Media Claims It’s IP Theft. Nobody Has Named the Cause of Action.

Washington has spent a year describing AI distillation as intellectual property theft. Run it through the four doors that phrase could actually open, and something uncomfortable happens.

In February 2026, Anthropic published an unusually specific accusation. It said three Chinese AI labs had generated more than 16 million exchanges with Claude through roughly 24,000 fraudulent accounts. In June it told the Senate that Alibaba had run approximately 25,000 fake accounts and 28.8 million exchanges over three months.

Read Anthropic’s own characterization carefully. The conduct occurred, it wrote, “in violation of our terms of service and regional access restrictions.”

That is a contract claim. By the time the story reached Washington it had become intellectual property theft, with sanctions and export restrictions floated as the remedy. Those are two different assertions about two different bodies of law, and the gap between them has gone almost entirely unexamined.

Let’s examine it. Distillation means querying another company’s model through its public interface, collecting the answers, and training your own model on them. If that is theft, theft of what?

Door one: trade secrets

The obvious candidate. Model weights, the trained parameters that constitute the model itself, are unquestionably protectable as trade secrets. When someone actually takes them, the law works: a former Google engineer was convicted in January 2026 on seven counts of economic espionage for exfiltrating AI infrastructure secrets..

Distillation never reaches the weights. It observes what the model says to a paying customer and reasons backward, which is the textbook description of reverse engineering. The Defend Trade Secrets Act addresses this directly. Improper means, the statute says at 18 U.S.C. § 1839(6)(B), “does not include reverse engineering, independent derivation, or any other lawful means of acquisition.” The Supreme Court said the same thing in 1974.

Bahrad Sokhansanj of the Institute for Law and AI called out the problem clearly in Lawfare: “Distillation doesn’t involve breaking into a developer’s internal system to download the model weights or source code,” and “trade secret protection requires reasonable efforts to keep information secret, and ordinary outputs are available to anyone with an account.”

There is a real counterargument. In a 2020 case involving a competitor that scraped 43 million insurance quotes from a public quote engine, the Eleventh Circuit held that scale can convert lawful access into improper means. Applied here: no single output is secret, while the compiled behavior across millions of exchanges might be. Nobody has tested that theory against model outputs yet. Critics doubt it would survive the attempt.

Door two: copyright

This door is closed, and for two independent reasons.

The outputs are almost certainly not copyrightable by the lab that produced them. The Copyright Office has held since 2023 that “copyright can protect only material that is the product of human creativity,” and the D.C. Circuit affirmed the human authorship requirement in 2025. The weights may not be copyrightable either. Mark Lemley of Stanford and Peter Henderson of Princeton concluded in the Indiana Law Journal that “model weights and model outputs are largely not copyrightable, making it unclear whether there is even anything to be licensed.”

Then there is the awkward part. American labs have spent three years arguing in federal court that training on someone else’s material is transformative fair use, and in the Anthropic and Meta cases they substantially won that argument. Georgetown law professor Anupam Chander named the tension on NPR: “After all, the AI companies believe, and they have argued, that learning from others is a perfectly fair use of other people’s copyrighted work.”

Door three: contract

Here something actually works. OpenAI’s terms forbid using output “to develop models that compete with OpenAI.” Anthropic’s commercial terms bar accessing the service “to build a competing product or service, including to train competing AI models.” A distiller who accepted those terms and did that thing breached them.

Note what kind of claim that is. It is a promise broken, enforceable against whoever made the promise, with contract damages as the ordinary remedy. Lemley is skeptical it even survives: “I think they are likely unenforceable, because DeepSeek didn’t take anything copyrighted by OpenAI and because courts generally won’t enforce agreements not to compete in the absence of an IP right that would prevent that competition.”

Door four: computer fraud

The 24,000 fraudulent accounts are the strongest fact in the entire story, and they point away from intellectual property entirely. Fabricated identities used to evade access controls implicate the Computer Fraud and Abuse Act and ordinary fraud doctrine. The Supreme Court narrowed the CFAA in 2021 and expressly reserved whether contractual limits count, and a scraping verdict turning on fake accounts is currently on appeal. The law here is genuinely unsettled.

What it is not is a property claim. The wrong being described is deception.

The tell

No frontier lab has sued a distiller. Sam Altman said in February 2025 that OpenAI had no plans to. Anthropic named three companies, quantified the conduct to the exchange, cut off access, and asked Washington for policy action without filing a complaint. In April 2026, Elon Musk testified under oath that xAI had trained on OpenAI models, called it “a general practice among AI companies,” and when pressed on whether that meant yes, answered “Partly.” Nothing followed.

Litigation would require pleading a specific cause of action and submitting your own fair use theories to adversarial testing. A press release requires none of that. Sokhansanj identified the stake precisely: “if every TOS violation counts as ‘theft,’ then the concept has no limiting principle.”

What’s left

If you publish weights, you retain almost nothing enforceable. Publication ends secrecy by definition, and the copyright that open-weight licenses are drafted to condition on may not exist. Meta included a clause in the Llama 3 license forbidding use of its outputs to improve other models, then removed it fifteen months later.

“IP theft” is a powerful phrase precisely because it sounds like a legal conclusion. Walk through all four doors and what’s there is a contract claim, maybe a fraud claim, and a lot of discomfort. Not theft.