The distillation wars: why frontier labs now fight ghost armies of fake accounts

According to Anthropic, operators it links to Alibaba's Qwen lab ran what it calls the largest distillation campaign ever measured: more than 28.8 million interactions with Claude between April 22 and June 5, 2026, using roughly 25,000 fraudulent accounts. It was not an isolated event. The company says a February 2026 wave of around 24,000 fake accounts produced 16 million interactions, attributed to operators tied to DeepSeek, Moonshot AI and MiniMax; OpenAI, for its part, sent a memo to Congress in February accusing DeepSeek of systematic distillation. In April, OpenAI, Anthropic and Google formed the Frontier Model Forum to share intelligence and coordinate defenses. These are accusations from the labs, and worth flagging as such — the accused Chinese labs are not quoted here — but the mechanism they describe is well understood.

The playbook is almost mundane in its simplicity. "Distillation" means feeding a powerful model carefully crafted prompts, harvesting its outputs, and using that data to train a smaller, cheaper model that mimics the original. What used to be IP theft by stolen code repositories has become IP extraction by legitimate-looking API traffic. The defenders' problem is genuinely hard: how do you distinguish an enterprise power user making thousands of calls for a real product from a bot network probing your model's capabilities? Rate limiting helps, but sophisticated operators spread queries across enough accounts to stay under the radar. This is an asymmetry that favors the attacker — the same asymmetry we see across AI-enabled fraud.

There is a deeper irony worth naming. Distillation is not inherently illegitimate; it is one of the core techniques that makes AI cheaper and more accessible, and the open-weight frontier we admire — Qwen, DeepSeek, GLM, Kimi — has ridden that democratizing wave. The line the labs are drawing is between learning from published models and industrially siphoning a competitor's frontier system through fraudulent access. That line matters, because the abundance we care about depends on it staying legible: copy openly and cheaply, yes; strip-mine a rival's servers under fake identities, no.

Our reading: this is a short-term symptom of a long-term truth. As we have argued, the competitive bottleneck is shifting from talent to compute and to the economics of inference — and as the models themselves converge in quality, the moat migrates to distribution, trust and the integrity of access. That is why the frontier labs are suddenly building shared defenses and pushing Washington for tighter export controls. The risk here is not the technology; it is the policy overshoot. If regulators treat every open-infrastructure project as a potential distillation front, they could throttle exactly the open, low-cost ecosystem that spreads AI's benefits widest — punishing the many for the tactics of a few. History also suggests export controls accelerate Chinese self-reliance more than they contain it. The honest conclusion is uncomfortable: catching fraudulent accounts is a legitimate, necessary fight, but the labs cannot litigate their way to a durable lead. The frontier will keep leaking, China will keep closing the gap, and the winners will be those who compete on cheaper tokens, better distribution and earned trust — not those who bet the moat on keeping their outputs a secret.