Anthropic names Z.ai in Claude-copying claim, cites 99% cut

By TechPulse USA

Anthropic has just done something no frontier AI lab has dared to do this loudly: it named a publicly traded Chinese company as a thief of its AI, put a number on how much of the theft it has stopped, and then compared its own defences to the ones that keep Claude from helping build bioweapons. The catch? Every number in the announcement comes from Anthropic itself. And that should make you read the whole thing twice.

On Monday, the California-headquartered company published a blog post — "Strengthening our defenses against distillation attacks" — claiming that new safeguards restricting access to Claude's protected reasoning have cut the data harvested in so-called distillation attacks by roughly 90 to 99 per cent. The volume of reasoning tokens extracted by distillers, it says, is now "10 to 100 times lower than it was before." The detection system, in Anthropic's telling, is "roughly as robust as those that prevent Claude from helping build bioweapons" and carries a false positive rate of less than 0.1 per cent. Reuters reported the disclosure on Monday (Oct 12, US time), and it landed on the wire early Tuesday in India.

That is the press release version. Here is the version with the caveats left in.

Anthropic CEO Dario Amodei onstage at TechCrunch Disrupt 2023. Anthropic's latest disclosure puts a company he co-founded at the centre of the US-China fight over AI model distillation. Photo: Kimberly White for TechCrunch, CC BY 2.0 via Wikimedia Commons (file photo).

The 99 per cent that is really a 10-to-100-fold guess

Start with the arithmetic, because the headline number is doing a lot of quiet work. A reduction of 90 to 99 per cent and a 10-to-100-times drop are the same claim wearing different clothes. And that is a wide range — the top end is ten times better than the bottom end. As the AI-policy outlet alfw.ai noted in its analysis of Anthropic's post, the company publishes a before-and-after chart of estimated daily extraction but not the underlying numerical series, no reproducible calculation, and no campaign-level breakdown. You cannot independently reproduce the estimate.

That matters because there is a mundane explanation the numbers cannot rule out: less extraction can also mean less trying. Attackers may simply be probing less, or — and this is the one Anthropic itself acknowledges — they may be shifting their extraction to other models or other providers. Displacement is not defeat. If the burglar leaves your house and tries next door, your alarm statistics will look excellent and the street will not be safer.

The false-positive figure deserves the same care. A classifier false-positive rate below 0.1 per cent is not the same as "fewer than 0.1 per cent of legitimate developer accounts got banned." Anthropic does not disclose how many legitimate requests were affected, nor how many bans were appealed. It does acknowledge the trade-off: some developers have had to update their integrations, benign requests can occasionally be blocked, and — here is the detail that should make every Claude developer sit up — certain blocked requests became billable on September 24. Anthropic is now charging some customers for the requests it refuses to answer. That is quite the business model innovation: the bouncer makes you pay for the privilege of being turned away.

How the defences work — lock the brain, watch the doors

Technically, the announcement describes two moves. First, Anthropic restricted access to Claude's reasoning — the chain-of-thought that is the crown jewel for anyone trying to train a cheaper model on Claude's outputs. This is not the first time the company has used this lever: when Claude Fable 5 launched in June, three query categories (cybersecurity, biology and chemistry, and suspected distillation attempts) triggered a fallback to the older Claude Opus 4.8 model instead of Fable answering directly. The new disclosure appears to be the same doctrine, hardened.

Second, the company says it made it harder to run repeated probes through proxy networks — the standard industrial tradecraft for evading detection — and banned tens of thousands of accounts it linked to distillation campaigns. The scale of the ban wave is the one figure that does not need methodology to impress: tens of thousands of accounts is an industrial operation being dismantled, not a handful of researchers overstepping terms of service.

Fable 5 is worth dwelling on, because it is the model at the centre of this fight. Anthropic's most capable public model, released June 9, priced at $10 per million input tokens and $50 per million output tokens, it was built with safeguards for exactly this scenario. According to alfw.ai's reading of Anthropic's post, Z.ai specifically targeted Fable 5's cybersecurity capabilities during GLM-5.3's development — and, after hitting the safeguards, switched to an older Claude model and a model from another company entirely. That last bit is Anthropic accidentally admitting the displacement problem in its own evidence: the wall works, so the climbers went to a different wall.

A data centre server room. Anthropic says it has made it harder for attackers to use proxy networks to repeatedly probe Claude's protected reasoning at scale. Photo: Fleshas, CC BY-SA 3.0 via Wikimedia Commons (file photo).

The accusation: a listed company, named in public

The boldest sentence in the whole disclosure is not a number. It is a name. Anthropic cited Chinese AI startup Z.ai — also known as Zhipu, ticker 02513 on the Hong Kong exchange — as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model, and warned the practice poses safety and national security risks. Z.ai did not immediately respond to Reuters' request for comment.

Keep the two claims separate, because the reporting does. Anthropic says it introduced technical restrictions and banned tens of thousands of accounts — that is its own operational record. It separately attributes a GLM-5.3-related distillation campaign to Z.ai. The public evidence for both comes from Anthropic. The allegation is not, at publication time, an independent finding or a court ruling.

What is Z.ai? This is not a garage startup. Founded in 2019 as a commercialisation of Tsinghua University research, it listed on the Hong Kong Stock Exchange on January 8 this year, billing itself as the world's first listed large language model company, with an issue price of HK$116.20 and a market capitalisation above HK$52 billion on listing. GLM-5.3 — the model at issue — was released on Z.ai's own API on August 14 as a 744-billion-parameter mixture-of-experts coding and agent model, with open weights following on Hugging Face on August 28. On October 5, Amazon added GLM-5.3 to Bedrock under a revenue-sharing deal, giving a Chinese open-weight model a front door inside the cloud platform most American enterprises already trust. Shares of Zhipu jumped more than 7 per cent on the news.

Pause on that timeline. A company accused by Anthropic of distilling Claude is simultaneously signing revenue-share deals with Amazon to serve American enterprise customers. That is not a contradiction — it is the whole geopolitical knot in one paragraph. Washington's chip controls try to slow Chinese labs down; American cloud platforms are selling their finished models to American buyers. The chip war and the model war are two different fights, and they have two different winners.

This is the same war — and the file is getting thicker

None of this arrives cold. We reported in September on Washington's accusation that China's Moonshot AI conducted "large-scale, covert industrial distillation" to build its Kimi K3 model from Anthropic's Fable — a charge levelled publicly on X by White House science and technology adviser Michael Kratsios, with Treasury Secretary Scott Bessent warning on X that "open source is not open season on American IP." That was followed by a joint NSA, CISA and FBI advisory on September 9 accusing six Chinese AI companies — DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI — of extracting "billions of tokens across millions of exchanges" from American frontier models since 2024, and by Anthropic's own 154-page September threat intelligence report alleging close to 200 million instances of malicious access.

The expert pushback then is worth remembering now. Braden Hancock, a researcher at the Laude Institute and co-founder of Snorkel AI, told TechCrunch: "You can't distill that much data, train a model, and release it in two weeks." AI researcher Nathan Lambert concluded distillation from Claude was "clearly part of the story" but "clearly nothing close to the whole story." Those cautions apply with full force to the Z.ai allegation: naming a company is not the same as proving a model's parentage, and Anthropic's September report attributed its largest quantified campaigns to Alibaba, not to the companies making the headlines.

The political frame has only hardened since. As we reported, Representative Ro Khanna has demanded that the CEOs of OpenAI, Anthropic, Google, Meta and SpaceXAI hand over data on every known Chinese attempt to get their model weights. "You cannot trust Silicon Valley tech billionaires to write the rules to keep us safe," Khanna told Reuters. Read Anthropic's disclosure in that light and it looks less like pure transparency and more like a pre-emptive filing: the lab showing Congress its homework before Congress starts grading.

The uncomfortable fine print

Strip away the rhetoric and three problems remain, all of them acknowledged somewhere in the fine print.

First, the evidence is entirely self-reported. Anthropic's internal monitoring is the only instrument measuring the drop, and the company publishes a chart without the numbers behind it. That is not how you settle a scientific claim, and it is certainly not how you settle an accusation against a listed company in another country. Reuters, to its credit, reported the allegation as Anthropic's claim with a noted non-response from Z.ai — which is exactly the distance the rest of the coverage should keep.

Second, the defences tax the innocent. Developers who depend on Claude's preserved reasoning context have had to rewrite integrations; a small share of benign requests get blocked; and blocked requests now cost money. A safeguard system "roughly as robust" as a bioweapons guardrail sounds reassuring until you remember that bioweapons guardrails are deliberately conservative — they are designed to catch harmless things rather than miss dangerous ones. In a safety context that is prudent. In an API business it is a customer-service problem, and Anthropic has chosen to bill through it.

Third, and most important, there is the displacement problem, which Anthropic's own evidence concedes. Z.ai allegedly switched to an older Claude and another company's model. Fine — but "another company's model" is doing a lot of work in that sentence. If the distillation economy simply migrates to whichever frontier lab has the weakest locks this quarter, then Anthropic has won a battle and advertised its address to everyone else's attackers. The moat is real. It is also, by definition, only as wide as the industry's weakest wall.

The Z.ai–Claude distillation FAQ

What is AI model distillation? Training a cheaper model on a frontier model's outputs to copy capabilities faster — the practice Anthropic, OpenAI and Google say lets rivals reproduce advanced capabilities at lower cost (Reuters, Oct 12).

Did Anthropic prove Z.ai copied Claude? No. Anthropic said Z.ai "attempted to distill capabilities from Claude" while developing GLM-5.3; Z.ai did not respond to Reuters' request for comment.

What does the 90–99% claim actually measure? The volume of data harvested in distillation attacks — separate from the "10 to 100 times lower" figure, which is reasoning tokens extracted (Anthropic blog, Oct 12).

Is distillation illegal? Anthropic frames it as a safety and national-security risk; no court has ruled on this specific accusation.

Related: the US government's own case against Chinese AI labs; Claude has been misused before — by hackers; Beijing is tightening the screws on its own AI talent.

Our read: a moat announcement dressed as a safety report

Let us be honest about what this document is. It is, simultaneously, a genuine security milestone and a shrewdly timed piece of corporate positioning. The milestone is real: tens of thousands of banned accounts and a 10-to-100-fold drop in extracted reasoning tokens, even taken at face value, describe a serious defensive engineering effort — the kind of work that keeps frontier capability expensive to steal and cheap to license legitimately. The labs that survive the next decade will be the ones that treat their APIs like vaults, and Anthropic is showing its vault has a new lock.

But the timing is not innocent, and the framing is doing double duty. A disclosure that names a Hong Kong-listed company, invokes bioweapons-grade robustness, and warns of national security risks is not just a threat-intelligence report — it is an argument aimed at three audiences at once: Congress, which is deciding whether the labs can be trusted to police themselves (Khanna has already answered no); investors, who need to believe the technological lead is defensible; and competitors, who are being warned that Anthropic will name names. Whether the defences actually hold — against attackers who have already demonstrated they simply move to the next unlocked window — will decide whether this was a turning point or a speed bump with good PR. The numbers are encouraging. They are also, for now, Anthropic grading its own homework.

One more thing the announcement quietly confirms: the distillation wars are no longer about proving theft happened. They are about who gets to set the terms of the next accusation. Anthropic has moved from victim to prosecutor, and it chose a listed company as its first public defendant. Beijing, Washington and every frontier lab will be reading this one closely — because the next name on the list could be anyone's.

The broader pattern of AI security incidents — from rogue agents to infrastructure probes — suggests this will not be the last such disclosure. The vaults are getting better locks. The thieves are getting better tools. The race, as ever, is on.

Sources

Reporting drew on Reuters ("Anthropic says new safeguards sharply reduce AI distillation attacks," Oct 12, 2026, by Mrinmay Dey); Anthropic's blog post "Strengthening our defenses against distillation attacks" (Oct 12, 2026) as analysed by alfw.ai; Startup Fortune on Z.ai's GLM-5.3 and its Amazon Bedrock listing; TechCrunch reporting on the Moonshot/Kimi dispute and expert responses; and TechPulse USA's prior coverage of the Moonshot distillation allegations and the Khanna letters. Direct quotes are from published interviews, official posts and congressional letters; the Z.ai allegation is reported as Anthropic's claim, with Z.ai's non-response to Reuters noted. Figures on Z.ai's listing (Jan 8, 2026; ticker 02513) are from the company's listing announcements via PR Newswire.

---

By TechPulse USA — TechPulse USA is an independent tech news publication covering the global AI race with a US-first lens. We verify every fact we print, link our sources, and separate what is proven from what is claimed.