The Two Hundred Million Handshakes: Anthropic, Distillation, and the Crisis of Machine Provenance

Somewhere inside Anthropic's infrastructure, a counter rolled past two hundred million. Not users. Not paid seats. Two hundred million discrete exchanges, later described as the fingerprints of five distinct campaigns, attributed to seven Chinese laboratories, with Alibaba's Qwen carrying 151 million of them alone — roughly three million a day at peak, scattered across some three thousand five hundred accounts. That is the number I cannot stop turning over. Not because it proves anything by itself, but because of what it implies about the one layer of the internet almost nobody audits. We spent a decade building tools to verify where money came from. We built almost nothing to verify where a sentence came from. On September 8th, CISA, the FBI, and the NSA released a joint bulletin. Two days later, Anthropic published its report. The gap between government framing and corporate evidence is not a scheduling accident; it is choreography. What followed was less a technical disclosure than a legal artifact, drafted in the grammar of national security. To see why this document deserves scrutiny — and why I read it with one eyebrow raised — you need the history. Model distillation is not a heist. It is the most ordinary practice in machine learning: a large teacher model emits outputs, and a smaller student model learns to imitate them. Every researcher who has fine-tuned on another model's completions has performed a quiet version of this. It is how capability migrates through an ecosystem. The report describes something more industrial. Moonshot allegedly routed Kimi user traffic silently to Claude and returned Claude's answers under a Kimi label. DeepSeek reportedly generated twelve million exchanges inside a fourteen-day window in July. The evasion tactics — proxies, account pools, semantic request rewriting, third-country routing — are unsurprising. The mechanism, if true, is banal: harvest the reasoning traces of a frontier system, feed them to your own, and skip the expensive decade of becoming intelligent. What makes this unsettling is not the accusation itself. It is the admission buried inside it: that approaching the frontier may now be a matter of bandwidth and disguise, not of insight — and that the people who built the frontier cannot tell the difference from the outside. Here the technical story grows slippery. Anthropic's detection rests on API telemetry, account linkage, and behavioral fingerprinting — the same instrumentation any cloud provider deploys to halt abuse. That machinery can be production-grade. During my own audit work on early token telemetry in 2017, I learned that behavioral fingerprints catch patterns; they rarely catch intent. The report never discloses its methodology. No false-positive rate. No watermark specification. No attribution threshold. No explanation of how it separates training on outputs from merely reading them. This is the unbridgeable gap at the center of the document: a high-volume customer and a distillation operation can look identical from the outside, because the difference lives in what happens to the data after it leaves your servers — the exact territory your telemetry cannot see. Code doesn't mind being copied. Code minds being mistaken for authorship. Distillation at scale is an authorship problem wearing the costume of a bandwidth problem. The most important omission, though, is quieter. Two hundred million exchanges is a volume, not a measure. Nobody converted it into tokens, or into capability. If Qwen 3.5, 3.6, and 3.7 gained a measurable share of their reasoning ability from Claude's chains of thought, then the pricing pressure compressing Western margins is not architecture. It is extraction — unpaid labor, laundered through an API. If the gain was marginal, then the report is a scarecrow. I have seen this ambiguity before. In 2022, I helped assemble a forty-page post-mortem on Terra's collapse, and the hardest question was never the code. It was attribution — determining which decisions were engineering and which were theater. A broken contract is readable. A broken promise is not. The report also implies, without ever stating, that Anthropic has deployed output watermarks, canary tokens, account graphs, and geographic anomaly detection. If those tools existed and were reliable, we would be reading a different document: one with a confusion matrix instead of a press strategy. What we received instead is the shape of evidence with no calibrated edges. And that is the question future regulators will have to weigh. When a trade tribunal asks whether a foreign laboratory stole reasoning, the answer cannot be a chart of API calls. It has to be a threshold, a method, and a false-positive rate — the same standard we demand before freezing a wallet or delisting a token. Otherwise we are not enforcing provenance. We are enforcing instinct with better branding. There is a diplomatic current running beneath the engineering, too. A joint CISA, FBI, and NSA bulletin is not a blog post; it announces that AI supply chains have been promoted to critical infrastructure. The consequences are predictable — KYC tightening, geographic fencing, and audit trails bolted onto model access, all of which raise the cost of competing from outside the alliance. Benefiting: closed frontier labs, security forensics firms, cloud compliance vendors. Losing: anyone whose product depends on cheap API arbitrage or a third-country proxy. None of it is proven. All of it is plausible. And plausibility, in a bear market, moves capital. Now the part the industry would rather glide past. Anthropic is not a neutral observer. By the report's own framing, the company is reportedly working toward a valuation near $965 billion. A firm preparing for that listing benefits enormously from a story in which a rival nation's best laboratories reach across the Pacific to mine its crown jewels. That does not make the allegations false. It makes them interested. Recall July: twenty-five technology companies signed a letter supporting open distribution of model weights. OpenAI and Anthropic both declined. The distillation report is perfectly consistent with that posture. If weights are property, outputs are property too — and the line between inspiration and theft becomes something you enforce rather than discuss. Here is the symmetry nobody wants to name. The same report documenting unauthorized extraction also demonstrates, inadvertently, that the moat around frontier reasoning is thin. If a competitor can close a meaningful gap by imitating 151 million exchanges, the advantage was never the architecture. It was the data — and data leaks. Soulless finance is just empty pixels; soulless intelligence is just borrowed text. I keep returning to provenance. We built Bitcoin to prove a coin wasn't spent twice. We built zero-knowledge proofs to prove a claim without exposing the secret. We built systems to prove where an image, a signature, a transaction originated. We built almost nothing to prove where a thought came from — and this is the year that silence became expensive. The next infrastructure contest will not be fought over chips. It will be fought over authentication: whose model trained on whose reasoning, provable without revealing either. Until someone ships that, every report like this one is an accusation dressed as evidence, and every denial is a denial dressed as innocence. The real question is not whether the numbers are true. It is whether anyone alive can prove them.