding models.
- May – July 2026: Industrial-scale exploitation peaks. Alibaba operators ramp up operations, driving a staggering 151 million Claude exchanges over a two-month window. Daily request volumes breach the 3 million mark through a vast web of fraudulent accounts. Concurrently, DeepSeek allegedly logs over 12.1 million exchanges within a compressed 14-day timeline.
- September 2026: Anthropic publishes its comprehensive threat intelligence findings, formally cataloging the deep entanglement of Chinese state-linked entities, defense contractors, and commercial giants with the Claude ecosystem for military, espionage, and data-harvesting purposes.
Supporting Data and Operational Breakdown
The scope and scale of the operations detailed in Anthropic’s report reveal an intensive, calculated reliance on Western AI superiority across multiple strategic domains.
1. Military Engineering and Defense Applications
Anthropic identified at least two distinct military-industrial programs utilizing Claude for sensitive defense specifications:
- Anti-Torpedo Fire Control: A China-based actor—disguising its identity as a defense original equipment manufacturer (OEM)—utilized Claude to draft a comprehensive fire-control specification for an anti-torpedo weapon system. The AI was tasked with establishing the core logic for threat engagement, simulating performance against U.S. Navy anti-torpedo and anti-submarine systems utilizing public domain data, and generating a 200-plus-page technical proposal destined for a People’s Liberation Army Navy (PLAN) contractor.
- Electronic Warfare (EW) Module Development: A researcher associated with Chinese military-industrial institutions used Claude to write approximately 16 distinct software modules designed for electronic warfare and the suppression of enemy air defenses (SEAD). The tool analyzed radars, surface-to-air missile (SAM) batteries, command posts, and communications nodes to prioritize targets. Notably, default simulation scenarios featured 12 explicit targets inside Taiwan, including Patriot and Tien Kung air defense batteries, strategic air bases, early-warning radar installations, and hardened command bunkers. Account metadata tied these activities directly to entities such as the PLA Academy of Military Sciences.
2. Transnational Surveillance and Diaspora Infiltration
Beyond direct military software design, Anthropic successfully disrupted sophisticated state-backed surveillance operations directed at Uyghur communities outside China:
- Infiltration and Social Mapping: Operating under the guise of an Arabic-speaking "expert" consultant, a government-linked actor utilized Claude to infiltrate Uyghur armed factions in Syria and monitor diaspora activists globally. Claude processed telemetry and raw text gathered across more than 100 WhatsApp groups and dozens of Telegram channels, mapping social networks and pinpointing high-value recruitment targets.
- Psychological Exploitation and Bot Amplification: The AI assisted handlers in identifying individuals rendered vulnerable by financial distress, family separation, or political disillusionment. Claude systematically drafted deceptive, localized outreach messages, translated real-time conversations, and vetted the credibility of recruitment interactions. Simultaneously, the operation executed coordinated mass-reporting and bot-amplification campaigns to silence independent diaspora journalists, including outlets like the Uyghur Post.
3. Industrial-Scale Model Distillation
The most economically disruptive finding involves the large-scale extraction of proprietary intelligence through model distillation:
- Alibaba’s Qwen Pipeline: Between May and July 2026, Alibaba operators utilized thousands of fraudulent accounts to generate over 151 million interactions with Claude—peaking at nearly 3 million requests daily. According to Anthropic, this harvested chain-of-thought data was funneled directly into training iterations for the Qwen 3.x model family, optimizing them for complex reasoning, software engineering, kernel development, and long-horizon execution tasks.
- Industry-Wide Participation: Anthropic’s telemetry also implicated other leading Chinese AI developers—including DeepSeek, Xiaomi, and Zhipu/Z.ai—in parallel harvesting operations. DeepSeek alone allegedly logged 12.1 million exchanges over a fortnight, while Xiaomi recorded upwards of 400,000 queries. These actors employed advanced evasion tactics, routing requests through proxy networks, forwarding unwitting commercial customers’ prompts to Claude, and purchasing consolidated conversation datasets from illicit third-party brokers.
Official Responses and Security Analysis
The disclosures have triggered intense scrutiny from cybersecurity experts, national security analysts, and policymakers in Washington and Brussels.
Security analysts note that the choice of Claude over domestically available Chinese large language models (LLMs) underscores a persistent capability gap in specialized reasoning, agentic workflow execution, and complex coding tasks. Furthermore, because Western frontier models are predominantly trained on vast corpora of English-language technical literature, open-source documentation, and public-domain U.S. defense literature, they inherently possess a deeper repository of institutional and technical knowledge regarding American military capabilities than many state intelligence archives can easily replicate.
Anthropic has responded by hardening its infrastructure, deploying advanced behavioral analysis to detect fraudulent account clusters, and updating its acceptable use policies to aggressively curtail automated distillation and adversarial task generation. However, security professionals warn that model distillation remains an asymmetric hurdle; as long as Western frontier models maintain a performance edge, foreign actors will continue to devise sophisticated evasion strategies to siphon their capabilities.
Strategic Implications
The revelations contained in Anthropic’s September 2026 report carry profound implications for the global technology landscape, geopolitical stability, and the future governance of artificial intelligence:
- The Erosion of Technological Sovereignty Myths: Despite heavy state subsidies and national directives demanding domestic self-sufficiency, the reliance of Chinese military researchers and top-tier AI firms on Western models demonstrates that a performance gap persists at the frontier level.
- Dual-Use Vulnerabilities and Guardrail Evasion: The ease with which threat actors masked their identities to write anti-torpedo logic and electronic warfare suppression code highlights the extreme difficulty of enforcing safety guardrails in commercial APIs. Advanced language models are increasingly functioning as force multipliers for asymmetric warfare and cyber-espionage.
- The Economics of Distillation: Industrial-scale distillation threatens to upend the traditional economics of AI development. By bypassing the immense computational expense of foundational training and instead "stealing" reasoning paths from frontier models, foreign developers can rapidly close capability gaps at a fraction of the cost, raising urgent questions about intellectual property protection in the age of generative AI.
- Heightened Geopolitical Tensions: As AI safety reports increasingly intersect with state-sponsored espionage, military simulation, and transnational repression, calls for strict export controls, mandatory know-your-customer (KYC) verifications for cloud compute providers, and enhanced federal oversight of frontier model deployments are expected to reach a fever pitch.
