Distillation Campaigns:
Model Choice Is a Trust Choice

Anyone choosing AI models for their company is simultaneously making a data-policy decision. Anthropic accuses three Chinese AI labs of extracting knowledge from its own model, Claude, at industrial scale — through roughly 24,000 fraudulently created accounts and more than 16 million API requests (Anthropic, 02/23/2026). For SMBs, that means: alongside price and performance, your multi-model strategy needs a third filter — a trust layer.

What does Anthropic accuse DeepSeek, Moonshot, and MiniMax of?

On February 23, 2026, Anthropic published a report titled "Detecting and preventing distillation attacks." In it, the company states it identified "industrial-scale campaigns" by three AI labs: DeepSeek (Hangzhou), Moonshot AI (Beijing), and MiniMax (Shanghai).

According to Anthropic's own account, the three labs directed a combined total of more than 16 million API requests at Claude through a network of roughly 24,000 fraudulently created accounts. Anthropic describes the infrastructure as a "hydra cluster": a single proxy network is said to have managed more than 20,000 accounts simultaneously, deliberately mixing distillation traffic with legitimate customer requests to make detection harder.

Anthropic states it identified the campaigns through IP correlation, request metadata, infrastructure indicators, and a behavioral fingerprinting system. The company itself uses the phrase "We have identified" — this is Anthropic's own analysis, not an external audit or a regulatory finding.

As of June 23, 2026, there is neither a court ruling nor a regulatory order regarding these allegations. No public statement from the three named labs could be found at the time of this research.

What is distillation in AI models?

Model distillation is a recognized technique in AI research. A smaller "student" model is trained on the outputs of a larger "teacher" model, rather than processing new data from scratch. The result: less compute, lower costs, and faster development cycles. Anthropic defines the term as "a technique called 'distillation,' which involves training a less capable model on the outputs of a stronger one."

What Anthropic calls a "distillation campaign" goes, by its own account, beyond the legitimate technique. It is said to involve targeted, mass prompt submissions to Claude through fraudulently created accounts, with the outputs subsequently used as training data for the labs' own models. This is said to have happened in violation of Anthropic's terms of use and regional access restrictions — Claude is not officially available in mainland China.

Which labs are involved — and who's behind them?

DeepSeek (Hangzhou)

Founded in July 2023 by Liang Wenfeng, co-founder of the hedge fund High-Flyer. Current models: DeepSeek-V3 (671 billion parameters, mixture-of-experts architecture), DeepSeek-R1, and the DeepSeek-V4 preview (April 2026). The models are open weight — freely downloadable and deployable on your own infrastructure.

Since early 2025, data protection proceedings have been ongoing in the EU in Italy, Ireland, Belgium, the Netherlands, and France. Italy temporarily blocked the app store version. According to its own figures, Anthropic attributes more than 150,000 API exchanges to DeepSeek, with a focus on reasoning and grading.

Moonshot AI / Kimi (Beijing)

Founded in March 2023 by Yang Zhilin, Zhou Xinyu, and Wu Yuxin. Current models: Kimi K2.5 (open weights, January 2026) and Kimi K2.6 (April 2026, agentic coding focus). Valued at roughly USD 18 billion (April 2026), with a Hong Kong IPO under discussion.

According to its own figures, Anthropic attributes more than 3.4 million API exchanges to Moonshot, with a focus on agentic reasoning, coding, and computer vision.

MiniMax (Shanghai)

Founded in 2021 by Yan Junjie (ex-SenseTime). Hong Kong IPO in January 2026 at a valuation of roughly USD 6.5 billion. Investors include Alibaba and Tencent. Current models include MiniMax-M3.0 (June 2026), usable across text, image, video, and audio — its video platform Hailuo AI is considered a Sora competitor.

Anthropic attributes the largest share to MiniMax: more than 13 million API exchanges, with an emphasis on agentic coding and tool use.

What does this mean for data policy in the mid-market?

The allegations are a concrete occasion to ask a fundamental question: which data jurisdiction does your company's data flow into when you use a particular AI model?

Western frontier labs (Anthropic, OpenAI, Google, Microsoft) offer an EU contractual framework. Data processing agreements (DPAs) are available, EU hosting options exist, and standard contractual clauses apply. The GDPR framework is legally enforceable — even if it isn't perfect.

Chinese AI models (DeepSeek, Kimi, MiniMax) are powerful and often cheaper. In the standard hosted offering, however, the country of data processing is China. According to DeepSeek's own privacy policy, user data is stored on servers in the People's Republic of China. China's National Intelligence Law (Article 7) obligates Chinese organizations to cooperate with state intelligence work. No EU adequacy decision exists for China, and the standard hosted offerings lack a data processing agreement to EU standards.

That doesn't mean Chinese AI models are unusable across the board. Open-weight models like DeepSeek-V3 can be run on your own EU infrastructure — in which case the data never leaves your own legal jurisdiction. Anyone hosting an open-weight model on a German or European server is subject exclusively to EU law — regardless of where the model was originally developed.

The decisive difference, then, lies in the deployment path, not the lab's country of origin. Current market shares in the multi-model space show that companies are increasingly running several models in parallel — which makes the question of which data may flow into which model all the more important.

A practical decision framework: multi-model with a trust layer

Model choice is a trust choice. Instead of declaring a single model the default, Amazing Agents recommends a three-tier decision framework:

Tier 1 — Data classification: What data goes into the prompt? Public information (product descriptions, FAQ text, marketing material) requires a lower protection level than customer data, cost calculations, or internal process descriptions.

Tier 2 — Check the deployment path: For each use case, clarify: Is a hosted cloud model being used — and if so, where is the data stored? Is a model with an EU hosting option available? Or would an open-weight model on your own infrastructure be a better fit?

Tier 3 — Secure the contractual framework: Is a data processing agreement (DPA) in place? Do standard contractual clauses apply? Is there a documented retention/deletion period? Is the model hosted in a jurisdiction covered by an EU adequacy decision?

This framework doesn't rule out any model across the board. It ensures that sensitive company data only flows into models whose contractual framework and hosting match the required level of protection. In practice, that means: for generating a public FAQ, a cheap open-source model can be the right choice. For analyzing customer data or internal financial reports, you need a model with a DPA and EU hosting.

Amazing Agents helps mid-sized companies integrate this trust layer into their existing multi-model strategies — in a 30-minute audit.

Frequently asked questions about distillation, AI model choice, and data protection

Are Chinese AI models like DeepSeek safe for my business data?

It depends on the deployment path. In the standard hosted offering, data flows to servers in China — no EU adequacy decision applies there, and China's National Intelligence Law (Article 7) obligates cooperation with authorities. Open-weight models run on your own EU infrastructure are a different case, because the data never leaves your own legal jurisdiction.

What does distillation mean for AI models?

Distillation is a training method in which a smaller model is trained on the outputs of a larger one. In principle, this is a legitimate technique. Anthropic accuses the three named labs of applying this method without authorization, at industrial scale, through fraudulently created accounts.

Which AI model is GDPR-compliant for SMBs?

There's no blanket answer. Western frontier models with an EU hosting option and a data processing agreement (DPA) currently offer the strongest GDPR framework. Chinese models in the standard hosted offering cannot be used in a GDPR-compliant way without additional safeguards. What matters is the combination of data classification and deployment path.

What exactly does Anthropic accuse DeepSeek, Moonshot, and MiniMax of?

Anthropic states that the three labs directed more than 16 million API requests at Claude through roughly 24,000 fraudulent accounts, in order to use Claude's outputs as training data. The report is dated February 23, 2026. As of June 23, 2026, there has been no court ruling and no public statement from the named labs.

Am I allowed to use DeepSeek in my company?

A blanket ban misses the point. What matters is the combination: data classification (public, internal, sensitive) × deployment path (hosted in China, hosted EU cloud, self-hosted open weights). For public data on EU infrastructure, there's little to argue against it. For sensitive customer data through the hosted China service, the missing GDPR framework argues clearly against it.