The Counterfeit Mind
A £15 fake shirt and a copied frontier AI. One is a knock-off. The other is the theft of a mind.
THE SUNDAY SIGNAL · Issue #61 · Week 27 · Sunday 5 July 2026
This issue is also available as a podcast. Listen on Spotify, Apple Podcasts or YouTube and tell me what you think.
Bottom Line Upfront
The most valuable thing America has ever built is being copied wholesale, and the law cannot stop it. Anthropic has told the United States Senate that operators tied to Alibaba ran the largest AI extraction it has ever caught, treating Claude as a teacher and cloning how it thinks. The same company, in the same fortnight, watched Washington restore its best models on terms Washington set, after switching them off with no warning. Underneath both stories sits a colder number. The price the market will pay for frontier AI is falling, and the entire trillion-dollar build-out is betting that it holds. And in Friday’s Yorkshire Post I wrote about a man with a red flag, and what Victorian England can teach a regulator now reaching for a kill switch. Four signals. One question. What is a mind actually worth, and who gets to hold it?
America Built the Mind. China Is Copying It in Plain Sight.
Times Square, last week, during the World Cup. I could have walked out with any country’s shirt in my size. England, Brazil, Argentina, Morocco, all hanging on the same rail, all for the price of lunch. An official replica from the club shop runs £55 to £80. The player-issue shirt the professionals actually wear costs more again. The version on that rail was £15, maybe £20, and from three feet away you could not tell the difference.
So which is it. A cheap imitation, or the same shirt with the label swapped?
The honest answer is uncomfortable. A counterfeit and a licensed replica often pour out of the same manufacturing clusters in southern China, sometimes off the same lines on an unofficial shift, using the same fabric rolls the brand ordered. The stitching is worse. The badge is a shade off. The materials are cheaper. But the gap between the £15 fake and the £75 real thing is not the gap you would expect from the price. Roughly one in seven young people in Europe buys counterfeit sportswear, and most of them know exactly what they are buying. The brand is not selling cotton. It is selling the badge, the story and the right to wear it. The counterfeiter steals all three and pays for none of it.
Shirts are one thing. Late last month it emerged that Anthropic has accused China of doing the identical thing to Claude.
Anthropic Has Blown the Whistle Twice This Year
On 10 June, Anthropic sent a letter to the United States Senate Banking Committee, addressed to chairman Tim Scott and ranking member Elizabeth Warren. It landed alongside a committee hearing on American AI. The letter, first reported by Bloomberg on 24 June, alleged that operators affiliated with Alibaba and its Qwen AI lab had run what Anthropic called the largest known distillation attack on Claude to date.
The scale is the story. Between 22 April and 5 June, the letter says, roughly 25,000 fraudulent accounts generated more than 28.8 million exchanges with Claude, aimed squarely at its most valuable capabilities: software engineering, agentic reasoning and long-horizon planning. That is the same class of capability that sits inside Mythos, the frontier model Washington forced offline weeks later. Anthropic’s head of policy, Sarah Heck, told senators the operation was designed to “harvest US AI capabilities” and repackage them as China’s own.
This was not the first alarm. In February, Anthropic named three Chinese labs, DeepSeek, Moonshot AI and MiniMax, running the same playbook to a combined total of around 16.5 million exchanges across roughly 24,000 accounts. Alibaba, on its own, in six weeks, beat that combined figure by nearly two to one. It is also the first time Anthropic has named a global conglomerate rather than a start-up.
One caveat matters, and I will not bury it. These are Anthropic’s allegations, not proven facts. Alibaba denies wrongdoing and says it does not train on other companies’ model outputs. The figures have not been independently verified. But the technique Anthropic describes is real, it is documented, and it is almost impossible to stop.
This Is Not a Hack. It Is an Interview.
Forget the Hollywood image of hooded figures cracking a server. Nobody broke in. Nobody stole the source code or the model weights. The attackers simply talked to Claude, millions of times, and wrote down what it said.
Here is the anatomy, because it explains why the law is helpless.
First, the disguise. Frontier models geoblock traffic from China to comply with US export controls. So the operators route through commercial proxy networks and VPNs, rotating IP addresses until the requests appear to come from London, Tokyo or California. Tens of thousands of accounts spread the load. No single account queries fast enough to trip an alarm. Spread 28.8 million exchanges across 25,000 accounts over six weeks and each one looks like an ordinary developer having an ordinary week.
Then, the interview. The attackers do not ask Claude for trivia. They hammer it with the hardest problems they can find, and they force it to show its working. A representative prompt reads like a job interview for a principal engineer: adopt an expert persona, solve a genuinely difficult problem, then, before giving the answer, lay out every architectural choice, evaluate the alternatives you rejected, and explain why. Wrap the reasoning in tags so it can be parsed cleanly. Only then, produce the code.
That instruction to “show your work” is the whole heist. A single query costs pennies in API credits. The output is a pristine, step-by-step map of how a frontier model actually thinks through a hard problem. It is worth a fortune. Multiply it by 28.8 million and you have not bought an answer. You have bought an education.
The Apprentice Who Never Read the Recipe
What happens to those millions of transcripts is called model distillation, and the cleanest way to picture it is a master chef and an apprentice.
The apprentice never sees the recipe book. The weights stay locked. Instead the apprentice stands at the master’s shoulder for millions of meals, watching every knife stroke, every correction, every decision, until they can reproduce the dish without ever knowing the theory behind it.
In practice the lab scrubs the transcripts first, stripping out every “I’m Claude, made by Anthropic” and every safety refusal, until it has millions of clean instruction-and-response pairs. It takes a weaker student model, often built on an open-weights base, and fine-tunes it on that data. The student is mathematically pushed, word by word, to reproduce the teacher’s output. Because the attackers specifically captured the reasoning, not just the answers, the student learns the process: to pause, weigh options and structure its thinking before it speaks. A polishing pass tidies the result.
At the end, the lab has a model perhaps a tenth of the size, costing a fraction to run, that mimics the teacher on exactly the tasks that matter most. Training the original teacher costs hundreds of millions of dollars, months of compute and years of human trial and error. Training the copy costs a few million and a few weeks. This is why export controls barely bite. You do not need to smuggle the model out of the country if you can telephone it and take notes.
So, back to the shirt. Is the copy the same as the real thing, or is it something far worse? A fake shirt is cotton and a stolen badge. It costs the maker a sale. What Anthropic describes is different in kind. The counterfeiter here did not copy the product. It copied the mind that makes the product, for the price of talking to it. That is not a knock-off. That is the whole factory, walking out through the front door, one polite conversation at a time.
Washington Switched the Models Back On. On Its Own Terms.
Two weeks ago in this newsletter I made a simple argument. On 12 June the US Commerce Department, using export-control powers, forced Anthropic to switch off its two most capable models, Fable 5 and Mythos 5, for every customer on Earth in a matter of hours. No missile. A letter. My concern was not the safety review. It was the precedent. Washington had quietly reclassified frontier AI as a munition, something closer to enriched uranium than to enterprise software. And any business, or any country, running on a single provider had just watched a machine it depended on get switched off by a government it does not vote for. Britain, I wrote, is running on borrowed machines.
This week the machines came back on. It is worth watching how.
Commerce lifted the export controls on 30 June. Fable 5 returned worldwide on 1 July, across Claude’s apps, platform and coding tools, after a 19-day global blackout. The trigger for the whole episode, it turns out, was a jailbreak: Amazon researchers found a way to make Fable 5 flag software flaws and, in one case, write code showing how one could be abused. Anthropic downplayed it as a handful of minor, already-known vulnerabilities, retrained its safety classifier, and says the technique is now blocked more than 99% of the time.
Mythos 5, the more powerful sibling with fewer guardrails, is not back for everyone. Access returned on 26 June to roughly 100 vetted US organisations that defend critical infrastructure, under Anthropic’s Project Glasswing. Washington still decides who is trusted. The negotiations were reportedly led not by chief executive Dario Amodei, who has clashed with the administration all year, but by co-founder Tom Brown. As part of the deal Anthropic agreed to hunt its own models for security holes, coordinate future launches with the government and report malicious use it detects.
Read that carefully, because it is the real news. The crisis is over. The precedent is now permanent. A frontier model was switched off by fiat and switched back on by negotiation, and along the way the US government established that it gets an early look at the most capable models before the public does. OpenAI previewed its latest system to a small, government-approved group days earlier, citing the same dual-use worry. The question one analyst put to Al Jazeera still stands: does Washington now approve every frontier model release? On the evidence of the last three weeks, the answer is drifting towards yes.
For anyone outside the American tent, the lesson from a fortnight ago has only hardened. The models you rent can be revoked. The kill switch exists, it has been tested in public, and it belongs to someone else.
The $700 Billion Question Nobody Wants to Ask
Here is the number that should be keeping data-centre investors awake. It is not on any earnings call. It is a price, and it is falling.
The Silicon Data LLM Token Expenditure Index tracks what the market actually pays for AI, per million tokens. Between its December launch and May it nearly doubled. Since then it has fallen almost 20%. It is the cleanest read anyone has on whether customers will keep paying premium prices for frontier intelligence, and right now it is flashing amber. As one veteran investor put it this week, users priced by the token are being forced to rein in unlimited use because the bills have grown too large.
Set that against the spending. Amazon, Microsoft, Alphabet and Meta have guided roughly $700 billion of capital expenditure this year, nearly double last year, most of it aimed at AI data centres and custom silicon. The march towards a trillion dollars in 2027 is already under way. That build-out is justified almost entirely by the belief that token spending keeps climbing. If the price the market pays softens while the concrete keeps pouring, the sums stop working.
The historical rhyme is unkind. Allianz Research puts the gap between AI investment and AI sales at nearly 46%. During the 2001 telecom bust, when companies laid fibre-optic cable for demand that arrived a decade late, the equivalent divergence was 32%. We are already past it. The one comfort for the bulls is that today’s hyperscalers have fortress balance sheets the fibre pioneers never had. The discomfort is that their share prices are priced for perfection, and perfection is a fragile thing to sell.
There is a subtler reading, and it is the one I hold. A softening index does not mean AI is failing. It means AI is commoditising. When a Chinese lab can distil a frontier model for a few million dollars, as the first story in this issue describes, the pricing power that justified today’s valuations starts to leak away. Enterprises are quietly trading the most expensive frontier models for cheaper ones that do the same job. The era of unmetered developer spending, of treating tokens as free, is giving way to the corporate bean-counter with a budget and a red pen.
The technology is not dead. The unconstrained pricing power that funded the boom might be. Somebody has to pay for all these data centres. This is the week the market started asking who.
The Man With the Red Flag
This week’s Yorkshire Post column.
In 1865, before the motor car had properly arrived, Parliament decided the self-propelled road vehicle could not be trusted on its own. The Locomotives Act required a crew of three: a driver, a stoker, and a man on foot walking 60 yards ahead with a red flag by day and a lantern by night, warning the public that a machine was coming. The vehicle behind him could move at two miles an hour in town.
It was not wholly irrational. Horses bolted, roads were bad, steam engines were loud. But the effect was absurd. While Benz, Daimler and the American pioneers got on with making the car work, Britain made the new machine walk behind a pedestrian. The flag went in 1878. The escort survived until 1896. For 30 years, a country proud of its engineering slowed the future to walking pace.
I thought of that man this week reading Sarah Breeden at Sintra. Breeden, the Bank of England’s deputy governor, was warning about autonomous AI agents in finance: systems that do not just produce analysis but act on it. In markets, she cautioned, they could amplify stress, not because one model goes berserk, but because many models do the same sensible-looking thing at the same moment. Same data, same signal, same exit. The Bank is examining guardrails: circuit breakers and kill switches that could halt trading if the machines misfire. More than half of finance firms already run these agents.
That is a serious question, and she is right to ask it. A kill switch on a runaway market is not a red flag on a road. The trouble starts when regulators forget which one they are holding.
There is an old official habit of making the unfamiliar move slowly until important people feel calmer. It looks like prudence. Often it is only a lack of understanding dressed up as caution. When margarine threatened butter, some American states forced it to be dyed pink. In 1994, Westminster wrote “repetitive beats” into criminal law to frighten off rave culture, and Autechre answered with a track arranged so no bar repeated. In 2019, OpenAI declared its own GPT-2 too dangerous to release. It had 1.5 billion parameters. The models that now help with homework and medical results are a thousand times larger. The feared monster became a useful tool.
So yes, regulate AI in finance. Test the models, demand audit trails, establish liability, make firms prove an agent can be stopped and overruled. But do not confuse slowing a technology with understanding it. Britain still marks the end of the red flag: at the first Emancipation Run in 1896, a motorist tore one in half and drove for Brighton, as the cars have done every November since. A serious country must know the difference between a brake and a flag. The brake stops a crash. The flag stops the journey.
The Tech & AI Layoff Tracker
Week 27 · 28 June to 4 July 2026
The first half of 2026 has closed, and the mid-year autopsy is brutal. According to a report published this week by Challenger, Gray & Christmas, US technology employers announced 139,156 job cuts in the first six months of the year, up 83% on the same period in 2025. Tech now accounts for nearly a third of every layoff announced in the country. For the fourth consecutive month, a streak with no precedent in the firm’s data, artificial intelligence was the single most cited reason for job cuts. AI has been named in 101,743 layoffs so far this year, roughly 23% of the total.
The narrative has shifted. Last year companies hid behind AI buzzwords to dress up ordinary cost-cutting. This year the cuts are real, and so is the mechanism. As Andy Challenger put it, the sector is “being reshaped in real time.” Wildly profitable firms are liquidating human headcount to fund silicon.
British American Tobacco, ~9,000 roles (about a fifth of staff). The single largest cut of the week, and it is not a tech company. BAT will eliminate 5,500 jobs outright and outsource a further 3,500, many to Accenture, to save £600 million a year by 2028. Chief executive Tadeu Marroco said the overhaul makes the company “more agile, cost-disciplined and technology-enabled.” Management pointed directly at AI and data analytics reshaping its staffing needs. When a cigarette maker starts citing agentic AI in its restructuring, the displacement has left the tech sector and entered the wider economy.
Microsoft, fewer than 5,500 roles (under 2.5% of staff). Expected to be confirmed in the coming week, timed to the close of Microsoft’s fiscal year on 30 June. The cuts target enterprise sales, consulting and the Xbox division, now under a “reset” led by new gaming chief Asha Sharma. The context is the arms race: Microsoft has committed around $190 billion to AI since 2025 and its capital spending hit $80 billion in the first nine months of this fiscal year alone. The market is forcing the company to choose compute over headcount, and it is choosing compute.
Elementor, ~100 roles (30% of staff). The website builder that powers roughly 13% of all websites is cutting nearly a third of its workforce. Chief executive Yoni Luksenberg blamed the speed of AI disruption directly. With agentic systems now spinning up and deploying entire websites on command, demand for human-operated layout software is collapsing. Elementor is the canary for mid-market software built on the idea that a human sits at the wheel.
What to watch in early Q3. Enterprise sales and customer success teams, as automated product-led growth and AI onboarding agents make large, expensive human sales floors an obvious target. And legacy design and middleware software, where any product whose core function is a dashboard for humans to drag and drop is facing an existential choice: build native AI generation, or become irrelevant.
Final Thought
Every story this week is the same story wearing a different coat. What is a mind worth, and who owns it?
The Chinese labs answered by stealing one for the price of a phone bill. Washington answered by declaring it a weapon and keeping the key. The market answered by quietly marking the price down. And the man with the red flag answered, more than a century ago, that a nervous state will always reach for something old when it meets something new.
Here is the part nobody in the boardroom wants to hear. There is growing evidence that a great deal of the “AI” in these layoffs is a story told to shareholders. A National Bureau of Economic Research working paper found that 90% of executives say AI has had no measurable effect on employment at their own companies. A study of firms cutting the hardest found no improvement in their financial returns. The badge, in other words, is doing a lot of work the cotton cannot.
So we are copying minds we cannot fully value, switching off machines we cannot fully control, and firing people to pay for a promise we have not yet proven. The fake shirt at least keeps you warm. I am not sure the same can be said for a strategy built on a badge.
🚀
Until next Sunday,
David