If you're procuring AI at any meaningful scale right now, this week's story might just help you negotiate better the AI vendor contracts sitting on your table.

This week, Anthropic made one of the most striking accusations in the short history of the post-ChatGPT AI industry. Here are the findings from what they’re calling an "industrial-scale distillation attack."

DeepSeek ran over 150,000 exchanges focused on foundational logic and alignment, probing how Claude handles policy-sensitive queries. Moonshot AI ran 3.4 million exchanges targeting agentic reasoning, tool use, and computer vision. Anthropic described one operation from another Chinese lab running a hydra cluster: tens of thousands of simultaneous accounts spreading requests across different API keys and cloud providers to evade detection. When Anthropic released a new Claude model, traffic specifically redirected to harvest the latest version the moment it went live.

This technique has a formal name: model distillation. A smaller model learns by studying the outputs of a larger, more capable one. In their perspective, doing this through fraudulent means constitutes IP theft, a terms of service violation, and a national security concern, for obvious reasons.

The findings were independently reported by Bloomberg, CNBC, and CNN on February 23 and 24. None of the named labs had publicly responded at the time of publication.

This wasn't the first time. Earlier that month, another major American AI lab sent an open letter to U.S. legislators citing the same actor, describing new and obfuscated extraction methods still being developed. In February 2026, Google's Threat Intelligence Group published its own AI threat tracker documenting a surge in what it independently calls "distillation attacks." Google observed the same pattern from private sector entities across the world, and described the underlying mechanism in plain terms: using legitimate API access to systematically clone a model's reasoning without building the underlying capability yourself. Their report also notes that this activity "effectively represents a form of intellectual property theft."  

Two of the industry's largest labs, in the same quarter, documenting the same attack pattern.  

Here's where the recipe metaphor earns its keep.

Every chef learns from dishes they didn't invent. Every engineer builds on papers they didn't write. The question was never whether knowledge gets passed around: it's whether that passing was consented to, compensated for, or at minimum acknowledged.

Which brings us to a question worth sitting with: Is Google or Anthropic itself cooking from someone else's recipe?

The answer: not from other models. From us, and our omnipresent online lives.

In September 2025, Anthropic settled a $1.5 billion copyright lawsuit. Authors whose books were used to train Claude, without permission and without payment, brought the case.

The mechanism was different from what the Chinese labs did. The underlying pattern is the same. Take work that others produced. Use it to build something more capable. Settle the terms of that extraction later, if at all. The same logic, applied to intellectual property at a scale the law hadn't caught up to yet.

What distinguishes what the labs did this week is specific: fraudulent account creation, scripted extraction at scale, coordinated evasion of detection. Distillation itself is the modern foundation of today's AI industry. What this story contests is the covert, high-volume variant run through fake accounts, not the principle itself, which much of the "open" AI ecosystem quietly depends on.

So what does this mean for the people in the room making AI decisions?

Enterprises buying AI on the basis of ethical provenance are placing a bet on contested ground. And most procurement frameworks today weren't built for that terrain.

Model provenance hasn't attracted scrutiny proportionate to the millions in contract value being placed on it. When a CIO or CTO chooses a frontier AI platform because of its safety reputation, its responsible AI commitments, its stated values: they're making an assumption about consistency and heritage. That the company publishing responsible scaling policies applied those same principles when building these models.

That assumption is harder to defend this week than it was last week. There is no clean supply chain in frontier AI. Every leading model carries accumulated intelligence from content it didn't commission, work it didn't license, outputs it didn't pay for. Those definitions are still being written, by an industry building on foundations it hasn't fully paid for.

The relevant question for 2026 isn't whether this happened. It's whether your procurement and governance frameworks are calibrated for a world where every AI model's origin is, to some degree, contested.

Model lineage, training data provenance, the basis on which these “intelligent” capability was built: these are legitimate procurement questions. They are largely absent from current enterprise contracts. The vendors setting the terms of this debate are the same vendors seeking multi-year contracts on the basis of those terms. Independent verification is the response that every legal and governance team needs to add to their war room action list.

The implication for enterprise AI leaders could be huge. Model provenance and distillation risk belong in the same evaluation criteria as accuracy and cost, and that conversation is already overdue as enterprises move past pilots projects.

Thankfully, the regulatory framework already exists. The EU AI Act and California's AB 2013, both operative in 2026, require documented training data disclosure for high-risk AI systems. In 2025, Italy's data protection authority fined a major AI lab €15 million for training data violations.  

The governance pressure is arriving from the outside, and eventually from within most boards. Most procurement frameworks cannot evolve fast enough. So change what you control: your contract questions.

Ask for the receipt. Training data disclosures, model lineage, distillation risk, and third-party verification. If they cannot show it, do not buy the story.

Runtime Check

Three points to bring up in your next meeting:

• What a vendor says about ethics and what's inside their model are two different things. Responsible AI commitments describe intent going forward. They say nothing about what data built the model, whether it was licensed, or whether creators were compensated. Most enterprise AI contracts don't require vendors to answer those questions. That gap in transparency is getting harder to ignore.

• The attack method documented this week is now public knowledge, and most enterprise AI policies were written before it existed. Proxy clusters, scripted API sessions, rotating account keys: these aren't exotic techniques anymore. If your organisation's AI usage policy hasn't been updated to account for how capability can be covertly extracted from a model, you have a structural blind spot. So does almost everyone else, which is precisely why it matters who moves first.

• Inside most organisations, nobody actually owns the question of where a model came from. Training data and licensing questions get split across Legal, Procurement, and IT, with each team holding part of the picture and none holding all of it. That fragmentation stays invisible until a customer dispute, a regulator, or a board member asks a question that suddenly requires someone to have the full answer.

Runtime Check for CXOs

Enjoyed the read? Let’s take it further.

Connect to unlock exclusive insights, smart AI tools, and real connections that spark action.

Schedule a chat to unlock the full experience