“We have identified industrial-scale campaigns by three AI laboratories—DeepSeek, Moonshot, and MiniMax—to illicitly extract Claude’s capabilities to improve their own models.” This is how Anthropic opens its report on “distillation attacks” by Chinese labs. Anthropic goes on: “[D]istillation can . . . be used for illicit purposes: competitors can use it to acquire powerful capabilities from other labs in a fraction of the time, and at a fraction of the cost, that it would take to develop them independently.” 

In this report, Anthropic is effectively stating that it’s illegal for a competitor to distill their models. This piece analyzes whether that is true.

Distillation is the process of training a model by piggybacking on the intelligence of another model. In broad terms, a “student” model is trained on the outputs of an already trained “teacher” model, typically by querying the teacher at scale. Those prompt-and-answer pairs become the student’s training data: instead of learning from the raw data, the student learns to reproduce the teacher’s answers directly.

The benefit is efficiency, and the teacher-student framing shows why. A philosophy professor spends years mastering a subject, then delivers it to students in a single semester. The students get the distilled knowledge without repeating the work that produced it. As it relates to a competitor distilling from a frontier lab (the focus of this piece), this efficiency means distillation can be used to train a model for significantly cheaper.

Unfortunately for Anthropic, the legal claims it could bring for the act of training on its outputs independently are relatively weak. Instead, the fight will focus on how access to those outputs was obtained. If outputs were accessed through authorized means, Anthropic’s claims will be weaker. If they were obtained through unauthorized means (fake accounts, evaded bans, etc.), Anthropic has much stronger claims. With this understanding, we can see that Anthropic is (intentionally or not) muddying the waters between the extreme conduct of a state adversary and the legality of distilling generally.

Understanding the law of distillation matters to us at Variant because we invest in technology that enables autonomy, and distillation’s legality or illegality will play a large part in who controls frontier intelligence. Pretraining is a game of resources and talent. The frontier labs have both, and their enormous head start compounds through economies of scale, brand power, and successive generations of models helping build the next. Left alone, the trajectory looks like a monopoly on frontier intelligence, and we will all be beholden to a few companies. Distillation is a key counterweight: it lets a challenger bootstrap a competitive model with a fraction of the resources. Whether the law permits that counterweight, and on what terms, is what the rest of this piece works out.

Separating access from training

A distiller (at least the kind this piece is about, an external party distilling from a frontier lab) does two things: it (1) accesses outputs through the frontier lab’s applications or API, and (2) trains its own model on those outputs. These two things ask very different questions under the law. The first focuses on the distiller’s conduct in accessing those outputs. The second focuses on how knowledge is transferred from the lab to the distiller.

What constitutes training is straightforward, but how access is obtained generally boils down to “authorized” and “unauthorized” accounts:

• By “authorized,” we mean a good-faith user who has a valid account with the lab and accesses the outputs simply by using the product. This could take the form of a harness or router that offers access to Anthropic’s paid API and then collects traces. Or it could take the form of a user who is directly engaged with the lab (e.g., using Claude) selling their traces, for example, using a Chrome plugin.
• By “unauthorized,” we mean a user the lab has explicitly banned or whose access it has revoked. Anthropic’s allegations regarding the Chinese labs show what this looks like:

The law of distillation

To ground the discussion, imagine Anthropic wants to bring a claim against a distiller. What would it plead? There are three buckets of claims: (1) copyright, (2) breach of contract, and (3) torts and other statutory claims.¹ 

Copyright

Copyright law protects original works of human authorship. Two federal statutory frameworks matter for our purposes, and they map onto our access/training distinction. First, the Copyright Act permits a holder of a copyright to sue an infringer: someone who copies, distributes, or adapts the work without permission. Second, the Digital Millennium Copyright Act (DMCA) prohibits circumventing the technical measures (collectively referred to as digital rights management, or DRM) that protect access to copyrighted works. 

However, if there is no copyrighted work, neither framework applies. There are three candidate “works” Anthropic could assert here as having copyright protection, but all three run into issues.

First, the outputs: notably, the only thing a distiller actually copies. The roadblock is that outputs are AI-generated, not human-generated, and the Copyright Office has repeatedly reaffirmed over the past few years that AI-generated content is not independently copyrightable.² Even if it were, Anthropic assigns whatever rights exist (“if any,” as its own terms hedge) to its users.

Second, the weights: the billions of numbers that constitute the model itself. The theory of infringement here has to be indirect because the distiller never sees the weights. Anthropic would have to argue that the outputs are derivative works of the weights (i.e., based on and adapted from the underlying weights, the same way a film adapts a novel), such that copying the outputs infringes the weights. But the weights claim likely fails at the same step as outputs: weights are set by the training process, not authored by a person. And copyright covers creative expression, never a “procedure, process, system, [or] method of operation.”³ Weights are likely just such a process: machinery that produces outputs, not a work that expresses anything to a reader.⁴

Finally, the training data. The theory is again indirect: the outputs are derivative works of a compiled training corpus, so copying them infringes Anthropic’s rights. But a compilation earns copyright only through creative selection and arrangement, and “everything available for scraping on the internet” (which describes a large share of the training data) is likely not a creative selection. Nor do a model’s outputs meaningfully reproduce the corpus’s selection and arrangement: they do not reveal which works Anthropic selected or how it organized them, and that curation is all a compilation copyright protects. Not to mention, most of the training data belongs to third parties, many of whom are currently suing the labs over that very scraping.

Given Anthropic likely does not have a valid copyright interest in any of these works, bringing an infringement suit under the Copyright Act will likely fail. But even if Anthropic has a valid copyright,⁵ the distiller will argue “transformative fair use,” the doctrine that permits copying when, weighing several factors, the use serves a new purpose or market rather than substituting for the original. And the distiller has an argument here: it is not republishing the model’s answers — it is learning patterns from them to build its own model, which could be seen as sufficiently “transformative.” Anthropic’s best counterargument here is probably Thomson Reuters v. ROSS Intelligence, where a court rejected fair use for a startup that copied Westlaw’s headnotes to train a competing legal research tool.⁶

But even so, the bigger problem for Anthropic is that fair use is the same doctrine it needs for its own defense in the scraping suits against it. For example, in Bartz v. Anthropic, authors sued Anthropic for scraping their books to train its models, and Anthropic defended the training as transformative fair use, a defense the court accepted as to training itself, before Anthropic settled the case’s piracy claims for $1.5 billion. Anthropic is thus hamstrung because many of the arguments it would make to narrow fair use as a plaintiff would hand its adversaries counterarguments to read back to it as a defendant.⁷

The DMCA claim for unauthorized access runs into the same issue as the infringement claim: there is likely no copyright to access in the first instance, leaving the statute out of scope. If there were a valid copyright, how the access was obtained would matter greatly to the claim. The DMCA, unlike the Copyright Act, polices how you reach a work rather than what you do with it: liability attaches to circumventing the technical locks that guard access. An unauthorized user circumventing blocks Anthropic has established could violate the DMCA (if there is a valid copyright).⁸

Breach of contract

If copyright doesn’t work as a claim, Anthropic would fall back on breach of contract,⁹ in this case its terms of service. Most relevant to distillation, two specific classes of terms stand out, and they map to our training/access distinction:

• Anti-training terms: Anthropic’s terms bar customers from accessing the services “to build a competing product or service, including to train competing AI models,” and from “reverse engineer[ing]” the services. 
• Access terms: Anthropic’s terms require accurate account information and prohibit sharing credentials, reselling access, and bypassing Anthropic’s systems or protective measures.¹⁰ 

Anthropic’s terms likely form a valid contract,¹¹ so the core question is whether these terms are enforceable. There are several reasons a court may not enforce valid terms. 

First, courts can refuse to enforce contract terms that violate law or settled public policy. Two flavors of that matter here: (1) antitrust law and (2) trade secret law. Both doctrines could be used to try and strike down the anti-training terms. It’s not clear how they could be applied to void the access terms.

• Antitrust: Conditioning access on an agreement not to use the product to train a competing model is arguably suspect under antitrust law, so a court may void the terms on that basis. The distiller would have to show the restraint actually harms competition, which may not be easy against one lab among many.¹² Although a company can generally just refuse to deal with a rival, selling to everyone on the condition that no buyer uses the product to compete is plausibly an agreement restraining competition, and such agreements get antitrust scrutiny that unilateral refusals don’t.¹³ 
• Trade secret: Trade secret law preserves the right to reverse engineer a product acquired fairly, i.e., not through “improper means.” A court could void the terms’ ban on reverse engineering to uphold that right, although most courts have not done so.¹⁴ But the privilege to reverse engineer only ever belongs to someone who acquired access fairly. An authorized user who studies outputs it paid for is squarely within the privilege, so the policy argument for voiding the ban is available to it. An unauthorized user is likely outside the privilege from the start: unauthorized access is itself likely “improper means”¹⁵ that the law does not protect. Courts have found improper means where scraping bots evaded barriers or vacuumed up entire databases by querying information piecemeal.

Second, a breach-of-contract claim may be preempted by the Copyright Act. Preemption is the doctrine that federal law displaces state law claims that tread on federal territory. Breach of contract is a state law claim; copyright is exclusively federal. The distiller could argue that a breach of contract suit sufficiently related to questions of copyright is really a copyright claim in disguise, so the Copyright Act takes over and the contract claim disappears. Notably, this works even if the content is not copyrightable (as the previous section suggests): preemption turns on whether the claim falls within copyright’s subject matter, not on whether the copyright is any good. And that is exactly why the distiller would make this argument: it forces the fight into the world of copyright, where Anthropic is weak.

The anti-training terms could be at risk of being preempted because a court could decide that they’re really terms about copying, and therefore, squarely within the ambit of the Copyright Act. The fact that the terms are boilerplate offered to the whole world helps the distiller’s preemption argument: a restriction everyone must accept starts to function like a right against the world, and rights against the world on how outputs can be copied moves things into copyright’s domain. Anthropic’s terms sharpen the problem by assigning the outputs to the user: having given the content away, the only right to exclude Anthropic holds is the one its contract invents, and a contract that invents exclusion out of nothing is arguably doing copyright’s job.¹⁶ The access terms would fare much better because they speak to conduct rather than copying. One catch: even a clean breach of the access terms will need to show damages that flow from the access itself. When X sued Bright Data for scraping, the court accepted that Bright Data was bound by X’s terms and still tossed the contract claim, because the only damage X pleaded came from the scraping and selling of data (a theory the court held preempted), not from the access.¹⁷

Either way, Anthropic is in a bind arguing against preemption because it has already taken the other side of this exact fight. When Reddit sued Anthropic for scraping its website in violation of its user agreement, Anthropic removed the case to federal court, arguing Reddit’s contract and tort claims were copyright claims governed exclusively (that is, preempted) by federal copyright law so that it could leverage defenses such as fair use.¹⁸ However, this March, the federal court held that none of Reddit’s claims were preempted for purposes of removal, and sent the case back to state court. Although this ruling does not legally prevent Anthropic from arguing that its own terms are not preempted, it is now hard for Anthropic to argue that its own terms escape preemption by federal law while arguing everyone else’s anti-scraping terms don’t.¹⁹

Finally, there is privity: the rule that a contract binds only the parties who actually agreed to it, so Anthropic could only sue its direct counterparty. The problem is that the distiller is often not the direct counterparty: an entire economy exists around reselling outputs.²⁰ It will be very difficult for Anthropic to establish privity with a distiller that buys outputs from a reseller without demonstrating it acted in concert with the reseller. So while Anthropic may have a claim against the reseller, extending it to the distiller will not be trivial.

Torts and other statutory claims

There is a hodgepodge of claims in tort and statute Anthropic could reach for with varying degrees of strength. The non-exhaustive list includes:²¹ 

• Unjust enrichment: A claim for a benefit unfairly gained at another’s expense. Everything depends on what the “unfairness” is. If the only unfairness alleged is the act of copying itself, the claim protects the same thing copyright protects and likely gets preempted. For instance, a court dismissed an unjust enrichment claim against Meta where books were copied to train its model for this reason, finding that it was preempted.²² However, if the unfairness lies in how the benefit was obtained, the claim can stand on its own and avoid preemption. When Reddit sued Anthropic, the court refused to preempt Reddit’s unjust enrichment claim because it rested on bypassed safeguards, violated access restrictions, and made misrepresentations rather than copying alone.²³
• Trespass to chattels: A claim for interfering with someone else’s personal property, here Anthropic’s servers. This claim often fails, because the tort requires actually impairing the property or depriving the owner of its use, and fraudulent access usually does not supply what is missing, which is harm to the servers themselves. Some courts have let the claim proceed where scraping bots hammered servers hard enough to strain capacity, but Anthropic’s problem with a distiller is different: a paying customer’s metered API calls impair nothing, since that capacity is what Anthropic sells. So the claim will likely struggle.
• The Computer Fraud and Abuse Act (CFAA): The federal anti-hacking statute imposes civil and criminal liability for accessing a computer without authorization. It is entirely about access, with nothing to say about training. The Supreme Court has held that misusing access you were given does not count: an authorized user who sells its trace data to a distiller, even if that breached the terms of service, has likely not violated the CFAA. But courts in the scraping context have accepted the theory that once a user’s access to a login-gated service is revoked, coming back anyway — including through fake accounts — is access without authorization. So Anthropic has a solid liability theory against a distiller that keeps creating fake accounts after Anthropic has clearly revoked that actor’s access. The catch is damages: a civil CFAA claim requires at least $5,000 in “loss,” and courts have divided on what counts. Some require harm tied to the systems themselves rather than the value of what was taken, and scraping plaintiffs have proven unauthorized access only to lose on this element. Others have accepted the costs of investigating the intrusion and hardening systems against it. (We’ve written an in-depth analysis about the CFAA here.)
• Trade secret misappropriation: Anthropic has trade secrets in its weights, architecture, and training methods, and trade secret law prohibits acquiring a secret through “improper means” — a term the statute defines to include misrepresentation, which is where the creation of fraudulent accounts at scale might fit. At least one federal appeals court has held that using bots to collect an otherwise infeasible volume of individually available data can itself be improper means, and Anthropic’s own defenses to stop fraudulent accounts help satisfy the separate requirement that it took reasonable steps to keep the secret.²⁴ The hard question is what the secret is. The distiller never touches the weights, only outputs, so Anthropic must argue that outputs extracted at scale are a proxy for the secrets behind them. No court has said they are.

Notice the pattern across all of these claims: access through deception or fraud is more likely to give rise to a claim. They turn much more on how the outputs were accessed than on what was done with them.

Takeaways and predictions

Anthropic’s strongest claims are against a distiller who is not authorized to access outputs. The contract claim is strong because the access terms police conduct rather than copying, so they largely survive both preemption and the public policy challenges. And the tort/statutory claims are strong because they are built for conduct that looks like deception or fraud: fake accounts, evaded bans, misrepresentations. This is why Anthropic would have a strong claim against the Chinese labs. But the unfortunate truth is that the parties most willing to use extreme tactics to access Anthropic’s outputs, like the Chinese labs, typically sit in nations that won’t cooperate with the US legal system. So Anthropic’s potential legal claims against these actors are a right without a remedy: it can win the judgment but rarely enforce it.

Anthropic’s claims are much less clear for distillers who train on outputs that were obtained through authorized access. Authorized access shifts the fight into the training world, where copyright law could preempt the breach-of-contract claim, and Anthropic would be strained in arguing against preemption after telling a court that others’ anti-scraping terms are copyright claims in disguise. It’s a particular problem when an authorized user resells to a distiller: there is no privity between Anthropic and the distiller. And torts and statutes have less to say about a party who is not engaging in deception or fraud.

Putting two and two together, we can predict how things play out:

1. We expect US frontier labs to limit public access to their latest models and focus on B2B, something we’ve argued before. Less public access means fewer ways in for parties beyond the reach of US law, and fewer end users around to resell traces. Negotiated deals are also safer from preemption: courts are far more reluctant to displace an arm’s-length contract between sophisticated parties than boilerplate terms imposed on everyone. B2B also fixes the privity problem: there’s always a direct counterparty on the hook, and the lab can force it to flow restrictions down to its own customers. A bespoke deal can even designate model information as confidential, which strengthens the trade secret claim.
2. We also expect the labs to invest heavily in anti-evasion mechanisms, not only because they prevent distillation in the first instance but because they buttress the legal claims. Once a lab blocks a user, a ban strips that user’s authorization, and sneaking past that ban may create legal exposure. The trade-off is that defenses aggressive enough to catch distillers catch legitimate customers too. We got a glimpse of this at Fable 5’s release, when Anthropic tuned its classifiers so conservatively that they flagged, by its own account, “a wide range of requests–even ones that were almost certainly benign.”²⁵ 
3. We expect the Chinese labs to keep finding ways to access outputs and distill regardless. History shows that outputs, like any information product, are very hard to contain: the most motivated parties generally find a way to access them.²⁶ Given the geopolitics of controlling frontier intelligence, China is about as motivated as parties come, and fully stopping it is unlikely. 
4. Without the ability to enforce against the Chinese labs, the US frontier labs will turn their attention to stopping competitors who are within their reach from distilling these open Chinese models, as Thinking Machines has done with its Inkling model. Because the US challenger labs do not need to access the US frontier labs’ systems to do so, contract and tort/statutory claims against these competitors will be weak. Copyright could normally step in because it is a “right against the world,” so no direct relationship to enforce a claim is necessary. But Anthropic’s weak copyright interest presents a hurdle here, too.²⁷ 
5. To plug this legal hole, we expect the US frontier labs to continue to turn to politics, lobbying (on national security grounds) to make it illegal for US companies to use Chinese models (as Anthropic’s report already does, by framing distillation as an export-control problem). Even if they can’t stop China from distilling, they can stop US competitors from distilling the distiller through the broad ambit of national security law.

Conclusion

Where does this leave us? Anthropic’s report treats a competitor’s distillation as illicit by its nature. The law does not. The key question is how access was obtained, and authorized users have a decent argument that training on these outputs is legal. Anthropic does have a good claim against motivated actors carrying out something that looks more like a cyberattack, but those actors are often located abroad and are the hardest for the law to reach for practical purposes. Anthropic is caught between claims it can’t easily win and defendants it can’t easily reach. This fight will probably be settled by engineering, lobbying, and business models rather than by lawsuits.

Footnotes

1. The framework here builds on Henderson and Lemley’s excellent paper, The Mirage of Artificial Intelligence Terms of Use Restrictions, 100 Ind. L.J. 1327 (2025), which anyone interested in this topic should read in full. 

2. The strongest counterargument: Jane C. Ginsburg & Luke Ali Budiardjo, Authors and Machines, 34 Berkeley Tech. L.J. 343 (2019), arguing that “[i]n many cases, either the upstream human being who programs and trains a machine to produce an output, or the downstream human being who requests the output, is sufficiently involved in the conception and execution of the resulting work to claim authorship” — works are “authorless” only when neither is.

3. 17 U.S.C. § 102(b).

4. One wrinkle worth considering is around memorizing training data: models sometimes memorize and reproduce training data verbatim, meaning particular outputs (and arguably the weights themselves) can contain copyrighted expression. See A. Feder Cooper & James Grimmelmann, The Files are in the Computer: On Copyright, Memorization, and Generative AI, 100 Chi.-Kent L. Rev. 141 (2025).

5. An alternative legal theory would be enforcing the terms of service as a conditional license: comply or you were never licensed at all, which makes the distiller an infringer rather than a mere contract-breacher. The catch is that leveraging a copyright to block competing products is a classic fact pattern for something called the “copyright misuse doctrine,” which renders a copyright unenforceable for as long as the misuse continues. This is not a sure thing; for instance, the ROSS court rejected ROSS’s copyright misuse defense because ROSS never showed that Thomson Reuters used its copyrights to stifle competition, after ROSS had already lost its antitrust counterclaims. See Thomson Reuters Enter. Ctr. GmbH v. ROSS Intel. Inc., No. 1:20-cv-613-SB, slip op. at 15, (D. Del. Feb. 11, 2025).

6. ROSS is on appeal: the Third Circuit heard the argument this June and has not yet ruled. While not a fair use question directly, the headnotes were human-written, giving Thomson Reuters a far stronger claim to copyright in the first instance than a lab could assert over AI-generated outputs. And the district court expressly limited its holding to “non-generative AI.”

7. In fairness, the suits differ. A distilled clone substitutes for Anthropic’s models in Anthropic’s own market in a way a chatbot doesn’t substitute for the books it trained on. That difference goes to one of the most important questions in fair use, which is whether the copy serves a new market or replaces the original. The different contexts may give Anthropic room to argue both sides, but a court may not find it persuasive.

8. See, e.g., I.M.S. Inquiry Management Systems v. Berkshire Information Systems, 307 F. Supp. 2d 521 (S.D.N.Y. 2004), where a competitor accessed a password-protected advertising database using credentials issued to a third party, and the court dismissed the DMCA claim: the defendant “did not surmount or puncture or evade any technological measure” but used a password the plaintiff itself had issued, and what it bypassed was permission, not the technological measure itself. Contrast this with Ticketmaster v. RMG Technologies, 507 F. Supp. 2d 1096 (C.D. Cal. 2007), where the defendant sold bots that defeated CAPTCHA and used what it advertised as stealth technology to hide IP addresses so users would “never get blocked by Ticketmaster.” The court held CAPTCHA was a technological measure effectively controlling access and found Ticketmaster likely to prevail on its anti-circumvention and anti-trafficking claims.

Anthropic could try arguing that its login gates control access to other copyrighted works, like the software behind its consumer apps, but that is not the focus of this piece. 

9. To be clear, these claims (copyright, contract, torts/other statutes) are not mutually exclusive: Anthropic would throw the kitchen sink at a defendant. The buckets are separated because each fails (or survives) for different reasons. 

10. These restrictions span Anthropic’s two sets of terms. The consumer terms (effective Oct. 8, 2025), which govern Claude.ai, require “correct, current, and complete Account information,” prohibit sharing “Account login information, Anthropic API key, or Account credentials,” and bar using the Services “to deceive any person” or “bypassing any of our systems or protective measures.” The commercial terms (effective June 17, 2025), which govern API access, bar reselling the “Services” without approval and make the customer responsible for all account activity. Both bar building competing products, including training competing AI models, and both prohibit helping anyone else to do so.

11. Anthropic follows the “clickwrap” paradigm (the terms are hyperlinked at sign-up and the user clicks a button agreeing to them), and courts routinely enforce clickwrap agreements. We’ve written about the law of enforceable terms of service here.

12. The classic cases condemning conditional dealing involved sellers with outsized market power, like the newspaper in Lorain Journal Co. v. United States, 342 U.S. 143 (1951), which controlled local advertising and refused ads to anyone who also bought them from the town’s new radio station. Whether Anthropic has this level of power could be debated, considering competing open-weight models are a click away.  

13. Courts won’t enforce a promise if enforcing it would force someone to break federal law. See Kaiser Steel Corp. v. Mullins, 455 U.S. 72, 77–79 (1982). The idea that selling on conditions draws scrutiny under antitrust law that a flat refusal to sell doesn’t is explained in Erik Hovenkamp, The Antitrust Duty to Deal in the Age of Big Tech, 131 Yale L.J. 1483, 1519–21, 1537–38 (2022) (distinguishing conditional dealing from unconditional refusals to deal) and Peter Henderson & Mark A. Lemley, The Mirage of Artificial Intelligence Terms of Use Restrictions. The closest case to our facts is Crowder v. LinkedIn, where LinkedIn allegedly told potential competitors they could have access to its API only if they promised not to build competitive products. The court held those allegations sufficient to state monopolization and attempted monopolization claims under Section 2 of the Sherman Act, noting that agreements not to compete aimed at preserving a monopoly have long been condemned. Crowder v. LinkedIn Corp., No. 4:22-cv-00237-HSG, 2024 WL 1221956 (N.D. Cal. Mar. 21, 2024). However, the judge remarked in the same order that the agreements produced in discovery may not contain the outright non-compete the complaint alleges, and no court has ruled on whether these conditions actually violate antitrust law. Restrictions like this get judged against the “rule of reason,” which asks whether the restraint harms competition in a defined market more than it helps it. So under our facts the distiller would need to show the restriction against distillation unreasonably harms competition overall, not just that it hurts the distiller. Ixchel Pharma, LLC v. Biogen, Inc., 9 Cal. 5th 1130, 1150–62 (2020). We note that Ixchel is a California case, and California law governs given Anthropic’s choice of law provision (for context, the commercial terms select California law as governing law for every customer outside of Europe, and the consumer terms select it for everyone).

14. Most courts have enforced no-reverse-engineering terms in software products. See Bowers v. Baystate Technologies, Inc., 320 F.3d 1317, 1325–26 (Fed. Cir. 2003). These cases were fought on copyright preemption rather than trade secret grounds, but the question was the same: whether a contract can take away a right that federal law otherwise protects. The main dissenting court refused to enforce this kind of term because it deemed it clashed with federal copyright law. Vault Corp. v. Quaid Software Ltd., 847 F.2d 255, 270 (5th Cir. 1988). The disagreement has stood for over 20 years, and the Supreme Court has yet to resolve it. Anthropic’s own consumer terms anticipate this disagreement, banning reverse engineering “except when these restrictions are prohibited by applicable law.”

15. The statute’s definition of “improper means” includes “theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means.” 18 U.S.C. § 1839(6)(A). 

16. Copyright preemption comes in two flavors. The first is express preemption: the Copyright Act’s text displaces state-law claims that assert rights equivalent to copyright, and the usual test asks whether the claim has an “extra element” that makes it qualitatively different from a copyright claim. Most courts hold a contract supplies one: copyright binds the whole world, while a contract claim requires proving a promise this defendant actually made and broke. Empirically, express preemption of contract claims is the minority outcome: Guy A. Rub, Copyright Survives: Rethinking the Copyright-Contract Conflict, 103 Va. L. Rev. 1141 (2017), reviewed four decades of decisions and found “”[t]he vast majority of the contracts litigated since ProCD [the canonical case] embody commercially reasonable transactions that do not seem to pose any real threat to the goals or policies of federal copyright law.” And the leading preemption wins involved free public websites; a paid API contract, with real consideration flowing both ways, gives Anthropic a cleaner “extra element” than the defendants in those cases had.

The second flavor is conflict preemption: even a claim that clears the extra-element test can be displaced if enforcing it would frustrate the Copyright Act’s objectives. That is how the court in X Corp. v. Bright Data Ltd., 733 F. Supp. 3d 832 (N.D. Cal. 2024), preempted X’s anti-scraping terms after accepting that contract claims generally survive express preemption. The core problem: through boilerplate terms imposed on the world at large, X sought a copyright owner’s right to exclude over content it had disclaimed owning, which would let it “entrench its own private copyright system” by usurping its users’ rights, defeating fair use, and pulling uncopyrightable material out of the public domain. The parallel is uncomfortable for Anthropic, which likewise uses boilerplate terms that assign away whatever rights exist in its outputs while its anti-training terms demand owner-style exclusion. The court was careful, however, to distinguish arm’s-length contracts between sophisticated parties, which it said did not raise the same concern.

17. X Corp. v. Bright Data Ltd., No. C 23-03698 WHA, slip op. at 15–17 (N.D. Cal. May 9, 2024) (“A breach of contract without damage is not actionable.”). The court found X’s allegations to strained server capacity and reputational harm “simply too conclusory to be redressable at all.” The case settled in June 2025 before any appeal.

18. This March the court rejected that argument and sent the case back to state court, holding that each of Reddit’s claims carries an “extra element” beyond copyright’s exclusive rights. See Reddit, Inc. v. Anthropic, PBC, No. 3:25-cv-05643-TLT, slip op. (N.D. Cal. Mar. 30, 2026) (order granting motion to remand). The ruling resolves preemption only for purposes of removal; Anthropic renewed preemption as a defense in a state court filing asking the judge to throw out Reddit’s claims as legally deficient. Reddit’s suit pleads only state-law claims (breach of contract, unjust enrichment, trespass to chattels, tortious interference, and unfair competition); with no copyright count on the face of the complaint, Anthropic had to argue the claims were really copyright claims in disguise.

19. This is a credibility problem, not a legal bar. Judicial estoppel generally requires that the party won on the earlier position. New Hampshire v. Maine, 532 U.S. 742, 750–51 (2001). Nothing formally stops Anthropic from arguing the opposite position as a plaintiff, but its arguments are on the record, and its adversaries in the scraping suits will read them back.

20. Anthropic’s report describes commercial proxy services that “resell access to Claude and other frontier AI models at scale.”

21. Kadrey v. Meta Platforms, Inc., 2023 WL 8039640, at *2 (N.D. Cal. Nov. 20, 2023). Authors sued Meta for training its models on their books. The court found the unjust enrichment claim alleged nothing beyond the unauthorized copying and dismissed it as preempted. The general rule is the Ninth Circuit’s: unjust enrichment does not qualitatively change the rights at issue in the work. Del Madera Props. v. Rhodes & Gardner, Inc., 820 F.2d 973, 977 (9th Cir. 1987).

22. See Reddit, slip op. at 7–8. The court acknowledged that unjust enrichment claims are generally preempted, then found Reddit’s survived because it was predicated on Anthropic “bypassing technical safeguards, violating contractual access restrictions, misrepresenting its compliance,” and exploiting the platform without authorization or compensation. The order distinguished Kadrey and Daniher v. Pixar Animation Studios, 2022 WL 1470480, at *5 (N.D. Cal. May 10, 2022), as claims where the benefit was nothing more than the outputs from copying.

23. See Compulife Software Inc. v. Newman, 959 F.3d 1288, 1310–15 (11th Cir. 2020) (bot-scraping millions of insurance quotes from a publicly queryable database was improper means, and the compilation remained a trade secret even though each quote was individually public), aff’d after remand, 111 F.4th 1147 (11th Cir. 2024). The theory is now being tested against an AI product in OpenEvidence v. Doximity (D. Mass. 2025), where a medical AI company alleges a competitor used fake healthcare-professional credentials to extract its system prompts. The limit: the owner’s own secrecy architecture still matters. Courts examine whether the lab actually treated the material as protected; where terms of use were buried and access was open to anyone, scraping claims have failed. See Cvent, Inc. v. Eventbrite, Inc., 739 F. Supp. 2d 927 (E.D. Va. 2010).

24. Anthropic has admitted the launch classifiers “triggered on a wide range of requests—even ones that were almost certainly benign,” and shipped an update cutting biology-related fallbacks by about 85%. See Anthropic, Improving Fable 5 Safeguards (Aug. 7, 2026). Security researchers had complained within days of launch that the filters were interrupting ordinary defensive work. Thomas Claburn, It Blocked Us At Hello: Anthropic Fable 5 Refusing Innocuous Prompts, The Register (June 10, 2026).

25. Music piracy is a precedent here. The industry won its lawsuits, shutting down Napster and beating Grokster at the Supreme Court, but illicit file-sharing kept growing anyway. See Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913 (2005).

26. Moonshot shipped the Kimi K3 weights on July 27, 2026, days after the White House Office of Science and Technology Policy director publicly accused it of building K3 by distilling Claude Fable 5, which Moonshot disputes. The license, published alongside the weights on Hugging Face, requires any licensee operating a “model as a service” business to strike a separate deal with Moonshot before commercial use once the licensee and its affiliates exceed $20 million in annual revenue over any consecutive 12 months, and requires any product with over 100 million monthly users or over $20 million in monthly revenue to prominently display Kimi K3 attribution. See Kimi K3 License, and Carl Franzen, Kimi K3’s Full Weights Are Here, But They’re ‘Open’ With a Caveat, VentureBeat (July 27, 2026).