APIs Have Become the New Front Line in the AI Model Race

The competitive significance is straightforward. A frontier model represents years of research spending, scarce compute, proprietary post-training work and safety engineering. If another laboratory can repeatedly query that model, collect its strongest outputs and use them to train a student system, it may reduce the time and expense required to approach the frontier.

That does not mean an API attacker steals the teacher model’s weights. Neither company describes a database breach or direct access to stored user conversations. Rather, the allegation is that attackers used the model as a highly capable data generator. In that model, the API is not a window into parameters. It is a production line for examples of problem solving, tool use, coding and evaluation.

Anthropic said in its report on detecting and preventing distillation attacks that it identified alleged campaigns tied to DeepSeek, Moonshot and MiniMax that generated more than 16 million exchanges through roughly 24,000 fraudulent accounts. Anthropic said the campaigns focused on agentic reasoning, tool use and coding, and used proxy services, coordinated account activity and capability-specific prompting.

The most important implication is commercial, not rhetorical. A provider that sells API access may be financing legitimate customer workloads and, at the same time, subsidising a rival’s effort to reproduce its most valuable behaviours. The defence problem is therefore about preserving a temporary capability lead, safeguarding safety controls, and ensuring that API revenue does not become a discounted substitute for original model development.

What an API distillation campaign is trying to capture

In legitimate distillation, a model developer trains a smaller or cheaper model on outputs from a stronger model that it owns or is authorised to use. The purpose is efficiency. A compact student can inherit useful behaviours from a larger teacher and serve lower-cost workloads.

Adversarial distillation changes the permission and competitive context. The student developer does not control the teacher, does not have authority to reuse the outputs for training, and may attempt to defeat controls designed to prevent the transfer of high-value reasoning. The target is not necessarily every response. It is the narrow set of capabilities where the teacher is most differentiated.

That distinction matters because ordinary API use can look superficially similar. A software company may send thousands of customer tasks for summarisation, coding support or classification. An extraction campaign instead tends to turn requests into a structured data collection programme. It repeatedly samples a capability, varies tasks systematically, collects outputs in machine-readable form, and evaluates whether the collected material improves a student model.

The first stage is access. Anthropic described proxy networks that distribute traffic across large numbers of accounts and access pathways. In one case, it said a network managed more than 20,000 fraudulent accounts at once, mixing suspected distillation traffic with unrelated customer requests. That architecture makes an individual account disposable and makes traffic volume appear fragmented rather than centralised.

The second stage is task design. The objective is to construct prompts that yield reusable examples of a teacher’s strongest work. For a coding model, that may mean difficult debugging, repository reasoning, tool orchestration and structured evaluation tasks. For an agentic model, it may mean sequences that test planning, error correction and the selection of tools. Anthropic said the alleged campaigns concentrated requests on precisely these differentiated capabilities.

The third stage is especially valuable: reasoning. A final answer tells a student what conclusion to imitate. A useful reasoning transcript can reveal an intermediate path: how a task was decomposed, which constraints were checked, where uncertainty was identified and how an answer was verified. This does not disclose model weights, but it can make the output substantially more useful for post-training.

OpenAI said in its account of disrupting a coordinated model-distillation campaign that operators attempted to extract protected reasoning through prompt manipulation and by replaying encrypted reasoning across conversations. OpenAI said the activity did not involve breaking encryption, compromising a database or directly accessing stored user conversations. It said it disrupted a core cluster it attributed to individuals associated with Moonshot AI.

After collection comes cleaning. Raw API outputs are noisy. A training pipeline must remove malformed records, deduplicate near-identical examples, separate prompt from response, assign task categories and filter poor answers. If reasoning has been collected, the operator may attempt to align it with final answers and preserve the sequence of steps. The cleaned corpus can then support supervised fine-tuning, where a student learns to imitate outputs, or a reinforcement learning programme, where the teacher’s judgments are used as a reward signal.

That final distinction is important. A provider can be exploited as an answer generator, but it can also be used as a grader. Anthropic said one alleged DeepSeek operation included rubric-based grading tasks that made Claude function as a reward model for reinforcement learning. The value lies not simply in copying prose style, but in obtaining an external signal about which candidate solution is better.

Why low-volume traffic can hide a large operation

The traditional abuse model is built around a conspicuous account: one identity generating an unusually high number of requests, from one location, with one payment instrument. That model is poorly suited to an operation that distributes work across thousands of accounts, residential IP addresses, cloud pathways and account types.

A coordinated campaign can make each individual account resemble a small developer integration. The extraction pattern only becomes visible when the provider connects signals across accounts and time. Repetition matters. So do identical prompt structures, improbable synchronisation, shared payment features, similar task distributions and common infrastructure.

Anthropic said that the alleged DeepSeek campaign used synchronised traffic, identical patterns, shared payment methods and coordinated timing that suggested load balancing across accounts. It said Moonshot used hundreds of fraudulent accounts through multiple access pathways, while MiniMax redirected nearly half of its traffic to a newly released system within 24 hours. Those are not single-request signals. They are operational signals visible only after aggregation.

OpenAI’s reported July activity illustrates the same point. It said the campaign began at low volume on July 1, then spiked on July 24 and July 25, when it recorded 16,000 requests using a relevant extraction pattern from more than 4,000 users. It later identified related activity across a cluster of more than 15,000 users, which it said it had fully disrupted by July 28. OpenAI cautioned that the figures represented attempted, not necessarily successful, extractions.

For an API security team, the audit question is therefore not only, “Which account is abusive?” It is also, “Which accounts behave as one distributed data-generation system?”

Useful detection signals include:

• repeated semantic templates that seek a narrow capability across many accounts;
• task coverage that resembles a benchmark or curriculum rather than organic user demand;
• rapid duplication of a newly released model’s behaviours;
• account clusters sharing payment, device, infrastructure or timing characteristics;
• unusually frequent requests to reproduce, translate, reformat or restate previous reasoning;
• output collection patterns that favour complete, structured and highly reusable training examples;
• sudden shifts from broad experimentation to a concentrated capability harvest.

None of those signals independently proves copying. Together, they can establish a behavioural case strong enough to justify stricter verification, rate reductions, temporary holds or account enforcement.

The premium on reasoning data

Anthropic’s own evaluation provides the clearest available estimate of why providers focus their defences on reasoning. Anthropic reported in its explanation of strengthened distillation defences that a pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, compared with 71.8% when trained on summarised transcripts.

The 8.6 percentage point gap is not a universal valuation of reasoning traces. It is one reported result on one coding benchmark and one training setup. But it demonstrates the business logic of the attack. The more a provider reveals the reusable structure of expert problem solving, the more it may improve a competitor’s post-training data supply.

That makes output summarisation a strategic compromise. It can preserve enough explanation for a customer while reducing the fidelity of the material available to a student model. Anthropic said it began by summarising reasoning and later added safeguards intended to prevent users from moving protected reasoning between conversations, models, accounts and organisations.

What defences protect, and what they do not

No single mitigation protects every asset. API operators should be explicit about the target.

Reasoning summarisation protects the most information-dense traces, but it does not prevent collection of final answers. It reduces the value of leaked training data rather than eliminating the capability signal.

Preserved thinking and context controls protect the boundary around a reasoning artifact. Anthropic said its preserved-thinking approach prevents newer API accounts from editing prior context, while other restrictions limit access to reasoning across organisations and weaker models. These controls aim to stop replay and cross-session recovery, not to conceal all model behaviour.

Behavioural classifiers protect against known and newly observed extraction patterns. Anthropic said its two-stage classifier had a false-positive rate below 0.1% and that it had reduced extracted reasoning tokens by 10 to 100 times after implementation. Such systems protect specific capabilities when they successfully identify the request, but their coverage must evolve as attackers change prompts.

Rate limits, verification and account graphs protect throughput. They are less about individual output quality and more about making a large data collection programme slower, costlier and easier to identify. They also impose friction on legitimate customers, especially those with fast-growing products or unconventional infrastructure.

Charging for blocked requests primarily protects economics. Anthropic said it resumed charging for blocked requests in areas where its safeguards have a false-positive rate below 0.1%. The aim is to remove the cheap trial-and-error loop that allows attackers to test many variants until a prompt works. It does not itself stop a capable adversary, but it changes the cost curve.

Behavioural classifierDetects extraction patterns

Protection and trade-offProtects targeted extraction; novel prompts and false positives remain; moderation and engineering cost

Account graph and limitsRestricts collection throughput

Protection and trade-offProtects throughput; distributed customers remain; onboarding friction

Thinking and replay controlsLimits cross-session recovery

Protection and trade-offProtects reasoning recovery; output collection remains; integration changes

Charging blocked requests

The key point is that output controls do not prove that a rival has or has not independently developed similar capabilities. Models can converge because they use similar architectures, public benchmarks, common open datasets and shared research ideas. Evidence of copying is stronger when it combines operational attribution with behaviour that fits a training pipeline: coordinated accounts, infrastructure links, repeated extraction prompts, suspicious task concentration and evidence that collected outputs were used in model development.

A competition problem, not proof that progress is fake

The supplied outside reaction contains one clear note of caution. TechCrunch reported that Braden Hancock, a Laude Institute researcher and Snorkel AI co-founder, questioned whether strict distillation alone could explain Kimi K3’s rapid performance. Hancock’s view was that a model that strong could not plausibly have resulted solely from distilling Anthropic’s system in the available time.

That is the only independently sourced critical view supplied for this article. No separately sourced opposing outside assessment was provided, so there is no basis for manufacturing one.

Hancock’s point sharpens the analytical standard. Distillation may accelerate post-training, import useful behaviours and reduce the cost of experimentation without being the sole explanation for a capable model. It is not enough to point to similarity in outputs. The relevant question is whether evidence shows an organised effort to transform a provider’s API into a proprietary training-data channel.

For frontier labs, that is now a core security and market-structure issue. Model weights remain valuable, chips remain scarce, and research talent still matters. But an API can expose another asset: a continuously updated stream of high-quality demonstrations from a system that has already absorbed all three.