Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Anthropic uncovered campaigns to extract Claude's capabilities carried out by the three Chinese AI Labs: DeepSeek, Moonshot, and MiniMax. Collectively, these campaigns used approximately 24,000 accounts and 16 million queries. They used model distillation to train their own models on the outputs of Claude in an attempt to replicate Claude's capabilities such as agentic reasoning, code generation, tool use, and computer use.
As outlined in Anthropic's report, model distillation was leveraged as a means for these labs to undermine Anthropic's export controls. Distilled models lack the safeguards that prevent bad actors from using frontier models for malicious purposes such as the bioweapon development, disinformation, offensive cyber operations, and mass surveillance.
ASSESSED SYSTEM
Anthropic's hosted Claude inference API as it stood during the distillation campaigns Anthropic disclosed on 2026-02-23: an account-based commercial API returning generated output to account holders, operated under a provider policy of not offering commercial access to Claude in China.
OUT OF SCOPE
The distilled models and training pipelines of DeepSeek, Moonshot AI, and MiniMax, and the prompt datasets they generated (attacker-side assets); the commercial proxy services used as the access path; downstream misuse of the distilled models described in the impact steps, which occurs outside the assessed service; and Claude's control state after Anthropic's response, which the record does not describe.
Architecture: Standalone LLM / Generative AI (decision tree Q5) — Q1 = NO: no coordinating agents inside the assessed boundary. Q2 = NO: the inference API answers individual requests and holds no autonomous planner or task state. Q3 = NO for the assessed boundary: the agentic reasoning, tool-use, and computer-use capabilities named in the record were the capabilities being imitated, and no tool execution by the service is part of the observed path. Q4 = NO: no retrieval layer is described. Q5 = YES: the service generates open-ended text and code in response to API queries, which is the surface the campaigns queried more than 16 million times. Tier 2: Tier 2 Consumer: a publicly available commercial inference API queried directly by individuals and organisations. The societal-harm steps in the record concern the distilled models outside the boundary and do not raise the assessed service to Tier 1.
Documented attack or failure path
- Access via commercial proxies. DeepSeek, Moonshot AI, and MiniMax reached Claude through commercial proxy services, circumventing Anthropic's policy of not offering commercial access to Claude in China.
- Prompt dataset generation. The laboratories generated large prompt datasets designed to extract Claude's capabilities.
- Fraudulent account population. The campaigns queried the inference API through approximately 24,000 fraudulent accounts.
- Extraction by distillation. More than 16 million queries were issued and the responses used to train the laboratories' own models, targeting agentic reasoning, tool use, and code generation.
- Impact outside the boundary. The distilled models lack Claude's safeguards; the resulting societal and user harm arises outside the assessed service.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Anthropic detected the campaigns and attributed them to three named laboratories operating approximately 24,000 accounts and more than 16 million queries; the disclosure is the product of the provider's own detection.
- Access required accounts on the provider's platform and, for the restricted region, an intermediary proxy service; the record shows no unauthenticated path to the inference API.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.05–0.85 (midpoint 0.45), Tier 2 MVT 0.55 indeterminate | |||
| Pr-2Inference Attack Resistance | 0.25w 0.20 | REVISED Pr-2 extraction criteria (2026-10-14); inference attacks are not evidenced and stay UNKNOWN. The 0.25 extraction anchor is met: only generic controls (account authentication and regional access policy) applied and were bypassed, and the campaign was detected only after material capability was replicated. The 0.50 anchor requires campaigns to be detected while in progress with MEA (chance-corrected Model Extraction Advantage) held to 0.30-0.60; detection after more than 16 million queries and successful capability replication shows neither. Not 0.00, because a provider control did detect and attribute the extraction. | Roughly 24,000 fraudulent accounts issued more than 16 million queries from purpose-built prompt datasets, and three laboratories trained models replicating Claude's agentic reasoning, tool use, and code generation from the outputs. Anthropic detected and attributed the campaigns, but only after that volume of extraction had occurred.source: secureflow/atlas |
| Containment (Cn) — scenario interval 0.06–0.83 (midpoint 0.44), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.13 | The 0.25 anchor: a scope boundary existed (a regional commercial-access policy) but was enforced inconsistently, because an intermediary relay was sufficient to exceed it. The 0.50 anchor requires core scope controls that block common violations; proxy resale is a common circumvention and it succeeded at campaign scale. | Anthropic's policy of not offering commercial access to Claude in China was circumvented by routing the campaigns through commercial proxy services.source: secureflow/atlas |
| Cn-5Agent Identity Integrity | 0.25w 0.09 | The 0.25 anchor: account and credential authentication existed, so unauthenticated calls were not accepted (above 0.00), but identity was not bound to a verified principal and one actor operated thousands of identities. The 0.50 anchor requires scoped identity with partial verification, which the fraudulent-account population defeated at scale. | The laboratories reached the inference API through approximately 24,000 fraudulent accounts; each account was accepted by the service although it did not represent a legitimate, distinct principal.source: secureflow/atlas |
Unknown, not N/A: 22 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: declared with an architecture rationale in the workpaper: Cn-9.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | The assessed service generates output and holds no tool, write, or transaction authority on the observed path. Placed at 0.25 rather than 0.00 because responses flowed to automated consumers with no human review, which the 0.00 anchor ('every output reviewed') does not describe. |
| AsAttack Surface Exposure | 0.75w 0.35 | Internet-facing commercial API reachable by any account holder; the inputs were adversarially designed prompt datasets submitted through fraudulent accounts and third-party proxies, so the authenticated channel carried only partially trusted input. Not 1.00: no untrusted retrieval, multi-agent, or MCP integration lies inside the boundary. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.75w 0.20 | Guardrail-mitigation anchor. Capability extraction through outputs is a property of any model that answers queries: account verification, aggregate-volume detection, throttling, and output fingerprinting reduce it but cannot eliminate it, and capability already distilled cannot be recalled. Scored exactly at 0.75 and therefore not counted as elevated. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | The public record identifies the affected product or representative configuration, attack path, and principal control boundaries, but does not provide a complete asset manifest, verified dependency graph, configuration export, or assessment evidence manifest. |
| Ec — Public evaluation coverage | 0.08 | coverage 0.12 (3 of 25 applicable sub-metrics) × independence 0.80 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.16 | Evidence dated 2026-02-23; age 237 days on the workpaper reference date. Components: T_calendar 0.16 · C_event 0.35 · C_monitor 0.85 · C_evidence 0.85. Binding term: T_calendar. dt_days = 237, measured from the 2026-02-23 disclosure (MITRE ATLAS AML.CS0056 incident date; Anthropic's report) to the 2026-10-18 evidence reference date. agentic = false: a hosted inference endpoint with no runtime tool or credential provisioning inside the boundary. baw = false: no model-writable persistent memory, agent-to-agent exchange, self-modifying configuration, or closed feedback loop is evidenced. C_monitor 0.85: provider monitoring detected and attributed the campaigns, but only after more than 16 million queries had been served. C_event 0.35: a confirmed capability-extraction compromise of the assessed service. C_evidence 0.85: the post-disclosure control state is not described in the record. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.17 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.0 midpoint, interval 1.3–6.7; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0056-claude-model-distillation-campaigns), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-1, step-3. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0056-claude-model-distillation-campaigns), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-1, step-3, step-5. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0056-claude-model-distillation-campaigns), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-I-003.003 | Resource, Token & Spend Budget ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0056-claude-model-distillation-campaigns), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-D-005.007 | Token, Tool-Use, Request-Parameter & Cost Spike Detection & AlertingExact SecureFlow defense-map identifier (flow atlas-aml-cs0056-claude-model-distillation-campaigns), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-013.003 | Black-Box Behavioral Ownership FingerprintingExact SecureFlow defense-map identifier (flow atlas-aml-cs0056-claude-model-distillation-campaigns), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Pr-1 |
WHAT THIS CASE TEACHES
A hosted model's caller identity and its extraction monitoring are both security controls: when one actor can operate thousands of authenticated accounts behind resale proxies, authentication and regional policy pass while capability extraction succeeds, so AITBM records the failure on Cn-5 and Cn-1 and the late detection on Pr-2 at 0.25 rather than treating authenticated traffic as trusted.
Sources: AIDEFEND SecureFlow — Model Distillation Campaigns Targeting Anthropic Claude · MITRE ATLAS case study AML.CS0056 · Detecting and preventing distillation attacks (anthropic.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0056 (incident) |
|---|---|
| Target | Anthropic Claude |
| Actor | DeepSeek, Moonshot AI, MiniMax |
| Reporter | Anthropic |
| Primary evidence date | 2026-02-23 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision |
| Risk impact | Resource hijacking / cost |
| Affected components | Claude inference API, fraudulent account population, commercial proxy access path, distillation prompt datasets, model-output training corpus |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Access Claude via AI Service ProxiesDeepSeek, Moonshot AI, and MiniMax used commercial proxy services to gain access to Claude. This circumvented Anthropic's policy of not offering commercial access to Claude in China. | AML.TA0003 AML.T0008.005 |
| 2 | Generate Distillation Prompt DatasetDeepSeek, Moonshot AI, and MiniMax generated large datasets of prompts designed to extract capabilities from Claude. | AML.TA0003 AML.T0065 |
| 3 | Query Claude Through Fraudulent AccountsThe AI labs accessed Claude's inference API via the combined approximately 24,000 fraudulent accounts. | AML.TA0000 AML.T0040 |
| 4 | Extract Model Capabilities by DistillationDeepSeek, Moonshot AI, and MiniMax used their generated prompts to repeatedly query Claude and train their own models from the responses. Collectively, the labs issued over 16 million queries during their distillation campaigns. | AML.TA0010 AML.T0024.002 |
| 5 | Steal Claude CapabilitiesDeepSeek, Moonshot AI, and MiniMax acquired Claude's capabilities via distillation at a fraction of the cost of developing their own models. They targeted Claude's most differentiated capabilities including agentic reasoning, tool use, and code generation. | AML.TA0011 AML.T0048.004 |
| 6 | Create Societal-Harm Risk with Unsafeguarded ModelsThe distilled models lack safeguards and could be used for malicious purposes such as offensive cyber operations, disinformation campaigns, mass surveillance, and censorship. | AML.TA0011 AML.T0048.002 |
| 7 | Create User-Harm Risk with Unsafeguarded ModelsThe distilled models lack Claude's safety guardrails, potentially exposing users to harmful outputs and behaviors. | AML.TA0011 AML.T0048.003 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0056-claude-model-distillation-campaigns; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0056 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).