When Data Becomes a Battlefield: Anthropic, Distillation, and the DataClaw Counterattack
*A story about walls, gardens, and a crowbar*
Have you ever wondered where your AI conversations go? They flow like rivers into company servers—stored, analyzed, and possibly used to train the next model version. You created this data, but it no longer belongs to you.
That has been the default rule of the AI era: users produce data, companies own data. Until someone decided to change it.
The Walled Garden: Anthropic and the Distillation Controversy
Anthropic, an AI safety-focused company founded by ex-OpenAI researchers, recently published a strongly worded article, *Detecting and Preventing Distillation Attacks*, claiming that three Chinese AI companies—DeepSeek, Moonshot, and MiniMax—made over 16 million distillation calls against Claude.
Distillation means training a smaller model (student) on the outputs of a larger model (teacher)—a common practice so widespread that modern AI arguably could not exist without it. Anthropic's article framed it as an "attack" to be "prevented."
But netizens quickly dug up Anthropic's own history:
- Claude was trained on massive amounts of internet data
- Anthropic itself has been accused of distilling OpenAI models
- It was previously accused of training on books downloaded from piracy sites
- The early internet was decentralized: data belonged to the network, not a company.
- Web 2.0 shifted data from "public property" to "platform assets"—Facebook owned your social graph, Google your search history, Twitter/X your posts.
- The AI era sharpens this: you now produce training data, used to build models that serve (or replace) you, with value flowing one way.
- Anthropic. (2026). *Detecting and Preventing Distillation Attacks*. https://www.anthropic.com
- POM. *DataClaw*. https://github.com/peteromallet/dataclaw
- Hugging Face. https://huggingface.co
Elon Musk publicly criticized the double standard: *"Anthropic itself stole training data before, paying a settlement in the billions."* The classic double standard: when I use your data, it's "learning"; when you use mine, it's an "attack."
Who Owns the Fruits of the Garden?
The deeper question: who owns the data an AI model produces? When you ask Claude a question, does the conversation belong to Anthropic (the provider), to you (the creator of the dialogue), or to no one?
Here lies a paradox: if Claude's answers derive from knowledge learned from public internet data—including many people's creations—on what basis does Anthropic claim exclusive rights over its outputs? It's like someone reading library books, writing a new article, then forbidding anyone from citing it.
Knowledge flows one way: from the public to companies, and no longer back.
The Crowbar: DataClaw
Shortly after Anthropic's article, an open-source developer, POM (Peter O'Malley), published his own 155,000 real local Claude Code conversation records and released DataClaw—a name pointedly playing on Anthropic's claw logo: a tool for clawing data back out of the walled garden.
DataClaw exports your conversation logs from AI coding tools (Claude Code, Codex, Gemini CLI) into standard-format datasets that can be uploaded and shared publicly on Hugging Face. Elon Musk reposted it with a single word: "Cool."
The Art of Privacy
DataClaw doesn't naively upload raw data. It includes layered privacy protection:
| Original data | Redacted output |
|---|---|
| /Users/alice/project/secret.py | ./project/secret.py (relative path only) |
| alice@company.com | user_7a3f9e2 (anonymized) |
| sk-abc123xyz789 (API key) | [REDACTED] (auto-detected and removed) |
| Database passwords, tokens | Multi-pass scanning, automatic removal |
Every step requires your confirmation: select source → confirm project scope → local preview → privacy scan → push after approval.
Why This Matters
1. Data sovereignty made concrete. Data sovereignty is no longer an abstraction—just run pip install dataclaw. Whether you publish or keep your data, the decision returns to you.
2. Undervalued data. Anthropic's strong reaction reveals how valuable these conversations are. Most training data today is synthetic or static code from public repositories. Real-world debugging reasoning, requirement decomposition, and iterative refinement are almost absent from datasets. Developer–AI pair-programming dialogues are golden data: real problem-solving processes, human thinking patterns, learning from mistakes.
3. Legal gray zones. The controversy surfaces unanswered questions: Are AI-generated outputs bound by the original model's terms of service? Can companies reverse-train on user behavior data? Can users export their conversations? The law here is nearly blank.
Honest Limitations
The author is candid. From the README:
> "This is NOT foolproof."
Automated redaction can miss things; sensitive information may hide in unexpected places. You should still review everything before publishing. Whether individual contributions will be meaningfully used—or remain scattered fragments on Hugging Face—remains unknown. This is a starting point, not a solution.
The Bigger Picture
DataClaw represents a form of resistance—not confrontation, but calm, firm action. You build walls? I plant gardens. It embodies the open-source ethos: knowledge should flow freely.
Conclusion: Garden or Wall?
Anthropic built a wall to protect its data from distillation. POM used DataClaw to pry open a door and let data flow again. This isn't a simple question of right and wrong—Anthropic must protect massive training investments; POM believes knowledge should be free and data sovereignty belongs to users.
The real question: what future do we want? A world of walled gardens, or one where data and knowledge flow freely?
DataClaw can't answer that, but it offers a choice: rather than waiting for others to decide where your data goes, decide yourself. Even if you never publish, regularly exporting your conversation logs is an accumulation—a record of your genuine thinking process, your own digital asset. In the AI era, that may be one of the most important things you can do.