Anthropic's Forced Tutoring Bill: Being Worth Copying Is the Point — and the Risk

Something odd happened on the way to the frontier. In February, Anthropic alleged that three Chinese AI labs — DeepSeek, Moonshot AI, and MiniMax — quietly opened roughly 24,000 fake accounts and fired more than 16 million questions at Claude, its flagship model. Four months later, in a letter to U.S. senators, it accused Alibaba-linked operators of doing the same thing at a bigger scale: 28.8 million exchanges between April and June, through about 25,000 fraudulent accounts. These are accusations from a company with an interest in dramatic framing, and Alibaba has denied them. But the dispute over who did what should not crowd out the more interesting fact — the scale itself tells an investor something specific about Anthropic's position, and it cuts both ways.

The technique is called distillation, and it is worth understanding before the numbers make sense. Normally a lab assembles its own training data, filters it, and spends enormous computing power and money teaching a model the relationships inside that data. Distillation skips most of that: you take a stronger model, ask it questions, and train a weaker model on its answers. Anthropic itself concedes the method is a legitimate way to build smaller, cheaper versions of a model. The charge is that these labs used it to reach Claude's output the way a stranded student copies a neighbor's exam — to close a gap without paying the tuition. Claude, Anthropic notes, is not even sold in China; the operators allegedly routed around that restriction through proxy services.

So the first reading of the numbers is flattering. These labs did not spend tens of millions of high-token, paid exchanges copying a mid-tier model. According to Anthropic, they concentrated on Claude's most differentiated capabilities — coding, tool use, and agentic reasoning, the exact skills that separate a frontier model from a commodity one. MiniMax's traffic reportedly surged toward whichever Claude was newest. You copy what is worth copying. If the accusation holds, the campaigns are indirect market research: rivals voting with their compute that Claude sits at the frontier.

The second reading is where the economics get uncomfortable, and it is the one that should give an investor pause. Distillation lets a competitor reconstruct a model's capabilities at, in Anthropic's words, a fraction of the time and cost it would take to develop them independently. The whole premise of a near-trillion-dollar AI valuation is that building the frontier model is brutally expensive and therefore rare — full stop. The gap you can skip destabilizes that premise at the margin. Every exchange a rival ran on Claude was paid for at API prices, so Anthropic actually collected revenue it would rather have refused: money that subsidized the education of the company eroding its own pricing power. Unwanted revenue is not a business problem by itself, but unwanted revenue that funds a competitor's path to parity is a different measurement entirely.

This is the part to hold onto, because it is the part that is not really about copyright. Anthropic's moat was never its brand or its sales force; it has no dominant enterprise installed base like a Microsoft. Its value is that its frontier model is ahead — and ahead is a moving target, not an asset you can depreciate on a schedule. Distillation attacks the durability of that lead, compressing the window in which a capability gap can be monetized before competitors meet it. The threat is not that someone steals a model, but that the economics of being first get cheaper for everyone else.

Which brings up the strategic wrinkle: the defense against this is mostly not technical, no matter how much detection tooling Anthropic builds. Its classifiers and coordinated-activity detection can spot the pattern — massive volume in a narrow area, requests scripted to extract step-by-step reasoning. But the attackers run what Anthropic calls hydra clusters: proxy networks reselling access through tens of thousands of accounts, mixing distillation traffic with normal customer queries so it looks benign, and regenerating banned accounts instantly. It is whack-a-mole on a server farm, and the most recent reports suggest the activity is migrating to channels that are harder to monitor at all.

That is why Anthropic keeps making a geopolitical argument alongside the technical one. Extraction at this scale, it argues, requires access to advanced chips, and restricting chip exports both limits direct training and limits how much illicit distillation a rival can run. Export controls are, in effect, part of the moat. Anthropic is a private company — it raised $30 billion in February at a $380 billion valuation, and is reported to be in talks to raise again at figures approaching $1 trillion — so retail investors cannot simply buy the thesis. But this is exactly the kind of question to sharpen before a debut: whether the premium on Anthropic rests on a capability gap that distillation is steadily, cheaply closing for everyone else. A lead only compounds if rivals cannot adopt it to the same economics. Being worth copying is validation. Being copyable is the risk — and with a potential trillion-dollar price tag, the distance between those two sentences is the entire investment case.