In February 2026, Anthropic, OpenAI, and Google independently disclosed something that should reset how every company exposing a proprietary model thinks about security. None of them had been breached in the traditional sense. No stolen credentials, no exposed database, no exploited CVE. Their models had simply been used, at industrial scale, exactly as their public APIs allow.
What actually happened
On February 23, 2026, Anthropic published a report accusing three Chinese AI labs, DeepSeek, Moonshot AI, and MiniMax, of running coordinated, large-scale distillation campaigns against Claude (CNBC, 2026). The scale was significant: over 16 million exchanges harvested through roughly 24,000 fraudulent accounts. Google disclosed a parallel effort the same month, identifying and disrupting a distillation campaign against Gemini's reasoning capabilities that ran through more than 100,000 prompts. In response, OpenAI, Google, and Anthropic began sharing threat intelligence through the Frontier Model Forum specifically to detect this pattern of automated, cross-account extraction earlier.
The most important detail in the disclosures isn't the scale. It's the method. As one breakdown of the Anthropic incident put it plainly: there was no vulnerability, no misconfigured database, no exposed API key, no unpatched CVE (Treblle, 2026). The attackers used Claude exactly as it was designed to be used, just not as it was *intended* to be used. That distinction is the entire security problem in one sentence.
The mechanics: why an API is enough
A model distillation, or extraction, attack doesn't require access to weights, infrastructure, or training data. It requires a public-facing API and patience. The attacker repeatedly queries the target model, records the input-output pairs, and uses that harvested dataset to train a second model that mimics the original's behavior, including specialized logic and domain expertise the target spent significant resources developing.
This works because, as one practitioner framing puts it, a model's behavior *is* the model. Every API response teaches an attacker something about the system generating it, and protecting the underlying weights while exposing unlimited queries doesn't eliminate theft risk, it just moves the attack surface from file exfiltration to behavioral replication (Praetorian, 2026).
Praetorian's own proof-of-concept extraction attack illustrates how little effort this actually takes. Using a public model API, researchers sent 1,000 queries, recorded every response as a labeled training example, and trained a replica model on those pairs. The result: a stolen copy that matched the original model's predictions with 80.1% accuracy, without ever touching the target's infrastructure. Basic rate limiting doesn't stop this. It only slows it down, and against an adversary running tens of thousands of fraudulent accounts in parallel, "slower" isn't much of a defense.
Why this matters beyond frontier labs
It's tempting to read the February 2026 disclosures as a story about a handful of trillion-parameter models and nation-state-adjacent labs. That framing misses the point for most companies building AI products. The underlying mechanism, an adversary querying an exposed model API to reconstruct its behavior, doesn't care how large the model is. It applies equally to:
- A proprietary fraud-scoring or underwriting model exposed through a partner API
- A fine-tuned domain model (legal, clinical, technical support) sitting behind a customer-facing chatbot
- A RAG system where the retrieval and ranking logic, not just the base LLM, represents real competitive IP
- Any internal model exposed to third-party vendors or integration partners without usage monitoring
If your competitive advantage lives in a model's behavior, and that model answers queries from the public internet, you have the same exposure Anthropic and Google described, just at a scale proportional to your business rather than theirs. The attack doesn't require sophistication. It requires access and volume, and most APIs are built to maximize both.
What defense actually looks like
The response to the 2026 disclosures points to a defense-in-depth pattern that smaller organizations can adopt without frontier-lab resources:
- 1Rate limiting and volume anomaly detection. Not just per-key limits, but detection of the query patterns extraction attacks actually produce: high-volume, systematically varied inputs designed to map the model's decision boundary rather than use it for a real task.
- 2Output perturbation. Introducing controlled variance into responses makes it harder for an attacker to cleanly replicate model behavior from collected input-output pairs, without materially degrading the experience for legitimate users.
- 3Behavioral and account-level monitoring. The Anthropic and Google cases were caught in part because of coordinated account behavior, not single-request anomalies. Fraudulent-account detection is now a model security control, not just a fraud-team concern.
- 4Cross-provider and cross-vendor threat intelligence. The Frontier Model Forum response signals where this is heading: extraction campaigns are often distributed across providers, and no single company sees the whole pattern from inside its own logs alone.
- 5Treat the model API like any other high-value API. This is the part most organizations still get wrong: a model-serving endpoint gets product and ML engineering attention, but often skips the API security discipline (authentication strength, endpoint inventory, abuse monitoring) applied to the rest of the API surface.
That last point is exactly where AI security and API security stop being two separate disciplines. A model is only as protected as the API that serves it, and a security program that treats "AI security" and "API security" as different tools solving different problems will miss exactly the kind of attack that just hit three of the most well-resourced AI companies in the world. Chronoloq's dual coverage exists because that split is artificial: the fastest-growing AI risk surface and the fastest-growing API risk surface are, increasingly, the same endpoint.
The lesson from February 2026 isn't that distillation attacks are new. It's that they scaled to millions of exchanges before anyone caught them, using nothing but the API these companies built to be used. Any organization exposing a model it cares about should assume the same query is already being asked of theirs, just without 16 million data points to notice it by.