Twenty-three million interactions across five thousand three hundred and eighty accounts. Twelve million more compressed into fourteen days. Those are the only hard numbers in a story that has otherwise been assembled entirely out of inference, and they are the numbers that tell you least about what actually happened.
On September 10, a report attributed to The Information โ relayed onward through crypto news channels, now arriving at you third-hand โ alleged that China's cybersecurity regulator had opened inquiries into two domestic AI laboratories, DeepSeek and Moonshot, over their use of Anthropic's Claude API. The proximate trigger: an Anthropic threat-intelligence report naming seven Chinese firms for what it called "illegal distillation." Seven were named. Two are reportedly under investigation. No regulatory document has been published. No company has confirmed it is a subject. The sourcing is anonymous, and the primary fact-base is the accusation of a direct competitor.
I have spent enough years auditing systems that I no longer treat a document's provenance as a footnote. It is the first line of the finding. Solitude is the only auditor that never sleeps โ and the corollary is that whoever commissions the audit chooses the question.
Context: what distillation is, and what it is not
Distillation is not a hack. It is the ordinary practice of training a smaller model to reproduce the behavior of a larger one, using the larger model's outputs as supervised targets. OpenAI does it. Google does it. Anthropic does it against its own models. Chinese open-weight releases have made cross-vendor distillation part of the open ecosystem's normal metabolism.
Anthropic's own framing concedes this. Distillation is legal; the word doing the work in the accusation is "illegal," and the illegality attaches not to the technique but to the access path โ accounts allegedly opened through misrepresentation or region-shifting.
That distinction matters enormously, and it collapses the moment the phrase leaves a technical audience. A terms-of-service breach is a contract dispute. A fraudulent account signup is a computer-fraud question with a narrow, contested statutory footprint. Neither is data theft in the sense the word "distillation" now implies. Code is law, but conscience is the interpreter โ and so is whoever writes the press release.
Core: the arithmetic does not support the alarm
Run the numbers a technical reviewer would run.
Moonshot: 5,380 accounts, roughly 23 million interactions. DeepSeek: 12.1 million interactions across fourteen days. At an average output of 300 to 1,000 tokens per call โ generous for a chat endpoint โ Moonshot's cumulative draw lands between 70 and 230 billion tokens. DeepSeek's two-week window lands between 3.6 and 12 billion.
Set that against the training corpora we actually know about. GPT-3: roughly 300 billion tokens. Llama 3: on the order of 15 trillion. The alleged volume is a rounding error against the pretraining budget of any frontier model. If the goal was bulk data acquisition, it was a failure. If the goal was capability transfer, it may have been cheap and effective โ and that is a different accusation entirely.
Here is where my audit background sharpens the reading. In 2017, reviewing a provenance startup during the ICO boom, I refused to sign off on a rushed mainnet because five metadata-exposure vulnerabilities had not been closed. What I learned from that refusal is that the vulnerability people argue about is rarely the one that matters. Nobody argued about the encryption suite; everyone argued about the launch date.
The same shape appears here. The scarce asset is not tokens. It is reasoning traces, code synthesis, and above all the alignment style โ the refusal behavior, the hedging patterns, the shape of a well-behaved answer. Those are the most expensive things to produce and the easiest things to imitate. Two hundred million tokens of ordinary chat is worthless. Two hundred million tokens of a safety-tuned frontier model's reasoning chains is a compressed syllabus.
That is why the phrase "illegal distillation" reads as engineered rather than discovered. It relocates a disagreement about terms of service into the vocabulary of espionage, where no counterargument sounds proportionate.
The second half of this story is that Beijing's interest and Anthropic's interest do not overlap. The regulator is not investigating whether Chinese labs copied Claude. It is investigating whether Chinese data went out โ whether prompts containing regulated material crossed a border and landed on servers in the United States.
Those are different questions with different answers and, crucially, different remedies. One is answered by a contract. The other is answered by a border.
I spent part of 2024 working with a small European legal team drafting governance standards for staking pools, and the lesson that stuck was this: technical facts do not have a single legal identity. The same transaction can be a custody arrangement in one jurisdiction, a securities offering in another, and a data transfer in a third. Regulators do not discover facts; they select frames. And the frame a regulator selects determines who is liable, for what, and how much.
Which produces the inversion almost nobody is discussing. If the allegations are accurate โ if sensitive material did pass through Claude โ then the entity now holding that material is Anthropic. The accuser would also be the custodian. I have not seen a single line about how that data is stored, whether it is used for training, or what the retention schedule is. An accusation of data mishandling that does not examine the recipient's own handling is not a safety finding. It is a positioning statement.
Widen the lens and the industrial consequence is already visible. If Chinese labs were leaning on foreign inference endpoints for capability, then some portion of the domestic "autonomous capability" story rests on imported computation โ a dependency that survives only as long as nobody asks. Regulators eventually ask. Substitution then arrives not as a choice but as a compliance line item.
Contrarian: the winner is not the accuser
The prevailing read is that Anthropic exposed a competitor and China's regulator corroborated it. I think that reading inverts the causality and misidentifies the beneficiary.
Consider the incentives. Anthropic's revenue depends on its API being used; its differentiation depends on being trusted. Those two dependencies point in opposite directions, and always have. Every hosted model provider faces the same structural deficit โ you cannot sell inference at scale and simultaneously control what the buyer learns from it. Watermarking and output perturbation are mitigations, not solutions; they degrade the product customers are paying for. The API economy's foundational promise is that outputs are fungible. That promise is the vulnerability.
So what did the accusation actually purchase? A policy audience. A brand position. A narrative in which safety leadership and market position are the same thing. And a durable liability: every enterprise contract now asks whether their own outputs are being audited and attributed.
Meanwhile the entities that gain most from this story are the ones never named in it โ domestic model vendors positioned as the safe substitute, provenance and fingerprinting services that convert uncertainty into billable verification, and every data-compliance practice that will now charge for a question nobody asked two years ago.
There is a harder truth buried here too. The loudest voice is rarely the most aligned. An industry that spent years insisting open protocols would route around institutional control is now watching its most advanced capability contested not in code but in memoranda โ and discovering that the decentralization it evangelized never extended to the weights.
Takeaway
Three signals will resolve this, and none of them is a media cycle. Watch the regulatory characterization: "violation" and "compliant" are not synonyms, and the choice of word is the whole policy. Watch whether the threat-intelligence report is ever published with verifiable call-level evidence, because an accusation that cannot be audited is a marketing document with a footnote. And watch whether Washington moves to treat API access itself as an export-controlled item โ that, more than any fine, would end the era in which capable models were a click away for anyone with a credit card.
The question worth sitting with is not whether these two labs did what they are accused of. It is whether we still believe capability should circulate freely โ or whether we have quietly decided it should circulate only between parties who already agree with each other.