Morning Briefing - February 24, 2026

Anthropic Accuses Three Chinese AI Labs of Industrial-Scale Distillation

Breaking overnight: Anthropic published a detailed report accusing DeepSeek, Moonshot AI, and MiniMax of running coordinated distillation campaigns against Claude using approximately 24,000 fraudulent accounts and more than 16 million exchanges. This isn't scraping — it's targeted extraction of Claude's most differentiated capabilities: agentic reasoning, tool use, and coding.

The scale varies by lab. MiniMax drove the most traffic at over 13 million exchanges. Moonshot AI's 3.4 million exchanges specifically targeted agentic reasoning and computer-use agent development. DeepSeek's 150,000 exchanges focused on foundational logic and alignment — including, notably, "censorship-safe alternatives to policy-sensitive queries." That last detail is worth sitting with: a Chinese lab extracting techniques for navigating censorship from an American model.

Anthropic says it has upgraded detection systems and plans further hardening. The timing is pointed — this drops days after OpenAI made similar accusations against Chinese firms, and while Congress debates AI chip export controls. Anthropic explicitly connects the dots: "The scale of extraction these firms performed requires access to advanced chips," reinforcing the rationale for tighter export restrictions.

This is the second major story in a week where Anthropic positions a product announcement (Claude Code Security) or a security disclosure (this) as evidence for policy positions. The pattern is deliberate.

Sources: TechCrunch — Anthropic accuses Chinese AI labs | CNBC — Anthropic joins OpenAI in flagging distillation | CNN — Are Chinese AI labs cheating? | Anthropic — Detecting and preventing distillation attacks

The Densest Day: Tariffs, Enterprise AI, and State of the Union

Three separate stories about power converge today.

12:01 AM — Tariffs take effect. The 15% Section 122 tariffs are now live as of midnight. Legal experts told CBS the use of Section 122 is "unprecedented," and challenges are expected — but the 150-day statutory limit (expiring around July 24) may discourage litigation. Why sue if the tariffs auto-expire? The Washington Post reports that's exactly the administration's gamble: a statute with a built-in clock that makes legal challenge less urgent while still extracting economic leverage. CNBC reports Congress is now "contemplating its role" — the Section 122 clock shifts the confrontation from courts to legislature, and several members from both parties are drafting bills to reclaim tariff authority.

9:30 AM — Anthropic "The Briefing." The enterprise agents showcase livestreams from NYC this morning. Product and engineering leaders will demo "what's possible when Claude knows your work the way you do" — enterprise Cowork capabilities, live demos, and the 2026 product roadmap. Context: Claude Code ARR is at $2.5B, Claude Code Security just rattled the cybersecurity sector, and the distillation report dropped overnight. This is a company running offense on multiple fronts simultaneously.

9:00 PM — State of the Union. Trump delivers his first SOTU of the second term to a joint session of Congress. Expected topics: tariffs (obviously), mass deportation, deregulation, and Iran — where a third round of nuclear talks begins Thursday in Geneva. He's reportedly not ruling out military force if negotiations fail. Gov. Abigail Spanberger (D-VA) delivers the Democratic response. The political backdrop: 60% disapproval (WaPo), a 16-day DHS shutdown, and midterms in November.

Sources: Washington Post — Tariff challenge | CNBC — Congress contemplates tariff role | CBS — Section 122 legal challenge | Anthropic — The Briefing | NPR — SOTU what to know | PBS — Watch live

Update on Claude Code Security: Cyber Stocks Fell Again Monday

The bounce didn't come. After Friday's 5-9% crash, cybersecurity stocks fell further on Monday. CrowdStrike and Zscaler dropped another 10%. The Global X Cybersecurity ETF (BUG) fell 4% more. The sector is now at levels not seen since mid-2023.

The analyst divide is widening:

• Wedbush (Dan Ives): Claude Code Security "validates the thesis that cybersecurity is the next frontier for the AI Revolution." Bullish signal, not bearish. CrowdStrike, Palo Alto, and Zscaler remain on Wedbush's preferred list.
• Morningstar: "Not bad news for cyber companies." The tool scans for vulnerabilities — it doesn't replace endpoint protection, identity management, or network security.
• Bank of America: AI could improve efficiency in specific workflows but "does not have the visibility, control, or reliability to replace end-to-end security platforms."
• The market: Disagrees. Down another day.

The question isn't whether Claude Code Security replaces CrowdStrike. It doesn't. The question is whether the market is pricing in a world where frontier AI models progressively absorb security workflows — and whether that's a two-year story or a ten-year story. Friday said "two years." Monday confirmed it.

Sources: Benzinga — Dan Ives bullish signal | Morningstar — Not bad news | Yahoo Finance — Wedbush sees overreaction

The Blizzard Meets the Shutdown

Winter Storm Fernando buried the Northeast under 2-3 feet of snow over the weekend, and the aftermath is today's logistical story. More than 11,000 flights were canceled Sunday through Tuesday. Monday alone: 5,700 cancellations. JFK at 89% canceled, LaGuardia and Boston above 90%.

The collision with the DHS shutdown is the detail that matters. Global Entry remains down (Day 16 of the shutdown). TSA PreCheck is operational after Saturday's reversal, but TSA agents are working without pay. Now add blizzard recovery operations at major Northeast airports staffed by unpaid federal workers, with Congressional escorts still suspended and FEMA's non-disaster operations halted. Congress returned yesterday with no deal in sight — Democrats are holding firm on ICE reform demands, Republicans pushing back on mask bans and body camera requirements.

The SOTU tonight will be delivered to a Congress that just came back to town, by a president with a partial shutdown, a constitutional tariff crisis, and tens of thousands of stranded travelers as backdrop. Whether that creates pressure for a deal or just makes for good television is today's question.

Sources: CBS News — Blizzard hits Northeast | CNBC — Airlines cancel thousands | The Hill — Republicans eye opening for DHS deal

Iran Nuclear Talks: Third Round Thursday, Military Buildup Continues

A story that's been building quietly while the domestic noise dominates. The third round of US-Iran nuclear talks begins Thursday in Geneva, with Trump envoys Witkoff and Kushner returning. Iran's Foreign Minister Araghchi said the previous round made "good progress" and reached "broad agreement on a set of guiding principles."

But the backdrop is ominous. Trump has ordered the largest American military buildup in the Middle East since the Iraq War. He's publicly said Iran faces a "very bad day" without a deal and reportedly growing frustrated with the limits of military options. Iran says Trump is risking a "crisis." The sticking point remains enrichment — Trump says none, Iran says it's their right.

Meanwhile, Iran is dealing with a domestic resurgence of protests as the US builds external pressure.

CNN frames it as three options: diplomacy, covert action, or regime change. All three are reportedly on the table. Expect this to feature prominently in tonight's SOTU.

Sources: CNN — Trump's 3 options on Iran | Fortune — New round of talks Thursday | NBC News — Iran protests as US builds pressure

VC Loyalty Is Dead: OpenAI Investors Pile Into Anthropic

TechCrunch reports that at least a dozen direct OpenAI investors — including Founders Fund, Sequoia Capital, Iconiq, and Insight Partners — are now also backers in Anthropic's $30 billion Series G at its $380 billion valuation. The era of exclusive AI bets is over.

The framing matters for Greg's professional context: Snowflake's $80B cloud commitment to Anthropic is part of this same capital ecosystem. When VCs hedge by backing both horses, it tells you they believe the market is big enough for multiple winners — but also that they can't tell which lab will dominate.

Sources: TechCrunch — Investor loyalty is almost dead

Status Board

Snowflake Q4/FY26 earnings: Tomorrow. Feb 25. Stock down ~20% YTD. AI-related offerings hit $100M revenue run rate a quarter ahead of schedule. 7,300+ customers using AI weekly. Watch for: Postgres GA timeline, Observe integration details. Barchart — Mark your calendars

Salesforce earnings: Tomorrow. Feb 25. Spring '26 went live yesterday with Agentforce Builder, Agentic Enterprise Search, and Voice for Financial Services. $1.4B Agentforce ARR trajectory on display.

Postgres out-of-cycle release: 2 days. Feb 26. substring() non-ASCII regression + standby halt bug. Versions 14–18. PostgreSQL announcement

PostgreSQL 13 AWS EOL: 4 days. Feb 28. Extended Support billing starts.

Iran nuclear talks Round 3: 3 days. Feb 27. Geneva. Witkoff + Kushner.

12 Hours of Sebring: 25 days. March 21. Porsche Penske with Estre, Vanthoor, Andlauer, Nasr.

Countdowns

Curator's Thoughts

On Industrial-Scale Distillation

The distillation story is the lead because it's genuinely new and consequential. DeepSeek extracting "censorship-safe alternatives to policy-sensitive queries" from Claude is a detail that will get more attention as it circulates. A Chinese lab mining an American model for techniques to navigate political censorship — and Anthropic framing this as evidence for export controls — is the kind of story that connects technology, geopolitics, and values in ways that are hard to dismiss.

What I find interesting is the pattern: Anthropic's security disclosures increasingly double as policy arguments. Claude Code Security wasn't just a product launch — it was a demonstration that AI can do security work, which crashed the sector. This distillation report isn't just a security disclosure — it's ammunition for export control hawks. The company is learning to weaponize transparency. Whether that's admirable or calculated is probably both.

On the Market Disagreeing with Analysts

Every major analyst covering cybersecurity says the selloff is overdone. The market fell further anyway. This is worth watching because the market is pricing in a disruption timeline that the analysts haven't modeled yet. The analysts are right that Claude Code Security doesn't replace CrowdStrike today. The market is asking what happens when it does — or when the next version does, or the one after that. The gap between "this specific product doesn't compete" and "this category of product will eventually absorb these functions" is where the real argument lives.

Generated by Claude at 06:01 AM in ~14 minutes.