OpenAI, Anthropic and Google Are Reportedly Sharing Notes on AI Distillation

OpenAI, Anthropic and Google are fierce competitors. Apparently, there is still room in their calendars for a shared concern: what happens when someone tries to turn millions of chatbot answers into training material for a rival?

Bloomberg reported on April 6, citing people familiar with the matter, that the companies are sharing information through the Frontier Model Forum to detect adversarial distillation by Chinese competitors. That is a report about cooperation, rather than a joint announcement proving that entire models have been cloned.

The distinction matters. “Rivals compare notes about suspected extraction” is less cinematic than “AI Cold War declared,” but it gets us closer to what is actually known.

Distillation Is Not Automatically a Heist

Distillation trains a student model using knowledge transferred from a teacher model. It can help make a smaller model useful for a particular task without the cost of deploying the larger one everywhere.

This is an ordinary part of AI development. OpenAI even introduced a developer workflow for model distillation in October 2024. Its offering combined stored model outputs, evaluations and fine-tuning so developers could adapt smaller models to their needs.

The argument is about permission, access and purpose. Training from outputs under an authorized arrangement is different from evading access restrictions to build a competing model. Calling the whole technique theft would be like banning photocopiers because someone copied an exam paper.

Nor is this a literal download of another model’s brain. A collection of answers can be valuable training material without containing the original model’s weights or reproducing all its capabilities. “Clone” is an attention-grabbing shortcut, but a poor description of what the public evidence establishes.

What Anthropic Actually Alleged

In a February 23 statement, Anthropic attributed campaigns to DeepSeek, Moonshot AI and MiniMax. It said they generated more than 16 million exchanges through approximately 24,000 fraudulent accounts, violating its terms and regional restrictions.

Anthropic reported more than 13 million exchanges associated with MiniMax, over 3.4 million with Moonshot and over 150,000 with DeepSeek. The reported targets included coding, tool use and reasoning. Those are Anthropic’s findings and attributions, not independently verified conclusions from this site.

The company described proxy services and coordinated accounts used to distribute traffic. Its announced response includes behavioral detection, stronger account verification and sharing technical indicators with other labs and providers.

That supports a story about large-scale suspected misuse. It does not show that every advance made by a named competitor came from Claude, that every query was free, or that all three U.S. companies independently confirmed every allegation. Those are much bigger claims.

An Existing Forum, Not a Sudden Friendship

The companies were already sharing an institutional roof. Google’s July 2023 founding announcement names Anthropic, Google, Microsoft and OpenAI as the Frontier Model Forum’s original members, with a focus on frontier AI safety.

Commercial competition and cooperation on security can coexist. You do not have to admire your neighbor’s business strategy to tell them someone has been trying the same suspicious keys in both your doors.

The financial incentive is easy to understand, especially alongside the scale of OpenAI’s latest funding round. Training and selling useful models is expensive. Companies will want to protect that investment. Their commercial interest is also a reason to examine their claims carefully.

The Difficult Part Is Drawing the Boundary

The Forum’s own February 23 issue brief recognizes the tension: techniques used to gather training material can also serve legitimate purposes. It warns that copying capabilities may fail to reproduce safeguards, while explicitly supporting authorized distillation.

That makes a simple “lots of prompts equals attacker” rule inadequate. Developers testing software, researchers evaluating models and customers running legitimate workloads may all generate substantial traffic. Context and authorization matter alongside volume.

The useful question is whether shared detection can reduce abuse without making ordinary work unnecessarily difficult. This cooperation may help; the available reports do not yet establish how effective it will be.

The rivals have a reason to compare notes. That does not mean the AI race is over, every Chinese model is a copy, or open development has received its eviction notice. For now, even the fiercest competitors appear to agree on one familiar classroom principle: if you think someone is copying the homework, check what happened before rewriting the entire school rulebook.