Case · DiggingBeagle record
Anthropic reports a Zhipu/Z.ai distillation campaign that rotated through 273 accounts, replayed Claude reasoning traces for cleaning and later targeted frontier-model cyber capabilities.
Anthropic's September 2026 attribution. The current source set does not include a Zhipu response.
Anthropic describes a production-scale extraction pipeline rather than occasional prompt copying. Zhipu allegedly rotated through 273 fraudulent accounts, captured Claude reasoning traces, replayed them through Claude to clean the transcripts and used the outputs in post-training work.
Over a ten-day period in June, Anthropic counted 770,609 exchanges through the chain-of-thought cleaner and more than three million exchanges attributed to Zhipu overall. The same report says Claude was used to judge outputs, normalize traces, score training data and implement testing.
The security relevance increased when the target moved toward cyber capability. Anthropic says Zhipu used public vulnerability datasets to construct capture-the-flag challenges and then ran distillation attacks against frontier models to acquire stronger cyber performance. That makes the boundary between model extraction and capability transfer explicit.
Hundreds of accounts distribute requests intended to bypass provider restrictions.
Boundary: account boundary / model access
The reported pipeline records model reasoning material.
Boundary: model output / extraction store
Captured traces are sent back through Claude for normalization.
Boundary: raw trace / training-ready data
The operator builds CTF tasks and seeks stronger frontier-model cyber performance.
Boundary: general distillation / capability-specific transfer
The report describes account rotation, CoT cleaning and later cyber-capability targeting.
Locator: GTG-16006 cyber-capability targeting
Anthropic describes CTF construction and later targeting of another frontier lab's top model for cyber-capability distillation.
Locator: GTG-16006 scale
Anthropic reports 770,609 cleaner exchanges and more than three million total attributed exchanges over ten days.
Locator: GTG-16006 overview
Anthropic reports 273 fraudulent accounts over ten days.
chart
Anthropic September 2026 threat report. The total is a lower bound because the report says over 3 million.
| Measure | exchanges |
|---|---|
| Total attributed | 3000000 |
| CoT cleaner | 770609 |
diagram
Rotated to evade restrictions
Record Claude reasoning material
Replay traces through Claude for normalization
Use cleaned outputs for judging, filtering and training work
Later CTF work targets frontier-model cyber performance
Model-access abuse can become a data pipeline. Detection needs to look for account rotation, replay signatures, structured extraction workflows and capability-specific task distributions rather than only individual suspicious prompts.
DiggingBeagle. “Anthropic attributes a large reasoning-trace extraction pipeline to Zhipu/Z.ai.” First seen Sep 10, 2026. https://diggingbeagle.com/cases/anthropic-attributes-a-large-reasoning-trace-extraction-pipeline-to-zhipu-z-ai/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.