AI & Automation Briefing - September 12, 2026
Anthropic Documents Nearly 200 Million Distillation Attack Exchanges Tied to Chinese AI Labs
Anthropic published a report on September 10 detailing five large-scale distillation campaigns attributed to China-based AI companies, including Alibaba, Moonshot AI, and DeepSeek. The attacks targeted Claude's chain-of-thought reasoning, agentic capabilities, coding, and data analysis. Distillation attacks work by extracting a model's internal reasoning traces and using that data to train smaller models via supervised fine-tuning. Anthropic normally withholds internal chain-of-thought output, showing users only summarized thinking, but attackers developed techniques to surface raw reasoning traces. One method framed the request as a translation task to bypass safeguards. The largest campaign, attributed to Alibaba, generated 151 million exchanges across 3,500 accounts between May and July 2026, peaking near three million exchanges per day. Anthropic linked those accounts through a shared fixed prompt used to extract training data for Alibaba's Qwen models. A separate Moonshot AI campaign ran roughly 300,000 requests through 5,000 accounts over ten days, primarily targeting Claude Opus, with at least one request appearing to route from the Chinese military to analyze surveillance footage for abnormal behavior. Anthropic had flagged distillation attacks as early as February; the new report describes the activity as both larger and more technically sophisticated than anything previously observed.
AI Tools Are Driving a Surge in Public Service Submissions Worldwide
Researcher Chris Schmitz has documented what he calls "agentic flooding," a pattern where AI tools are driving large volume increases in applications and complaints to public agencies. His forthcoming paper for the AI Ethics and Society conference covers 84 cases across 11 jurisdictions. UK housing ombudsman complaints rose from 2,600 in 2022 to over 7,000 last year. US Consumer Financial Protection Bureau complaints grew fivefold over the same period. Similar jumps appeared in Brazilian judicial petitions and German parliamentary petitions. Submissions across most cases were flat before 2022 and have continued rising without any sign of slowing. Unlike the flood of low-quality AI-generated bug bounty reports that burdened security teams last year, Schmitz notes that most of the new public service submissions are coming from real people with legitimate claims, many of whom would not have filed without AI assistance. The core operational challenge is that agencies must process a much higher volume of requests with the same staffing and budget.
Procedural Graphs Give LLM Agents Self-Correcting Execution Structures
Researchers have introduced Procedural Graphs, a framework that organizes an LLM agent's step-by-step decision logic into explicit graph structures rather than leaving it implicit in generation history. Each node represents a procedure, and a guidance model reads the surrounding subgraph to steer the agent's next action without overriding it. The key capability is self-evolution: an LLM refiner compares failed runs against successful ones and edits the graph's structure and attributes automatically, improving performance without manual redesign. Tests across multiple datasets, task types, and base models show consistent gains over memory-based agent baselines. For builders of multi-step agentic workflows, this approach addresses a real failure mode: agents drifting from their objectives, calling tools out of sequence, or repeating failed actions as context grows.