The Moat Anthropic's IPO Valuation Rests on Is Being Farmed

On September 10, Anthropic released a threat intelligence report describing a sweep of disruptions over the past eight months: Russian-linked espionage campaigns, state-sponsored Chinese hacking, and what the company calls "illicit extraction" of Claude's capabilities by Chinese AI rivals. The headline reads like a security victory — Anthropic's threat team found bad actors and stopped them.

The report is something else. It documents a sustained, industrial-scale attack on the very proprietary advantage Anthropic's coming IPO valuation is built on.

The theft is in the product, not just at the perimeter

The most structurally important word in the report is "distillation." A distillation attack works like this: instead of building intelligence from scratch, a competitor feeds Claude millions of prompts designed to extract the model's best reasoning, coding, and decision-making outputs. Those outputs become training data for a competing model. The rival doesn't need to replicate Claude's R&D — it farms Claude for the hard part, then sells a cheaper copy.

The scale in the new report is not incidental. Alibaba alone generated over 151 million exchanges with Claude between May and July 2026, peaking at nearly 3 million per day from more than 3,500 fraudulent accounts. Earlier in the year, DeepSeek, Moonshot, and MiniMax ran 16 million exchanges through roughly 24,000 fraudulent accounts. Seven China-based labs total were identified. This is not a nuisance that gets patched. CISA, in a September 8 advisory, described these campaigns as forming "the core — not merely a supplement — of their AI development strategy".

On the espionage side, the picture is equally concrete. A Russia-linked group Anthropic calls Midnight Blizzard — associated with Russia's SVR foreign intelligence service — used Claude to develop malware that rewrote its own code when flagged by security defenses. The campaign targeted Ukrainian government, military, and diplomatic sectors using phishing, hotel Wi-Fi hijacking, and WhatsApp-takeover operations. In a separate China-sponsored campaign, AI performed 80 to 90 percent of the campaign across roughly 30 global targets in tech, finance, and government.

These are the facts. Now the question is what they mean for the business that is about to go public.

The valuation assumes a moat the report shows under pressure

Anthropic filed a confidential IPO prospectus in June 2026 and is preparing for what could be the largest public offering in history. The Series H round in May valued the company at $965 billion. Pre-IPO secondaries are already trading between $1.4 and $1.6 trillion. The revenue engine is extraordinary: Q2 2026 brought in over $11.5 billion — a 14-fold increase year-over-year — and the company posted its first operating profit of roughly $559 million. The annualized revenue run rate climbed from about $9 billion at the end of 2025 to more than $65 billion by July. Bankers are underwriting against a projected 2028 revenue of $190 to $200 billion.

That $559 million operating profit on $11.5 billion in revenue is a 5 percent margin. The company has committed more than $130 billion in cloud compute contracts with AWS and Microsoft Azure, plus a multi-gigawat agreement with Google and Broadcom. The margin expansion that makes a $2 trillion valuation defensible depends on revenue growing faster than infrastructure costs, which in turn requires Claude's pricing premium to hold.

Here's the structural tension. Distillation creates competitive models that sell at a fraction of Claude's price. If Alibaba's Qwen, DeepSeek, and others are improving themselves on Claude's output, the premium Anthropic charges for Claude's superior capabilities narrows. Enterprise buyers are already sorting workloads by price-to-performance. Anthropic's own data shows that use of cheaper open-weight models rose from 4.5 percent to 6.1 percent of AI-spending businesses between January and July.

A 5 percent margin with $130 billion in committed infrastructure spend and structural competitive pressure from distillation means the IPO pricing is built on a future where none of these threats become sustained pricing erosion.

The defense is real but incomplete

There is a legitimate counterargument. Anthropic's security team is clearly capable. It identified seven distinct labs, mapped thousands of fraudulent accounts, and disrupted the campaigns. The company recently launched the Mythos model specifically for cybersecurity and co-founded Project Glasswing alongside AWS, Google, Microsoft, Cisco, CrowdStrike, Palo Alto Networks, and others to secure critical software infrastructure. Claude Code alone generated roughly $15 billion in annualized revenue by August 2026 and is projected to reach $23.5 billion by May 2027. The revenue momentum is not a narrative — it is operating reality.

However, the question for the investor isn't whether Anthropic can block the next attack. It's whether distillation represents a permanently drainable leak on the competitive moat. In pharmaceuticals, patents create a hard legal wall around formulas. In AI, the "formula" is the model's behavior — and that behavior is visible every time a prompt produces a response. You can make the theft harder, but the capability always leaks through use. Anthropic's own report acknowledges that some Chinese labs found ways to route live customer conversations through Claude, harvesting responses as training data rather than running bulk queries that are easier to detect.

What the investor carries

The revenue growth is undeniable. Claude captured roughly 68 percent of U.S. business AI chat spending by January 2026, up from under 10 percent a year earlier. The enterprise adoption is real. But the proprietary intelligence that justifies the valuation is under sustained, industrial-scale extraction by the very competitors Anthropic is racing.

This isn't a reason to dismiss the company. It is a reason to watch the margins after the IPO filing clarifies the compute commitments, revenue booking methodology, and customer concentration. The threat report doesn't just describe attacks that were stopped. It is evidence that the moat around Anthropic's crown jewel is being farmed in real time. The investor's job is to determine whether that farming translates into pricing erosion or whether Claude's lead is wide enough that distilled copies can't compete — even at a fraction of the price. The answer to that question determines whether the valuation has a floor.