Anthropic disclosed in February that three Chinese AI labs, DeepSeek, Moonshot AI, and MiniMax, ran more than 16 million conversations with Claude through over 24,000 fake accounts. Anthropic said the labs targeted Claude’s most distinctive strengths, singling out coding, tool use, and agentic reasoning, TechCrunch’s Rebecca Bellan reported. David Rosenthal, the digital-preservation researcher who writes DSHR’s Blog, argues the episode proves something larger: frontier AI labs have no durable defense against distillation, only an expensive arms race they are likely to lose.
Distillation, extracting a rival model’s capabilities through repeated queries, is not new. Elon Musk testified in a California federal court in April that xAI used distillation techniques on OpenAI’s models to train Grok, calling it a general industry practice, TechCrunch’s Tim Fernholz reported. Rosenthal’s underlying point is structural: an LLM’s only function is answering queries with a slice of what it learned in training, so enough queries can reconstruct the parts a competitor is missing. No copyright or patent law protects the resulting weights, leaving trade secrecy and terms-of-service violations as the platforms’ only defenses, both weak against a determined distiller.
The exchange counts Anthropic disclosed show why catching up keeps getting cheaper. MiniMax needed more than 13 million exchanges with Claude to approach its capabilities, Anthropic said, while DeepSeek needed only around 150,000 and Moonshot AI’s Kimi model needed roughly 3.4 million. The UK’s AI Security Institute found that today’s cyber-capability gap between GLM-5.2 and DeepSeek V4-Pro on the open-weight side and the closed frontier has narrowed to four to seven months, down from six to ten months through most of 2025. Rosenthal reads that trend as evidence the frontier is flattening: the closer open models get, the fewer queries a distiller needs to close the remaining distance.
Anthropic says it has built behavioral fingerprinting systems and traffic classifiers to catch distillation patterns, including detection of chain-of-thought elicitation used to harvest reasoning data, plus tools to flag coordinated activity across many accounts. The company also concedes, in its own published account, that no single lab can solve the problem alone, and that stopping distillation at this scale will require cloud providers and policymakers to join the effort alongside AI companies. Rosenthal points to a live example of the scale problem: the Free Software Foundation’s Ian Kelling reported that a botnet of roughly five million IP addresses has been hitting its GNU Savannah servers since January, probably to assemble a dataset for training a language model. Spread across that many addresses, MiniMax’s 13 million exchanges would work out to under three queries per address, too little traffic for any fingerprinting system to flag.
Rosenthal’s core claim is that raising prices will not fix this either. Pricing high enough to make botnet-scale querying uneconomic would also push away the enterprise customers frontier labs need to service the debt funding their data centers, a dynamic he has separately labeled AI’s affordability crisis. A free tier that lets anyone run a limited number of queries is also central to how these companies acquire users, and a botnet address using a handful of free queries never crosses into paid, metered traffic at all.
AI Insiders has tracked open-weight releases from DeepSeek and Moonshot closing on frontier benchmarks for two years; Rosenthal’s exchange data gives that trend a mechanism, not just a coincidence of parallel research. If a leading lab’s edge amounts to a shrinking, temporary head start rather than a defensible barrier, anyone pricing a trillion-dollar valuation on durable capability advantage is underwriting a debt-funded arms race, not a monopoly. Investors and enterprise buyers evaluating frontier contracts this quarter should ask each lab what its distillation defenses cost per query and how many months of lead that spend is actually projected to buy.
Analysis by David Rosenthal on DSHR’s Blog, July 2026.
