Subscribe to The Post Most newsletter for the most important and interesting stories from The Washington Post. <\/a><\/p>\nAnthropic\u2019s tracking code invisibly checked whether a Claude user\u2019s computer was set to Chinese time zones and using a web domain name linked to certain Chinese AI companies.<\/p>\n
The American firm backtracked and removed the electronic monitor last week, after a software developer revealed its existence and privacy advocates criticized Anthropic, saying it had surveilled its own users. An Anthropic executive said the tracking was an \u201cexperiment\u201d that would be rolled back in favor of better defenses.<\/p>\n
But the episode revealed increasingly aggressive measures American firms are taking in a battle with Chinese rivals over who will control the technology\u2019s future.<\/p>\n
The geopolitical contest has contributed to recent, rapid-fire moves by the Trump administration to assert greater control of whom Anthropic and its chief U.S. rival, OpenAI, allow to access their technology. (The Washington Post has a content partnership with OpenAI.)<\/p>\n
But although the White House has claimed it is helping U.S. firms dominate AI, some Silicon Valley allies of President Donald Trump have said the recent policies risk making it harder for American firms to compete with those from China. The dissatisfaction with U.S. policy and allegations against Chinese firms come as evidence grows that their AI technology is becoming more competitive with that offered by U.S. companies.<\/p>\n
\u201cThey\u2019re very close,\u201d Srinivas Mukkamala, CEO of cybersecurity company Securin, said of the capabilities of Chinese AI models, \u201cand they cost you nothing.\u201d<\/p>\n
For over a year, Chinese AI companies have consistently matched the capabilities of the latest U.S. AI models within months, industry benchmarks show. Among free and open AI models, Chinese options are already more popular than American ones, The Post reported in October. Last week, cybersecurity firm Semgrep said a new, free AI model from Chinese company Zhipu AI was better at finding computer vulnerabilities than Anthropic\u2019s Claude Opus 4.8 model, which was released in May.<\/p>\n
Anthropic\u2019s tracking code was designed in part to catch Chinese firms \u201cdistilling\u201d its AI models, a technique that involves pressing a large, expensive AI system to serve as a tutor to a smaller, cheaper one. Asking the larger system huge numbers of questions – hundreds of thousands or more – generates responses that can be used to upgrade the power of the smaller one on the cheap.<\/p>\n
Distillation isn\u2019t illegal, and it has been used for years in the AI industry. But distillation without permission is against AI companies\u2019 rules, and, used effectively, is giving Chinese AI companies a major leg-up, American AI companies say.<\/p>\n
These \u201cattacks pose a serious threat to national security and undermine AI safety standards across the industry. That\u2019s why we continue to speak openly about what we\u2019re seeing and work closely with other labs, government, and partners on shared solutions,\u201d a spokesperson for Anthropic said. Spokespeople for OpenAI did not return requests for comment.<\/p>\n
Anthropic and ChatGPT-maker OpenAI have both accused Chinese AI companies of using this technique to build copy-cat AI models of their own.<\/p>\n
In a May blog post, Anthropic said that Chinese companies\u2019 use of distillation, along with evading U.S. export controls on high-end computer chips, has allowed them to \u201ctrail closely\u201d behind U.S. models. But if these techniques can be blocked, it might be possible for the United States to \u201clock in a 12-24 month lead\u201d on Chinese capabilities, the company said.<\/p>\n
Neither Anthropic nor OpenAI permits access to their models from mainland China or Hong Kong, blocking users with measures that include IP-based location restrictions and government ID checks, though residents frequently find work-arounds to access the tech.<\/p>\n
This month, Anthropic said in a letter to U.S. senators that was obtained by The Post that it uncovered a campaign in which Chinese tech giant Alibaba\u2019s Qwen AI team used roughly 25,000 fraudulent accounts to generate more than 28.8 million exchanges with Claude to improve its own technology.<\/p>\n
In February, Anthropic made similar accusations against the Chinese firms Deepseek, Moonshot and MiniMax and said the campaigns were \u201cgrowing in intensity and sophistication.\u201d Alibaba, Deepseek, Moonshot and MiniMax did not respond to requests for comment.<\/p>\n
Anthropic and OpenAI have appealed to the U.S. government, arguing that distillation amounts to intellectual property theft that harms the U.S. in the geopolitical AI contest.<\/p>\n
\u201cAnthropic\u2019s framing is that this is a geopolitical contest for basically the future of the world and freedom and democracy.\u201d said Kyle Chan, a fellow at the Washington-based Brookings Institution\u2019s China Center.<\/p>\n
\u201cIt\u2019s that this is not just undercutting the U.S. commercially, but undercutting American strategic advantage in the most powerful technology we know today,\u201d he said.<\/p>\n
That argument has been echoed by the Trump administration and some Republican lawmakers.<\/p>\n
In April, the White House released a memo warning that Chinese firms were running \u201cdeliberate, industrial-scale campaigns\u201d to distill U.S. systems, raising concerns that the practice could allow Chinese competitors to build cheaper models stripped of safety mechanisms.<\/p>\n
\u201cThe United States cannot afford to let China or any other adversary gain a technological edge in artificial intelligence,\u201d said Sen. Tim Scott (R-South Carolina), chairman of the U.S. Senate Committee on Banking, Housing and Urban Affairs, at a hearing last month that addressed distillation concerns. \u201cWe have to carefully craft export control policy that is clear and concise,\u201d he said.<\/p>\n
That Chinese AI labs are using U.S. models to improve their own technology appears beyond dispute.<\/p>\n
In a February 2025 study, researchers from China\u2019s Peking University and the state-funded Chinese Academy of Sciences developed methods to detect signs of distillation in leading large language models. They concluded that, with the exception of ByteDance\u2019s Doubao, most domestic models they tested showed substantial evidence of distillation, mostly drawing from U.S. models.<\/p>\n
Among them was one of Chinese e-commerce giant Alibaba\u2019s Qwen AI models. Using tests that compared model outputs and probed for clues about a model\u2019s underlying identity, the researchers found that Qwen repeatedly appeared to mimic Claude – suggesting Anthropic\u2019s model had been used to improve the Chinese system. In one set of intensive tests, a Qwen model misidentified itself as Claude nearly a third of the time, the Chinese researchers found.<\/p>\n
U.S. firms have also used distillation to piggyback on AI systems made by others.<\/p>\n
In 2024, OpenAI released a tool to make it easier for customers to distill its own models and produce data sets for AI training. SpaceX founder Elon Musk said in court testimony in May that his AI company xAI used distillation to train its models and that the technique is common throughout the industry.<\/p>\n
Without knowing the details about how a Chinese model was trained, it can be difficult to distinguish illicit behavior from a terms of service violation, said Irene Solaiman, the chief policy officer for Hugging Face, a repository for open source AI.<\/p>\n
But alleging popular Chinese models are somehow \u201cstolen goods\u201d could lead the U.S. to underestimate China\u2019s ability to innovate in AI. Chinese labs have consistently made breakthroughs in efficiency and cost effectiveness, partly out of necessity while facing U.S. export controls, she said.<\/p>\n
Silicon Valley startups and cash-strapped academic researchers have flocked to Chinese AI models, which companies such as Alibaba and Deepseek release free versions of for others to use and modify, in addition to charging for apps and services.<\/p>\n
Fortune 500 CEOs are beginning to call for cheaper alternatives to the extremely expensive AI sold by leading U.S. companies such as OpenAI and Anthropic. The chief executives of Airbnb, Brian Chesky, and cryptocurrency exchange Coinbase, Brian Armstrong, have spoken publicly about their companies\u2019 use of Chinese AI models.<\/p>\n
Any move to prevent Americans from building on Chinese open source models could harm the growing numbers of users, researchers and start-ups depending on them, Solaiman said.<\/p>\n
Preventing Chinese companies from distilling U.S. AI models would also be difficult.<\/p>\n
In September, Anthropic expanded its restrictions beyond users based in China to include any entity more than 50 percent owned by Chinese interests anywhere in the world. In April, it went further, requiring some users to verify their accounts with a government-issued ID.<\/p>\n
Despite that, Chinese users who have faced decades of internet restrictions under the tight controls of the Great Firewall are adept at finding ways around the types of regional registration controls that U.S. AI firms have put on their models. Anthropic said it has banned nearly 700,000 accounts that were using Claude in China.<\/p>\n
\u201cThere is a whole ecosystem of proxy servers, third-party accounts and even services that allow you to get around the know your customer ID verification,\u201d said Chan of the Brookings Institution.<\/p>\n
In recent tests conducted by The Post using Chinese phone numbers and subscriptions purchased on Alibaba-owned Taobao, access to free Claude and OpenAI free accounts was available for about $1 a month. Pro subscriptions that cost more than $100 a month in the U.S. were offered by Chinese re-sellers for as little as $12 monthly.<\/p>\n
Anthropic\u2019s February blog post alleging that Chinese companies distilled its AI models suggested that these proxy services can operate at huge scales. \u201cWhen one account is banned, a new one takes its place. In one case, a single proxy network managed more than 20,000 fraudulent accounts simultaneously,\u201d it said.<\/p>\n
Related Content<\/p>\n","protected":false},"excerpt":{"rendered":"In March, artificial intelligence company Anthropic quietly deployed software to spy on China-based customers of its popular coding…\n","protected":false},"author":2,"featured_media":535897,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[220,227791,3673,218,219,114,81636,37177,8061,61,60,1425,80],"class_list":["post-535896","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-an-anthropic","tag-anthropic","tag-artificial-intelligence","tag-artificialintelligence","tag-china","tag-chinese-firms","tag-claude-code","tag-claude-opus","tag-ie","tag-ireland","tag-models","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/535896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=535896"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/535896\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/535897"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=535896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=535896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=535896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}