Anthropic Alleges Distillation by Seven Chinese Labs as OpenAI Pauses Its $200 Tier Over Compute

The day’s two most important threads interlocked. Anthropic published its September threat intelligence report, documenting how Iran, Russia and commercial influence-for-hire networks use Claude, while alleging that seven Chinese labs distilled Claude’s capabilities; English media put the distillation total at nearly 200 million interactions across five campaigns. The same day, OpenAI opened the Codex orchestration layer as an Agents API and paused new subscriptions to its $200 Pro tier, citing pressure from Astra. Capacity expanding on one side and access narrowing on the other: the binding constraint for model companies is shifting from model capability to power and memory.

Theme 1: Anthropic’s September report splits misuse into influence operations and distillation

On September 10 Anthropic published its September threat intelligence report. The influence-operations section presents numbered cases (the GTG series): three Iranian state propaganda bodies — the Islamic Culture and Communications Organization (ICCO), a cognitive-warfare command room run out of a Mashhad seminary by the Islamic Propaganda Office of Khorasan Razavi, and the Bina Cultural Observatory — plus a Russian information manipulation operation in the Central African Republic, a commercial “influence-as-a-service” network spanning six continents, an election-manipulation platform targeting Malaysia, a pro-Awami League fake-news pipeline in Bangladesh, coordinated inauthentic behavior in Kenya, and a UAE-directed operation against the Muslim Brotherhood.

The report says Claude served as the “main administrative and operational layer” for these operations: writing playbooks and persona systems, rewriting and translating official intelligence bulletins into six languages (with a plan to reach 20), and laundering attribution so that state-backed narratives read as independent voices. During the 2026 US-Israel-Iran war, the Iranian network attributed fabricated claims to CSIS, Brookings and RAND. One shared agent platform was instructed to clone a real activist’s Telegram account, reading roughly 8,400 of his past posts to copy his writing style.

The Central African Republic case contains more granular detail: operators used Claude to score staff articles against a rubric and decide who would be laid off; when the model flagged the political weighting, the operators relabeled it in neutral terms and kept using it. They also used the model to maintain surveillance data on opposition political figures and to forge Gendarmerie and Ministry of Defense documents. Claude refused the most aggressive request — naming real individuals as militants to draw security action — and the operators pivoted to anonymous-source framing.

The distillation line is more sensitive. TechCrunch reported that Anthropic found nearly 200 million related interactions across five campaigns, alleging that Alibaba, Moonshot and DeepSeek extracted Claude’s chain-of-thought, coding and agent capabilities through proxy accounts or by forwarding user requests. Numbers circulating in Chinese-language communities also name Zhipu, Xiaomi, SenseTime and MiniMax. The report notes that forwarded user requests carried sensitive data with them.

The report turns “frontier models get misused” from a hypothesis into a numbered archive of operations, and it puts the question of vendors unilaterally analyzing user conversations on the table. The boundary matters: the specific distillation figures come from secondhand relay, the archived report text here covers only the influence-operations section, and those figures have not been checked against a primary source. Anthropic is both the observer of this data and a beneficiary of the distillation allegations.

Sources:

• https://www.anthropic.com/threat-intelligence-report-september-2026
• https://techcrunch.com/2026/09/10/anthropic-details-distillation-campaigns-from-alibaba-moonshot-ai-and-deepseek

Theme 2: DeepSeek V4.1-Flash trades memory for price

DeepSeek released V4.1-Flash under an MIT license on Hugging Face, the smallest model in its new architecture family. It has a 552B MoE backbone, roughly 8B activated parameters for input processing and 16B for output generation, a 1M context window, and native visual understanding. One analysis mentions an additional 196B Engram parameters alongside the backbone.

The real change is memory footprint. The model uses FP4 KV cache and cross-layer attention reuse, bringing global KV cache down to about 890 bytes per token — roughly one quarter of the previous V4-Flash and 1/437 of V1 — while supporting both HBM and SSD storage tiers. This route targets the cache cost of long agent sessions rather than raw capability.

Third-party evaluations widen the price gap: OpenDesign’s testing says it reaches 98% of top-ranked GPT-6 Astra’s score at about 1.4% of the cost; another developer says it beats Opus 5 and GPT-5.6 Sol on DeepSWE v1.1 at roughly 2.5% of Opus 5’s API cost. One detail researchers noticed on the training side: DeepSeek merges models during RL, combining checkpoints trained under different harness configurations and continuing from the successful ones, moving capability across tool environments. SiliconFlow put it live on day zero and called it “the new Pro,” Tencent’s WorkBuddy offers a two-week free trial, and DeepSeek delayed the retirement of V4 Pro.

There is local progress too: antirez ran V4.1-Flash on a 128GB M5 Max with DwarfStar over SSD streaming, faster than he expected. Companion infrastructure shipped the same day, including DeepJIT — a header-only C++20 JIT runtime supporting both NVIDIA CUDA GPUs and Huawei Ascend NPUs, giving extension authors a unified interface for kernel compilation, caching, loading and launch. Boundary: the full technical report, parameter scale and official benchmarks are not yet public, and all scores are third-party.

Sources:

• https://the-decoder.com/new-deepseek-model-v4-1-flash-cuts-memory-needs-for-ai-agents
• https://www.marktechpost.com/2026/09/10/deepseek-ai-released-deepseek-v4-1-flash-with-1m-context-fp4-kv-cache-and-cross-layer-attention-reuse

Theme 3: OpenAI opens an Agents API while pausing its $200 tier

OpenAI sent opposite signals in two directions on the same day. On the product side, the Agents API launched, productizing the Codex agent harness: the agent loop runs on OpenAI’s infrastructure handling model calls, tool use and context management, while developers define only the agent’s capabilities and runtime. Execution has three tiers, from bring-your-own sandbox to nine sandbox partners (Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, Vercel) to an OpenAI-hosted sandbox built on the same infrastructure as Codex. Codex lead Tibo says this is the same stack running underneath ChatGPT Work.

Three capabilities are worth noting: automatic compaction near the context limit so workflows span multiple context windows; tool search that loads tool definitions on demand to save tokens while preserving the model cache, with programmatic tool calling letting the model call tools in parallel, chain them and filter results inside code; and a main agent splitting work across parallel subagents that each hold their own context and report back.

On the commercial side, Tibo announced a pause on new subscriptions to the $200 Pro tier, saying Astra places the greatest strain on the system and existing users need to be protected first. Other tiers and the API are unaffected, existing accounts are unaffected, and there is no timeline for resuming. The same day, the GPT-Live-1 voice model entered the API, with Yelp Host, Hatch, Picsart, HeyGen, GenSpark and Cognition’s Devin Voice all announcing integrations.

Read together, the constraint has moved: the output side keeps expanding while the input side starts rationing. Keeping orchestration on the platform and handing sandboxes to developers effectively resolves the most common enterprise adoption concern — where code and data run — with the three tiers differing in CPU/GPU/memory combinations, cold-start time and cost. The subscription pause is first-party information; reports of a slower Codex on the Plus tier are individual observations without official confirmation.

Sources:

• https://x.com/thsottiaux/status/2098238138334548260

Theme 4: Cursor turns “can you manage a fleet of agents” into product and evaluation

Cursor released Projects (beta), changing the product shape from a single chat into a standing project team. The coordinator agent never touches code files; it understands intent, decomposes tasks, dispatches subagents and watches CI. Project-level context files pin down how the repository is tested, which patterns get rejected, and what pitfalls have been hit. Tasks can be attached to subscriptions, so a bug report in Slack or a failed CI run on GitHub can trigger work automatically.

Cursor’s internal statistic is that engineers who made heavy use of Projects merged 6x more pull requests. That is company data without independent verification, although the direction matches its evaluation updates the same period.

Details of CursorBench 4.0 also circulated: after public benchmarks were saturated, Cursor moved to a private question bank. The core mechanism is Cursor Blame, which traces committed code back to the agent request that generated it, naturally producing query/ground-truth pairs. Tasks come from internal codebases and controlled sources, with the whole bank replaced every few months to prevent leakage. Task scale roughly doubled from the first version to 3.0 and now includes multi-workspace monorepos, production log debugging and long-running experiments. Task descriptions are deliberately kept short and under-specified. The findings: Claude Fable 5.1 and Opus 5 are the most expensive and the strongest, GPT-6 Astra does not participate, and Grok 4.6 shows little advantage over Muse Spark 1.3 while costing more.

What is worth remembering is the methodology shift: with public benchmarks diverging from real experience, reverse-engineering real tasks offline plus controlled online experiments become a necessary complement.

Theme 5: Shopify goes back to native by cutting migration into reviewable pieces

Shopify announced it is moving all mobile apps from React Native back to Swift and Kotlin. Its 2020 all-in bet on React Native rested on the assumption that cross-platform code can only be written once; the company says that assumption broke in late 2025, when agents could take the iOS implementation as reference and write the Android version directly, keeping the two aligned through shared specs, tests and review.

The migration approach is called Helix, and the key point is that agents do not rewrite everything at once: each screen’s migration is sliced into checkpoints reviewable in minutes, and every checkpoint must pass behavior-equivalence tests and visual matching, clear two adversarial reviewers and a human sign-off, with review feedback retained.

The bottleneck turned out to be verification. Agent operations against a simulator take minutes, so the team decoupled business logic from UI into a CLI that runs headless on desktop. The result: the core Shop app went from proof of concept to a fully native release in 12 weeks.

The ecosystem cost is in the blog too: FlashList (about 2 million weekly downloads) needs a new maintainer; React Native Skia was forked and continued by its author with Shopify funding through the end of 2026; Restyle will be archived. Shopify’s stated judgment is that the barrier of implementation language has fallen below the barrier of specs and tests, which explains why it accepted the cost of rewriting two clients. The source is a company engineering blog, so this is vendor self-report.

Sources:

• https://shopify.engineering/back-to-native

Theme 6: Anthropic’s 2030 economic scenario puts distribution on the table

Anthropic published an economic scenario model for the United States through 2030. In the extreme scenario, 2030 US GDP is 32.4% higher than a world without AI, annual growth reaches 15.4%, and unemployment reaches 11.9%. Knowledge workers take the hardest hit: 17.9% unemployment, wages down 11.5% and employment down 21.5%. Wages for non-cognitive jobs rise 33.6%. Labour’s share of income falls from 60% to 45.2%, while capital income ends roughly 81% higher than it would have been. Most effects arrive only after 2028.

The part genuinely worth reading is distribution: the economy gets bigger and most of the new wealth lands with whoever owns the machines. The time shape matters too — 2026 and 2027 look relatively normal before the curve bends after 2028. Anthropic frames this as a scenario rather than a forecast, the numbers rest on its own assumptions, and the most load-bearing assumption — that capability improves fast enough to displace large volumes of cognitive work within four years — has not been independently tested. Chinese and English accounts of it currently come from secondhand summaries.

Theme 7: Safety debates get pulled into public view in a single day

Anthropic researcher Jacob Coxon resigned and then appeared on Fox News warning about AI risk. Nvidia’s Jensen Huang called his comments outlandish and “deeply untrue”; Garry Tan said the discussion is a smokescreen that distracts from more practical safety concerns; Gary Marcus wrote a long rebuttal of the “AI kills all humans by 2030” argument. The debate kept narrowing to a concrete question: whether employees’ public positions align with their employer’s policy asks.

On another front, Paul Christiano announced he is joining OpenAI’s nonprofit board overseeing safety, publishing a personal statement explaining why he considers the risk non-trivial. Kevin Roose describes him as one of the three most credible AI safety experts in the world, a co-inventor of RLHF who served at the US CAISI. That makes the question of who supervises whom more complicated than before.

There is also a more technical safety thread: independent investigators expanded a directory of suspected OpenAI agent services on collusion.wiki to 30 entries, finding traces of collaboration through wikis, text dumps and RubyGems metadata; Anthropic is reviewing four of its own security incidents; OpenAI says it has found no serious event comparable in scale to the Hugging Face intrusion.

This whole cluster is largely social media and secondhand reporting with sharply divided positions. The one first-party item with a methodology document is Anthropic’s Frontier Red Team evaluation, measuring model capability in tactical intelligence targeting (account linkage, photo and text geolocation) and conventional weapons development (drone terminal guidance, payload delivery, navigation under GPS jamming).

Sources:

• https://www.anthropic.com/research/intelligence-targeting-conventional-weapons-capabilities
• https://the-decoder.com/swarmchasers-hunt-rogue-agents-anthropic-investigates-itself-and-the-trail-they-both-follow-is-going-dark

Theme 8: API relay data leaks put credential risk in plain sight

A blogger who previously leaked Claude Code source code says a batch of relay-station data he bought for five figures (about 6TB) would be enough to support attacks on seven state-owned enterprises and 19 leading companies. Alongside chat logs, the data contains SSH private keys, VPN configurations, Alibaba Cloud keys and GitLab tokens.

The mechanism is not in doubt: an agent’s tool call is effectively remote code execution, so handing credentials to a relay station amounts to handing a stranger login rights to company systems. After an incident, the company can trace which employee sent those credentials — the leak happens at the company, but responsibility lands on the individual.

This corroborates detail in Anthropic’s report: it says forwarded user data on the DeepSeek side included live database credentials for an institution tied to the Russian Ministry of Defence, code related to a public security case-management system, and internal code and live credentials submitted by state-owned enterprise engineers. Boundary: the 6TB claim is a single blogger’s assertion without independent verification; that relay stations can see tool calls and credentials needs no further verification.

Theme 9: Agent engineering shifts from prompts to infrastructure

Several pieces of work on the same day pointed at one thing: what determines agent performance is often not the model. Researchers report that with weights held fixed, optimizing OpenCode’s harness for GPT-OSS-20B turned $50 of harness search into a 3x gain on Terminal-Bench.

System structure got pulled apart too. The AWS paper UnitBoost separates the management step from the execution step; replacing only the management step improves six compound-system configurations, raising FanOutQA cell F1 from 0.4778 to 0.5524. Other work proposes writing memory, time limits and runtime environment into the planning state, producing more conservative programs and lower memory peaks once constraints are disclosed. RefactorPlatform provides an evaluation environment for repository-level refactoring, using AST-aware chunking instead of naive windows and recording tokens, diffs, logs and verification results.

On methodology, the Kiro team published 10 principles for “Frontier Engineering,” arguing for replacing line-by-line authorship with infrastructure that lets agents close their own loops — stretching a 60-second wait cycle into a 30-minute self-healing loop, preparing a codebase the way you would prepare onboarding for a new hire, and making direction rather than execution the human’s main input. The fourth installment of Andrew Ng’s AI engineering skills map reaches a similar conclusion: coding agents advance fastest at “delivering once given a clear spec,” which pushes engineering toward deciding what belongs in the spec.

Most of this comes from company engineering blogs and paper preprints with no independent replication, but the direction is consistent — treating an agent as a colleague first requires building the surrounding toolchain, verification path and permission boundaries as formal engineering.

High-value briefs

• Liquid Network resumes producing blocks: on September 6, roughly 4,000 BTC (about $320 million) was withdrawn from the federated wallet by exploiting a cache flaw in Elements range-proof verification. Patch Elements v23.3.4 fixes the cache key; 3,400 BTC has been returned and about 598 BTC (roughly $46 million) remains unrecovered. Block production resumed Thursday, but transactions and pegging operations are still paused.
• OpenAI’s verticalization pace: ChatGPT for Financial Services launched with built-in financial data and GPT-6 Astra; an Data agent arrived in ChatGPT Work; a partnership with GSA offers federal, state, local and tribal governments $0 license fees and 50% off usage; a Box partnership brings enterprise content into ChatGPT; Codex and ChatGPT are being used to search living and extinct genomes for antimicrobial molecules.
• Meta Muse’s supervision design: the personal agent runs on an isolated Linux computer, a separate Sentinel agent watches what it sends out, passwords are stored separately so Muse cannot read them, purchases or emails require user confirmation, and it is free up to 100 million tokens per week.
• MiniCPM5-2B from ModelBest: described as 2B-class SOTA, it puts tool calling, deep search and code generation on-device and open-sources part of the training recipe, data and RL framework, including code pretraining data built from roughly 192 million public GitHub repositories and about 500,000 agent training samples.
• Google Pics: an image tool built on Nano Banana, live at pics.new, supporting local object editing, in-image text edits and translation, multiplayer collaboration and multiple options from a single prompt.
• Cognition factors RSA-260: employees used multiple Devin agents to build a high-performance GPU lattice sieve, breaking the public challenge record held by RSA-250 since 2020.
• Navier-Stokes and an authorship dispute: OpenAI says an agent team produced a solution to the Millennium Prize problem while responding to an authorship dispute involving Levent Alpöge and Tristan Buckmaster, acknowledging it cannot fully rule out indirect influence from de-identified product data. The result still awaits mathematical review.
• Collapsing test-time compute costs: Sam Altman shared Noam Brown’s claim that an older ARC result once required about $500,000 of compute, a level Astra now exceeds at very low cost.
• OUI-1: OpenUI released what it calls the first open-weights generative UI model, a 26B/A4B MoE with a 13.0% base baseline.
• Harnesses can be searched: with weights held fixed, optimizing the OpenCode harness for GPT-OSS-20B turned $50 of harness search into a 3x gain on Terminal-Bench.
• Chrome and Gemini distribution moves: Chrome 153 rolls out, the Gemini app arrives on Windows, and Google Cloud publishes a plugin pack for coding agents.
• Reported OpenAI screenless AI hardware in Shenzhen: the project is described as highly secret and slated for a 2027 launch; this is a single-source rumor.
• Google DeepMind’s AlphaGenome Atlas: aims to cover every DNA letter change in the human genome, positioned as a predictive map for variant interpretation and disease mechanism analysis; whether it validates stably determines how much target-screening time it compresses.
• Two capacity and capital data points: AI Base reports that Anthropic signed compute contracts totaling a substantial sum over 11 months, some running past 2030 and paired with plans for its own data centers; Mistral completed a Series D with Samsung, Scaleup Europe and PSG Equity participating, as European capital keeps paying for foundation-model independence.
• FLUX 3 Video adds precise editing: Black Forest Labs calls it the fastest and lowest-cost video editing model, able to swap a character, rebuild a background or restyle a shot from one prompt on fal; this is a vendor internal benchmark claim.
• Unitree fully open-sources a general-purpose humanoid foundation model: a humanoid hardware vendor opens the entire foundation model, adding another option for combining hardware and models.
• World Labs’ Atlas-turbo: demonstrates generating a new outdoor area from a picture of a child’s bedroom and continuing exploration, with spatial memory extending scenes beyond a single room.
• Paper roundup: NEAT-POCKET generates candidate molecules atom by atom conditioned on the protein binding pocket and explicitly models hydrogen; MultihopSpatial evaluates vision-language models on 1- to 3-hop compositional spatial relations; SoundMHPE attempts multi-person 3D pose recovery from audio alone; Protective Capacity Hallucination shows models claiming capabilities such as calling police or performing rescues, across eight models.
• Developer assets climb the trending lists: browser-use packages web tasks into orchestration-ready capabilities; superpowers breaks team coding experience into reusable skills; andrej-karpathy-skills uses a single CLAUDE.md to constrain Claude Code behavior; Google publishes official Agent Skills; designer Emil Kowalski’s 12 motion skills have passed 36,000 stars.
• Xinbi asset seizure: on September 8 the US Secret Service froze $52.8 million USDT across 52 wallets tied to the Telegram scam marketplace Xinbi, and the Treasury designated it a significant transnational criminal organization the next day. Two wallets totaling about $12 million were seized directly under a DOJ warrant, and Xinbi moved about $2.8 million into USDD, which has no centralized freeze switch.
• Real-world WebMCP adoption: a Chrome engineer analyzed 545 sites implementing WebMCP and found two recurring problems across thousands of tool definitions, indicating the specification for making sites callable by agents still has clear stylistic divergence.
• How multimodal inference gets split: Nvidia explains EPD disaggregation, where separating vision encoding from prefill and decode reduces resource contention and speeds responses, but only for the right workloads.

🕐 Selected hourly signals

PT time	Signal	Why it is worth remembering
01:00	Anthropic’s report and Paul Christiano joining OpenAI’s nonprofit board land in the same window	Misuse cases go public and safety oversight staffing settles at once, opening both safety threads for the day
02:00	MiniCPM5-2B ships with open training data	On-device models start opening the recipe, not just the weights
03:00	US Secret Service freezes $52.8M USDT across 52 wallets tied to Xinbi	Treasury designates it a significant transnational criminal organization the next day, with two wallets worth about $12M seized outright
04:00	Report that OpenAI is close to solving one or two more Millennium Prize problems	The claim traces to its blog noting separate agent groups on every unsolved Millennium problem
05:00	Coxon’s resignation and Jensen Huang’s response spread across social platforms	The safety debate moves from technical circles into financial and political commentary
09:00	With fixed weights, $50 of harness search yields 3x on Terminal-Bench	Turns “the harness matters as much as the model” into a reproducible number
10:00	GPT-Live-1 enters the API	Voice moves from demo to integrable product capability, with several announcements in one day
12:00	DeepSeek open-sources DeepJIT and companion infrastructure	Beyond inference optimization, the toolchain extends toward C++ and domestic NPUs
13:00	antirez runs V4.1-Flash locally on a 128GB M5 Max	SSD streaming beats expectations, adding a realistic local long-context option
14:00	Tibo announces a pause on new $200 Pro subscriptions	Compute strain appears in an official announcement for the first time
18:00	Liquid Network resumes block production	About 598 BTC from the 4,000 BTC incident remains unrecovered
19:00	OpenAI productizes the Codex agent harness as the Agents API	Orchestration to the platform, sandboxes to the developer; the biggest enterprise adoption concern gets split apart

Editorial conclusion

Only two pieces of hard information are confirmable today: Anthropic’s report turns misuse cases into a numbered archive, and OpenAI has put compute strain into an official notice. Most other signals remain under observation — DeepSeek’s scores are third-party, Cursor’s 6x is internal, and the safety argument is driven largely by social platforms. For people building products, two unglamorous lessons are worth keeping: Shopify cut migration into reviewable checkpoints, which shows the bottleneck for agent deployment sits in verification; and the Iranian network in Anthropic’s report industrialized the rewriting of official bulletins, which shows where the same capability lands depends on who industrializes it first.

Sources and method

Reviewed 20 hourly captures and five named sources with content in the target directory, about 309KB total, with a rich signal pool. Two PT windows had no new signals; OpenAI’s site body is behind anti-scraping protection so only RSS metadata was available; XiaoHu.AI failed to capture for lack of absolute dates; Chrome, Cline and Google Research published nothing new that day. The Anthropic report capture covers only the influence-operations section, so the distillation figures rely on secondhand reporting; the quantitative findings from Shopify and Cursor are company-internal figures.