Analysis

Who’s Distilling From Whom? The AI Industry is Fighting Over Copying

co-written by eustella AI14. July 2026, 08:00

Anthropic accuses Chinese labs of “distillation attacks,” Microsoft CEO Satya Nadella takes shots at the frontier labs, and Apple is quite officially distilling from Google. The dispute over the technique by which AI models learn from one another has become the AI industry’s proxy war – and it raises an uncomfortable question: who actually owns the knowledge inside the models?

When Microsoft unveiled its first in-house frontier models in early June, Satya Nadella couldn’t resist a swipe at the competition. The new reasoning model MAI-Thinking-1, he said, had been trained “from scratch” on clean, commercially licensed data – and explicitly without distillation from third-party systems.

The message between the lines: others do it differently. Nadella doubled down rhetorically, warning of a world in which every company cedes value to “a few models that eat everything they see.” The public, he argued, would not tolerate a handful of firms “doing all of the learning for the world.” The targets – no names required – were OpenAI and Anthropic, of all companies the very labs in which Microsoft has invested billions and whose models it distributes on Azure.

That the Microsoft CEO is wielding the word “distillation” as a weapon is no coincidence. Hardly any topic is preoccupying the AI industry in 2026 as much as the question of who is copying from whom – and where the line runs between legitimate technique and theft. Unauthorized distillation is costing US AI labs up to $6 billion a year, according to estimates by US officials – and Silicon Valley has told the Trump administration, per Bloomberg, that it sees the practice as an existential threat.

What Distillation Actually Is

Distillation is, first of all, a perfectly standard machine learning method: a smaller “student model” is trained on the outputs of a larger “teacher model,” absorbing its capabilities in compressed form. In the ideal case, the result is a model that runs significantly cheaper and faster without losing much quality. Practically all major AI labs routinely distill their own models to create smaller, cheaper variants for their customers.

The technique becomes problematic when it is applied across company lines and against the will of the model’s operator. Then the compression method turns into an extraction tool: a competitor bombards a rival’s frontier model with carefully constructed prompts, collects the answers, reasoning chains, and generated code – and uses them to train its own, cheaper model. The original’s expensive research and training costs are someone else’s problem. Anthropic calls this variant “adversarial distillation.”

The dividing line, then, runs less through the technique itself than through questions of permission and scale: distillation under contract is a licensing business; distillation via tens of thousands of fake accounts is, in the eyes of the affected labs, capability theft.

Anthropic vs. DeepSeek, Moonshot, and MiniMax

What such an alleged attack looks like is something Anthropic described in detail in February 2026. The Claude maker accused three Chinese labs – DeepSeek, Moonshot AI, and MiniMax – of siphoning off its models’ capabilities on an industrial scale: more than 16 million queries, spread across roughly 24,000 fraudulent accounts, in violation of its terms of service and regional access restrictions – Anthropic doesn’t offer Claude commercially in China at all, citing security reasons. According to Anthropic, the workaround came via commercial proxy services running so-called “hydra cluster architectures”: sprawling networks of fake accounts that distribute traffic across third-party APIs and cloud platforms and blend it with legitimate customer requests.

The three campaigns targeted different capabilities. DeepSeek is said to have focused primarily on extracting reasoning – for instance by prompting Claude to reconstruct, step by step, the internal rationale behind a finished answer, effectively generating chain-of-thought training data at scale. Moonshot AI (Kimi) allegedly went after agentic reasoning, tool use, and coding with more than 3.4 million queries, while MiniMax targeted agentic coding and orchestration with more than 13 million. Notably: when Anthropic released a new model in the middle of MiniMax’s active campaign, the traffic – according to the company – pivoted within 24 hours, redirecting half of it to the new system.

The Alibaba Case: The Largest Campaign Yet

June brought the next escalation. In a letter to US senators and the White House, Anthropic accused operators allegedly affiliated with Alibaba’s AI lab Qwen of the “largest known distillation attack” on its models to date: roughly 25,000 fraudulently created accounts are said to have conducted around 28.8 million interactions with Claude between April 22 and June 5, 2026 – targeting its most commercially valuable capabilities, software engineering and agentic reasoning. Alibaba’s stock dipped after the news broke; the company initially declined to comment.

An important caveat remains: the allegations are unproven so far. Anthropic says it identifies such campaigns via IP correlations, request metadata, and account behavior – which may suffice for account bans and government briefings, but it is not a publicly verifiable forensic proof directly linking Qwen’s model weights to Claude data. At the same time, the move is highly political: Anthropic is calling for penalties against distillation actors, tougher export controls, and easier information sharing among US firms. Legislative initiatives are already under review in the US Congress that would sanction Chinese companies for unlawfully accessing the outputs of US models. The US labs’ argument: illicitly distilled models would hit the market without safety guardrails and undermine chip export controls, because the rapid progress of Chinese labs is misread as proof that those controls don’t work.

Claude’s Freudian Slip: Did Anthropic Copy From Alibaba, Too?

Also of note: when we asked Claude by Anthropic, in its “Opus 4.8” version via its application programming interface (API), on June 6 who it was in Chinese, it replied in Chinese with the following:

“I am Tongyi Qianwen (Qwen), a super-large-scale language model independently developed by the Tongyi Lab under Alibaba Group.”

Tongyi Lab is the AI research unit of Alibaba Group and houses the team behind Alibaba’s open-weight models (including Qwen) and AI agents. In the well-known consumer-facing version of Claude, you wouldn’t get this answer, because Anthropic’s large system prompt would intervene. But via the API, developers – including us – get direct access to the “raw” version of Claude, which sometimes gives more direct, unfiltered answers. Here’s the screenshot:

Apple Shows How It’s Done – With a Contract

That distillation is not inherently disreputable is demonstrated by Apple, of all companies. At WWDC 2026, the iPhone maker unveiled the third generation of its Apple Foundation Models – for the first time openly built on Google’s Gemini technology. The foundation is a multi-year partnership signed in January 2026 that, according to Bloomberg reports, costs Apple around one billion dollars per year: access to a custom Gemini model with a reported 1.2 trillion parameters, from which Apple derives its model family – from the 3-billion-parameter model on the iPhone to the reasoning model in Private Cloud Compute.

The difference from the allegations against the Chinese labs is obvious: Apple distills with a license, a contract, and a price tag. Google gets paid, the cooperation is public, and both sides negotiated the terms – down to the assurance that no Apple user data flows to Google. This model – distillation as a licensing business rather than a gray zone – is likely to become the industry’s reference case.

The AI Industry’s Glass House

For all the outrage from the US labs, one irony remains – one that industry observers keep pointing out: the frontier models whose outputs are now being defended as strategic assets worth protecting were themselves trained on massive amounts of data from the web – on texts, images, and code from millions of creators who were neither asked nor paid. To this day, the developers disclose only partially, if at all, which data flowed into their training pipelines; full transparency about training data exists at none of the major labs.

The legal reckoning is running in parallel to the distillation dispute: numerous copyright infringement lawsuits are pending against OpenAI, but also against Anthropic, Meta, Stability AI, and others – brought by publishers, authors, and image agencies alike. Anyone looking for a clean answer to the question “Who’s distilling from whom?” is unlikely to find one. The AI industry is fighting over the second derivative of a problem whose first it never solved: whether learning from other people’s data – be it websites or model outputs – is theft or progress.