Anthropic describes a production-scale extraction pipeline rather than occasional prompt copying. Zhipu allegedly rotated through 273 fraudulent accounts, captured Claude reasoning traces, replayed them through Claude to clean the transcripts and used the outputs in post-training work. Over a ten-day period in June, Anthropic counted 770,609 exchanges…
Inspect the ClaimsCase · DiggingBeagle record
Anthropic attributes a large reasoning-trace extraction pipeline to Zhipu/Z.ai
Anthropic reports a Zhipu/Z.ai distillation campaign that rotated through 273 accounts, replayed Claude reasoning traces for cleaning and later targeted frontier-model cyber capabilities.
Scope
Anthropic's September 2026 attribution. The current source set does not include a Zhipu response.
Assessment profile
Assessment method- Setting
- allegation
- Exploitation
- not established
- Evidence
- Grade B
- AI role
- WITH AI
Basis and provenance
The profile preserves Anthropic attribution of account rotation, cleaner and extraction volumes; it does not establish Zhipu confirmation or downstream capability gains. Identified campaign passages support the provider report, not independent adjudication. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CYBER · CLM-CLEANER · CLM-ACCOUNTS · Countering misuse of AI: September 2026
At a glance
Model-access abuse can become a data pipeline. Detection needs to look for account rotation, replay signatures, structured extraction workflows and capability-specific task distributions rather than only individual suspicious prompts.
Read the implicationsThe current source set contains Anthropic's attribution but no Zhipu response. The report does not establish how much downstream model capability was gained from the campaign.
Limits and uncertaintyFull account
Anthropic describes a production-scale extraction pipeline rather than occasional prompt copying. Zhipu allegedly rotated through 273 fraudulent accounts, captured Claude reasoning traces, replayed them through Claude to clean the transcripts and used the outputs in post-training work.
Over a ten-day period in June, Anthropic counted 770,609 exchanges through the chain-of-thought cleaner and more than three million exchanges attributed to Zhipu overall. The same report says Claude was used to judge outputs, normalize traces, score training data and implement testing.
The security relevance increased when the target moved toward cyber capability. Anthropic says Zhipu used public vulnerability datasets to construct capture-the-flag challenges and then ran distillation attacks against frontier models to acquire stronger cyber performance. That makes the boundary between model extraction and capability transfer explicit.
Mechanism and trust boundary
- 01
Rotate fraudulent access
Hundreds of accounts distribute requests intended to bypass provider restrictions.
Boundary: account boundary / model access
- 02
Capture reasoning traces
The reported pipeline records model reasoning material.
Boundary: model output / extraction store
- 03
Replay traces through a cleaner
Captured traces are sent back through Claude for normalization.
Boundary: raw trace / training-ready data
- 04
Target cyber capability
The operator builds CTF tasks and seeks stronger frontier-model cyber performance.
Boundary: general distillation / capability-specific transfer
Timeline
- Sep 10, 2026Event type unspecified
Anthropic publishes GTG-16006 case study
The report describes account rotation, CoT cleaning and later cyber-capability targeting.
Claims & evidence
CLM-CYBERAnthropic says Zhipu later used public vulnerability datasets to build capture-the-flag challenges and targeted the cyber capabilities of frontier models during distillation work.supported
Basis: reported finding · active
- supportsCountering misuse of AI: September 2026primary
GTG-16006 cyber-capability targeting
CLM-CLEANERAnthropic reports 770,609 exchanges through the chain-of-thought cleaner and more than three million Zhipu-attributed exchanges over the same 10-day period.supported
Basis: reported finding · active
Recorded measurement: 770609 cleaner exchanges · Anthropic threat-intelligence attribution
- supportsCountering misuse of AI: September 2026primary
GTG-16006 scale
CLM-ACCOUNTSAnthropic reports that Zhipu/Z.ai rotated through 273 fraudulent accounts during a 10-day chain-of-thought extraction campaign against Claude Opus 4.8.supported
Basis: reported finding · active
- supportsCountering misuse of AI: September 2026primary
GTG-16006 overview
Evidence visuals
chart
Zhipu/Z.ai distillation activity reported by Anthropic
Anthropic September 2026 threat report. The total is a lower bound because the report says over 3 million.
| Measure | exchanges |
|---|---|
| Total attributed | 3000000 |
| CoT cleaner | 770609 |
diagram
Zhipu reasoning-trace extraction pipeline
- 273 fraudulent accounts
Rotated to evade restrictions
- Capture reasoning traces
Record Claude reasoning material
- CoT cleaner
Replay traces through Claude for normalization
- Post-training pipeline
Use cleaned outputs for judging, filtering and training work
- Cyber-capability tasks
Later CTF work targets frontier-model cyber performance
- 273 fraudulent accounts Capture reasoning traces: query
- Capture reasoning traces CoT cleaner: replay
- CoT cleaner Post-training pipeline: normalized traces
- Post-training pipeline Cyber-capability tasks: capability targeting
Implications
Model-access abuse can become a data pipeline. Detection needs to look for account rotation, replay signatures, structured extraction workflows and capability-specific task distributions rather than only individual suspicious prompts.
Controls and mitigations
- Detect coordinated account rotation and repeated trace-replay patterns.
- Rate-limit and investigate structured extraction workloads spanning many accounts.
- Treat capability-specific distillation against cyber tasks as a distinct high-risk pattern.
Unknowns and contradictions
- The current source set contains Anthropic's attribution but no Zhipu response.
- The report does not establish how much downstream model capability was gained from the campaign.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 2
- Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: assessment_profile, claims