Anthropic Tracked Chinese Users to Combat AI Model Distillation

Covert monitoring reveals AI knowledge wars

Anthropic deployed tracking software in March to monitor Chinese users of its Claude Code chatbot, attempting to identify rival firms suspected of using the system to train their own AI models. The monitoring code checked for Chinese time zones and web domains linked to specific Chinese AI companies before being removed last week following public criticism.

The incident exposes the increasingly aggressive tactics American AI companies are employing as Chinese competitors rapidly close the capability gap. According to The Washington Post, which first reported these details, the episode highlights tensions over a practice called "distillation"—using a powerful AI system as a tutor to train smaller, cheaper models.

The distillation controversy

Distillation involves querying a large AI model hundreds of thousands of times to generate training data for a smaller system. While the technique itself isn't illegal and has been used throughout the industry, doing so without permission violates AI companies' terms of service.

In a letter to U.S. senators obtained by The Post, Anthropic alleged that Alibaba's Qwen AI team used approximately 25,000 fraudulent accounts to generate over 28.8 million exchanges with Claude. The company made similar accusations in February against Chinese firms Deepseek, Moonshot, and MiniMax, stating these campaigns were "growing in intensity and sophistication."

Research from Peking University and the Chinese Academy of Sciences appears to support these claims. A February 2025 study found that most Chinese language models tested showed substantial evidence of distillation from U.S. models. One Qwen model misidentified itself as Claude nearly one-third of the time during intensive testing.

Why it matters

The distillation debate carries significant implications beyond corporate competition. Chinese AI models are achieving near-parity with American systems at a fraction of the cost, with some free Chinese models already outperforming paid U.S. alternatives in specific tasks. This capability gap closure—despite U.S. export controls on advanced chips—threatens American technological leadership while simultaneously offering cost-effective options that Fortune 500 companies and startups are increasingly adopting. The tension between restricting Chinese access and maintaining U.S. innovation advantages will shape both AI policy and market dynamics.

Enforcement challenges mount

Preventing unauthorized access remains difficult. Despite Anthropic banning nearly 700,000 accounts and implementing government ID verification for some users, Chinese customers routinely circumvent restrictions using proxy servers and third-party services. The Post's testing found Claude and OpenAI accounts available through Chinese resellers for as little as $1 monthly for basic access, with premium subscriptions offered at $12 versus over $100 in the U.S.

Anthropic noted in February that "when one account is banned, a new one takes its place," with one proxy network managing more than 20,000 fraudulent accounts simultaneously.

Industry practices under scrutiny

The controversy is complicated by the fact that distillation is widespread. OpenAI released a tool in 2024 to help customers distill its own models, and Elon Musk testified in May that his company xAI uses the technique. Irene Solaiman, chief policy officer for AI repository Hugging Face, cautioned that framing Chinese models as "stolen goods" risks underestimating China's genuine innovation in AI efficiency and cost-effectiveness.

Anthropic characterized the tracking as an "experiment" and stated that distillation attacks "pose a serious threat to national security and undermine AI safety standards across the industry." The Trump administration echoed these concerns in an April memo warning of "deliberate, industrial-scale campaigns" by Chinese firms.

These details were first reported by The Washington Post.