Anthropic Discloses State Hackers Beat Its Own Guardrails

Anthropic said Thursday it disrupted a Russia linked group that used Claude in a campaign against more than twenty government, intelligence, diplomatic and defense organizations, and separately named seven China based labs, including Alibaba, Moonshot and DeepSeek, running industrial scale distillation attacks to extract Claude's outputs and train competing models. A third disclosure describes a state sponsored actor using Claude to rebuild its own malware every time Anthropic's classifiers flagged it, an arms race running inside the product Anthropic sells as the safe one. The company's chosen verb was 'identified and disrupted.' The honest verb is 'eventually.'

Kai Tanner's desk has the audit trail, and the detail that matters for Hong Kong is procedural, not dramatic. The HKMA's existing third party risk circulars already require banks and insurers to document due diligence on AI vendors, and this disclosure is the artifact for that file: a foundation model provider's own trust and safety team catching nation state misuse only after it ran long enough to write up. No new HKMA guidance follows from this, which means the obligation was always there, and boards asking whether their AI governance programme covers vendor model risk now have a dated incident instead of a hypothetical to point to.

The distillation angle deserves its own beat. Seven China based labs running industrial scale extraction against Claude is not hacking in the conventional sense, it's the same move as a student copying a rival's exam answers, except the exam is a trillion parameter model and the classroom is the open API. Anthropic's guardrails are built to catch abuse, and industrial scale imitation apparently doesn't trip the same wire as malware.

A vendor whose pitch is real time detection has just shown its real time was measured in campaign length, not query length. Any firm routing regulated data through Claude, Gemini or GPT based agents can now ask its own vendor a concrete question: not whether misuse gets caught, but how many weeks pass before it does.