Palantir’s CTO Says China’s Open AI Boom Runs on Distillation Attacks on American Labs.
Speaking on Bloomberg Television at the Pennsylvania Defense and Innovation Summit on July 15, 2026, Shyam Sankar, Chief Technology Officer of Palantir Technologies, made a specific technical accusation rather than a vague swipe: China’s celebrated open-source AI models, he said, are “really the result of distillation attacks” — the practice of flooding an American frontier model with queries and training a cheaper rival to mimic its answers. “Most of this is just stolen American IP from frontier labs,” Sankar said, arguing that US labs protecting that intellectual property is “in their own economic interests.”
Sankar isn’t describing a hypothetical. Anthropic has disclosed two industrial-scale distillation campaigns against its own Claude models in 2026 alone — one in February involving three Chinese labs and roughly 24,000 fraudulent accounts, a second in June involving Alibaba’s Qwen lab and 28.8 million queries, which Anthropic calls the largest such campaign it has found.
Sankar named a second threat, too — one he called potentially more consequential: the political backlash against the power-hungry data centers AI needs to run, days after New York Governor Kathy Hochul signed the nation’s first statewide moratorium on new hyperscale data centers. “Turning our back on AI would be as consequential a mistake as turning our back on the atom in the ’70s,” he said.
- 24,000+ accounts — used by DeepSeek, Moonshot AI, and MiniMax to run 16 million-plus exchanges against Claude, per Anthropic's February 2026 disclosure
- 28.8 million queries — run against Claude by Alibaba's Qwen lab through ~25,000 fraudulent accounts between April 22 and June 5, 2026 — Anthropic's largest documented campaign
- 45% — of AI tokens run by US companies on OpenRouter used Chinese models by July 7, 2026, up from about 11.5% in January · Source: CNBC
- 41% — of global Hugging Face downloads this spring went to Chinese open-weight models · Source: MIT Technology Review
- $2.5 billion — DOJ chip-smuggling case cited at the House Select Committee's April 16, 2026 hearing on China's AI theft campaign — the largest export-control violation in US history
The word Sankar chose — distillation — is a real machine-learning term, and that is what makes the charge land differently than a generic complaint about copying. Distillation is normally a legitimate technique: a lab trains a smaller, cheaper model to mimic a larger one it already owns, compressing capability without the full training cost. Anthropic describes the illicit version it says it has caught repeatedly — adversarial distillation — as the same idea aimed at someone else’s model: an outside party floods a frontier system with carefully constructed queries, harvests the outputs at scale, and trains a rival on the results. No weights change hands. No code is copied line for line. The capability transfers anyway.
“These Chinese open source models are really the result of distillation attacks.”
Shyam Sankar, CTO, Palantir Technologies — Bloomberg Television, Pennsylvania Defense and Innovation Summit, July 15, 2026
Sankar’s second line was blunter: “Most of this is just stolen American IP from frontier labs.” He framed US labs’ defense of that IP as self-interested rather than merely principled — “in their own economic interests” — a distinction that matters, because it recasts a fight often litigated as national security into something closer to a straightforward property dispute between a handful of American companies and their fastest-growing competitors.
Anthropic’s own disclosures are the clearest paper trail behind Sankar’s claim. In February 2026, the company said it had identified coordinated extraction campaigns from three Chinese labs — DeepSeek, Moonshot AI, and MiniMax — running roughly 24,000 fraudulent accounts and more than 16 million exchanges with Claude combined. Moonshot alone generated over 3.4 million exchanges probing agentic reasoning, tool use, and computer-vision tasks; MiniMax ran more than 13 million exchanges targeting agentic coding before Anthropic caught the campaign live and watched it pivot to a new model within 24 hours.
February 2026: DeepSeek, Moonshot AI, and MiniMax — ~24,000 fraudulent accounts, 16 million-plus exchanges combined, per Anthropic.
April 22 – June 5, 2026: Alibaba’s Qwen lab — ~25,000 fraudulent accounts, 28.8 million exchanges, targeting Claude’s software-engineering and agentic-reasoning capabilities.
June 10, 2026: Anthropic discloses the Qwen campaign in a letter to the Senate Banking Committee — the largest distillation attack it says it has found, exceeding the combined volume of the three February campaigns.
The June campaign dwarfed the one from February. Anthropic told the Senate Banking Committee that operators tied to Alibaba’s Qwen lab opened about 25,000 fraudulent accounts and ran 28.8 million exchanges with Claude between April 22 and June 5 — more traffic than the three February campaigns combined, aimed squarely at Claude’s coding and agentic-reasoning strengths, the capabilities that command the highest prices in the enterprise market.
We've identified industrial-scale distillation attacks on our models by DeepSeek, Moonshot AI, and MiniMax...
Anthropic accuses Chinese AI labs of 'distillation attacks' on its models
The paper trail runs through Washington, too. On April 16, 2026, the House Select Committee on the CCP held a hearing titled “China’s Campaign to Steal America’s AI Edge,” where witnesses Dmitri Alperovitch, Yusuf Mahmood, and Kyle Chan walked members through a simple mechanical reality: China does not have enough advanced AI chips to train frontier models from scratch, so distillation is the shortcut. The hearing came alongside a Justice Department chip-smuggling case worth $2.5 billion — the largest export-control violation in US history — and testimony that Chinese firms sidestep export controls by building supercomputers in third countries and renting the compute back over the cloud.
A week later, on April 23, the White House Office of Science and Technology Policy went further. Director Michael Kratsios issued a memorandum — formally NSTM-4, “Adversarial Distillation of American AI Models” — accusing foreign entities, principally in China, of “deliberate, industrial-scale campaigns” to copy US frontier systems, and directing federal agencies to share threat intelligence with American AI labs and explore ways to hold the foreign operators accountable.
There is nothing innovative about systematically extracting and copying the innovations of American industry.
Congress followed with a legislative response of its own. After Anthropic’s June disclosure about Alibaba went public, Senators Bill Hagerty and Andy Kim moved to attach an amendment to defense legislation that would blacklist or sanction entities running distillation campaigns against American AI companies — the same enforcement gap Sankar’s “own economic interests” framing implicitly argues the labs should not have to close alone.
Sankar told Bloomberg he considers a second problem more consequential than distillation: America turning against the physical infrastructure AI needs to run at all. Two days before his interview, Kathy Hochul signed the country’s first statewide moratorium on new hyperscale data centers — a one-year freeze on state environmental permits for any facility drawing 50 megawatts or more, meant to buy regulators time to write rules protecting the power grid and ratepayers.
The politics behind the freeze are real: New York’s average residential electricity price has climbed roughly 68% since 2019, and a June 2026 Siena Research poll found 46% of New Yorkers thought the moratorium would help, against 21% who thought it would hurt. President Trump, who headlined the same Pennsylvania summit where Sankar spoke, publicly criticized Hochul’s order that same week. Sankar put the stakes in historical terms.
“Turning our back on AI would be as consequential a mistake as turning our back on the atom in the '70s.”
Shyam Sankar, CTO, Palantir Technologies — Bloomberg Television, July 15, 2026
Whatever Washington decides, enterprise buyers have already voted with their token spend. Chinese-origin models’ share of tokens run by US companies on OpenRouter climbed to roughly 45% by July 7, 2026, up from about 11.5% at the start of the year, per CNBC — while Chinese open-weight models captured about 41% of global Hugging Face downloads this spring, per MIT Technology Review. The draw is price: Chinese frontier-class models routinely list at a fraction of Claude’s or GPT’s per-token rates, the same economics distillation is built to produce.
Sankar’s own CEO has been making a related complaint from the buyer’s side. On July 1, Alex Karp told CNBC that the token-based pricing US labs charge enterprise customers is fundamentally broken — “something has gone completely wrong,” he said — arguing companies now expect to burn through tokens, generate no value, and hand over their intellectual property in the process. Karp wasn’t talking about China, and Sankar wasn’t talking about pricing; but together the two Palantir executives are describing the same market from opposite ends — one warning that cheap copies are eating American labs’ edge, the other warning that the labs are pricing their own customers into looking for those copies.
Sankar’s argument reduces to a wager: that America’s edge in frontier AI is worth defending on two fronts at once — against a rival that is, per Anthropic’s own disclosures, copying its models by the tens of millions of queries, and against a domestic backlash that could shut off the power those models need to keep running. Washington has written a memo, held a hearing, and drafted an amendment. None of it has stopped the campaigns, slowed China’s download numbers, or reversed a single data-center moratorium. The distillation attacks are documented. The atom-versus-AI bet is still open.
