Two hundred million exchanges.
That is the number Anthropic put on the table. Five campaigns. Seven Chinese labs. One of them — Alibaba's Qwen — allegedly responsible for 151 million of them. Peak throughput near three million requests per day. Roughly 3,500 accounts doing the work. A second cluster tied to Moonshot, a third to DeepSeek, which reportedly contributed 12 million exchanges inside a single fourteen-day window in July.
Now read the timestamp.
The events are pegged to September 2026. My calendar says it is May. Either the chronology is a typo, the document is predictive fiction, or it is an internal stress test that escaped containment. Code doesn't argue with timestamps. It also doesn't lie about them. A date that has not happened yet is the first flag on the field.
Then trace the pipe. The material arrived through a blockchain and Web3 news feed. The content has almost nothing to do with crypto. That detail matters more than it looks. It tells me the editorial chain that pushed this had no specialist review at the AI layer — and no specialist review at the crypto layer either. So I did what I did with forty-plus ICO whitepapers in late 2017: I read it line by line, and I distrusted every number that could not be independently reconstructed.
This is not an AI story with a crypto sidebar. This is an attribution story. And attribution is the exact problem every settlement layer in this industry has been grinding on since 2015.
Context: What the Report Actually Claims
Strip the adjectives and the technical claim is narrow.
Model distillation is not exotic. It is a well-understood capacity-transfer technique. A "teacher" model produces outputs. A "student" model trains on those outputs. The student inherits some of the teacher's behavior at a fraction of the training cost. When the outputs are chain-of-thought traces — the step-by-step reasoning — the transfer is more valuable, because you are not just copying answers, you are copying the method that produced them.
That is the mechanism Anthropic is describing. Its accusation is not that Chinese labs broke mathematics. Its accusation is that they broke terms of service, then converted that breach into competitive product.
The staggering of the documentation is what gives the game away. A joint CISA/FBI/NSA bulletin lands on September 8. Anthropic's own report lands on September 10. Two days apart. Government accusation plus corporate evidence equals a public record built for downstream use — future enforcement, trade negotiation, and, per the reporting, an Anthropic IPO target reported near $965 billion.
I have seen this architecture before. It is the same architecture the SEC used during its regulation-by-enforcement decade in crypto. The agency never published the bright-line rule. It published the case. Then it let the market infer the rule from the settlement. Withholding clarity is not ignorance of the technology. It is a deliberate strategy: ambiguity keeps discretion in the enforcer's hands.
The tell here is the open-weights fight from July. Twenty-five technology companies signed a letter supporting open-weight distribution. OpenAI and Anthropic did not sign. That is consistent positioning. A firm that treats distillation of its closed frontier model as intellectual property theft is not going to bless a norm of open redistribution. The Sept 10 report is the same position, restated with a national-security envelope.
And I have to mark the confidence level honestly. Almost every number in this story comes from a single interested party. Anthropic is the accuser, the evidence-builder, and the beneficiary of the narrative. When a financial auditor gets a schedule of transactions from one side only, they do not sign off. They qualify. My qualification on this entire report: confidence C, trending C-minus.
Core: The Evidence Chain, Deconstructed
1. Telemetry is a signal, not a proof
Here is the actual detection surface. When Anthropic says it identified seven labs across five campaigns and 3,500 accounts, it is describing API telemetry — not a confession.
What telemetry can see:
- Account graph: a cluster of accounts created from shared infrastructure, funded from correlated sources, or behaving in lockstep.
- Behavioral fingerprint: request cadence, prompt templates, token distribution, temperature settings, and retry patterns.
- Geographic anomaly: traffic routed through third countries that does not match any legitimate user base.
- Output watermarking: statistical marks embedded in the model's responses that survive downstream copying.
- Canary tokens: bait content seeded into responses so that if it shows up in a competing model, the lineage is provable.
What telemetry cannot see:
- Intent. A hedge fund running 3 million API calls a day is not necessarily distilling. It might be stress-testing, or synthesizing data, or building an agent swarm.
- Provenance of a distant student. You can prove that a competitor's output correlates with yours. You cannot, from correlation alone, prove the training pipeline that produced it.
The report does not publish its false-positive rate. It does not disclose the watermark robustness. It does not give the attribution threshold — how many standard deviations of behavioral overlap trigger a "campaign" label. Without those numbers, you cannot audit the claim, only receive it.
Code doesn't ship a fraud detector without a precision-recall curve. Neither should a national-security accusation.
2. Distillation versus legitimate concurrency
The single biggest unaddressed question in the whole document is the boundary between two things that look identical on the wire.
Legitimate high-concurrency API use and distillation training generate the same packet shape: many requests, rapid succession, templated structure, coherent output capture. The technical difference is neither enforced nor enforced-able at the API layer alone. It is a contractual difference — what the terms of service say you may do with the outputs — not a physical one.
This is where the report performs a sleight of hand. It binds three very different acts into one phrase: "intellectual property theft."
- Act one: high-volume API usage. Legal, paid, within many contracts' plain letter if not spirit.
- Act two: training a student on teacher outputs, in violation of usage terms. A breach of contract.
- Act three: using distilled capability to undercut the teacher's price in the open market. A business competition claim.
The narrative fuses one into two into three, so that a permissible act inherits the moral weight of a crime. That is not a technical conclusion. It is a rhetorical construction. And in my experience, when a report needs the rhetoric, the technical chain usually has a soft link somewhere.
3. The economics: whose margin is being compressed
The most substantive sentence buried in the material is not about national security. It is about pricing.
Western frontier suppliers have watched their margins compress because Chinese labs ship comparable capability at a lower price. The report argues that if part of that efficiency came from extracting Claude's reasoning patterns, then the price war is no longer "architecture innovation versus architecture innovation." It is "unlicensed extraction subsidized by the victim."
It is a real argument. It is also unfalsifiable as stated, because we have no decomposition of how much of Qwen's, Kimi's, or DeepSeek's capability comes from distillation versus original architecture work versus their own reinforcement learning. Distillation might be 5% of the gain or 40%. The report leaves the biggest variable blank and then builds a margin story on top of it.
And here I have to flag my standing bias, because it is load-bearing on this exact section. Oracle feed latency is DeFi's Achilles' heel. Chainlink solving decentralization with a curated node set is its own joke. Why does that matter to an AI accusation? Because the same disease is present on both sides of this fight. An attribution system that relies on a single party's unilateral telemetry, unverified by any third party, is the AI equivalent of an oracle that reports a price nobody else can independently check. You are trusting the reporter because the reporter is the only one with the tape.
4. The pre-mortem: how this claim fails
I run a failure-first analysis on everything. If the Anthropic claim is wrong, or unprovable, here is the sequence in which it breaks.
Failure mode one: correlation theater. Watermarks and behavioral fingerprints degrade. Vendors paraphrase, filter, and mix distributions. Within one generation of defensive engineering, the statistical signal washes out. Then the accusation survives only on accounts and geography — the weakest, most court-contestable layer.
Failure mode two: collateral damage. Aggressive geofencing and KYC at the API layer does not just hit suspected distillation operations. It hits legitimate research, third-country startups, and every developer who happens to sit behind the wrong proxy. Compliance cost becomes an innovation tax on the innocent.
Failure mode three: the self-bootstrap objection. A capable lab can generate synthetic data from its own models and never needs a teacher. If that is what actually happened, the entire extraction narrative is a spurious causal story imposed on an independent capability.
Failure mode four: enforcement vacuum. A public record is not an indictment. If no regulator, court, or trade authority actually acts, the report's lifespan collapses into IPO marketing and cultural grievance. The strongest evidence for this risk is that the two most consequential numbers — the $965 billion valuation and the 200 million exchanges — cannot be independently checked, while the least consequential — the September bulletin date — is the one stamped with government certainty.
The through-line: an accusation is only as strong as its weakest verification link, and this chain's weakest link is that all of it is self-reported.
5. The crypto bridge: verifiable inference is the missing layer
This is where the story stops being an AI story and becomes a settlement story, and where crypto's decade of hard lessons becomes directly load-bearing.
Everything the crypto industry learned about proving state transitions in an adversarial environment applies verbatim to proving which model trained on whose outputs.
The problem structure is identical:
- Two parties disagree about what actually happened in a computation.
- Neither trusts the other's logs.
- A third-party adjudicator needs a proof it can check cheaply.
Crypto solved this with two families of technology, and both map onto the distillation dispute.
Optimistic proofs. You assume the computation is valid, publish it, and allow a challenge window. Disputes get resolved out-of-band. This is the equivalent of "we believe your training pipeline is clean until someone demonstrates fraud." It is cheap, it is fast, and it is exactly as strong as the watcher's incentive to actually watch. History says watchers get lazy.
Validity proofs. You produce a cryptographic certificate that the computation was executed correctly, and anyone can verify it in milliseconds. This is the equivalent of "here is a zero-knowledge attestation that our inference ran on our own weights, over a declared corpus, producing these outputs." It is expensive and it is honest.
The distillation dispute is an optimistic-proof world with no challenge window and no proof. Anthropic publishes an assertion. Chinese labs publish denials. Nobody produces a validity certificate. The market is left to pick a side on identity, not on evidence.
There is a version of this future that is already being built. Trusted execution environments that sign inference outputs. Verifiable compute that attests to which weights were loaded. Content provenance standards that survive model-to-model copying. On-chain registries of model lineage. None of it is mature. All of it is the right shape. The industry that figures out a portable, third-party-checkable attestation of "this output came from these weights under these terms" will do more to end distillation disputes than any government bulletin.
And on the Layer 2 comparison I keep making: the real difference between OP Stack and ZK Stack was never the cryptography. It was who could convince more projects to deploy chains first. Adoption beat elegance. The same law is about to apply to attestation. The winning standard will not be the mathematically prettiest one. It will be the one that the most model providers, cloud vendors, and auditors agree to embed. Standards are a coordination game, not a proof contest.
6. The security footnote everyone will skip
One line in the material deserves far more attention than it got. DeepSeek's operation is alleged to have exposed real-time credentials for Russian government databases.
Read that slowly. The implication is that an extraction campaign ran adjacent to, or through, infrastructure holding live credentials into foreign state systems. Whether or not the credentials were used, the exposure exists. This converts a commercial dispute into a counterintelligence question.
From a forensic standpoint, this is the one element of the report that does not depend on watermark robustness or behavioral fingerprints. Exposed credentials are binary. They are either live or they are not. If that single claim can be independently verified, it is worth more evidentiary weight than the entire 200 million-swap statistical edifice, because it does not require anyone to trust Anthropic's opinion about what counts as a "campaign."
Contrarian: The Blind Spot in Every Take You Will Read This Week
Here is what the consensus commentary will miss.
Everyone is framing this as an AI governance story — model safety, export control, US-China tech decoupling. That framing is comfortable and it is wrong. Treat it instead as a fraud-proof problem, and the whole thing reorganizes.
The core failure is not that Chinese labs may have distilled. The core failure is that the industry has no portable mechanism to prove it either way, and it is building policy on top of a proof gap. That is precisely the mistake crypto made in its early token era: projects asserted utility, nobody could verify it, and the market priced narratives until the narratives collapsed.
There is a second blind spot, quieter and more dangerous. The report positions distillation as theft because the teacher model was built at great expense under a closed regime. But the entire premise of frontier training economics is that the value lives in the weights, not in any single output. If a handful of inference outputs can transfer meaningful capability, then the moat was never the weights — it was the assumption that nobody would systematically drain them. Distillation, if it works at scale, is not an attack on a business. It is a stress test that reveals the business model was thinner than advertised.
And a third: watch who gains from the prosecution versus who gains from the uncertainty. A clean rule would help everyone plan. Ambiguity helps exactly one party — the one holding the enforcement pen. This is the same dynamic I flagged with the SEC in crypto: the absence of a bright line is not a gap in the system. It is a feature of the system. Whoever controls the ambiguity controls the terms on which the next decade of cross-border model access is negotiated.
The angle almost nobody is reporting: if the $965 billion IPO figure is real, then the public record is not primarily a cybersecurity disclosure. It is a pre-money positioning document. The report needs a threat to justify a premium, and a state-level adversary is the most premium threat available. That does not make the accusations false. It makes them expensively motivated, which is a different kind of flag.
Takeaway
The number that matters is not 200 million. It is zero — the number of independent, third-party-verifiable proofs attached to this entire claim.
That is the real story, and it is the reason I stopped treating this as an AI dispute and started treating it as an infrastructure gap. Every sector that runs on trust-me-bro telemetry eventually discovers it needs a settlement layer that no single participant controls. Crypto discovered it with oracles. AI is about to discover it with training data. The two are converging in front of us, and the firms that build portable model-provenance attestation will end this debate more decisively than any joint bulletin ever could.
So here is the question I am holding into the next cycle: when a lab next accuses another of extraction, will anyone be able to check the math — or will we all be reading a press release and calling it evidence again?
