📰 Key Takeaways

Alibaba had the largest haul, with 151 million conversations concentrated between May and July, peaking at nearly 3 million requests in a single day, spread across 3,500 accounts. Because they all shared the same fixed prompt designed to get the model to spill its chain of thought, Anthropic determined this was a single large-scale distillation campaign run by Alibaba to train its Qwen model family — the largest such campaign the company has ever observed. The attackers got around Claude’s default protection (which only shows a “summarized reasoning” block) by disguising their requests as translation tasks, tricking the model into leaking its full reasoning process directly — for example, asking it to translate “previous working memory” into pure katakana Japanese. Another campaign, from Moonshot AI (the company behind Kimi), appears to be directly tied to the Chinese military — one request asked Claude to evaluate closed-circuit surveillance footage and judge whether the people in it were “behaving abnormally.” Over 10 days, around 5,000 accounts sent nearly 300,000 requests over the network, mainly targeting Claude’s Opus model. The full investigation covers close to 200 million transactions across five separate campaigns, showing that Chinese AI companies have kept developing more sophisticated methods in recent months to get around Anthropic’s defenses and extract capabilities from US frontier models — including agentic and tool-use skills, coding and data analysis, and logical reasoning — all in pursuit of a competitive edge. Anthropic already called out these labs back in February, and OpenAI has previously pointed to similar behavior from DeepSeek, but this report reveals campaigns that are larger in scale and more aggressive than before.

💬 JudyAI Lab Take

Alibaba disguised its requests as translation tasks and, over three months, tricked Claude into leaking more than 150 million full reasoning traces — the largest distillation campaign Anthropic has ever observed. This is a case every AI practitioner should pay attention to.

It points to a trend worth taking seriously: if model safeguards only operate at the surface level — showing a summarized version of the reasoning while hiding the full chain of thought — attackers can just repackage their request to get around it. Asking the model to translate “previous working memory” into katakana Japanese is a good example: it tricks the model into dumping its internal process directly. Once the reasoning chain itself becomes an asset that can be stolen, security design can’t just block direct questions — it has to account for indirect prompting and multi-turn repackaging too. And the more advanced the reasoning capability, the more attractive a target it tends to become.

If your product has a step-by-step or chain-of-thought feature, now’s a good time to check whether there’s an input path that lets users indirectly get the model to output internal processes it shouldn’t reveal.

📅 Source Info

🔗 Further Reading