Google offers Anthropic models hosted on GCP through their Agent Platform (fka Vertex AI) - presumably any internal Anthropic use never crosses the Google boundary.

> if Anthropic models run in a Google cage, does that not also mean Google can distill Anthropic models even easier (both fast and unseen)?

Anthropic is indeed trusting Google and other companies they rent compute from. Distilling or stealing the weights would be a contract violation, and would wreck other business relationships. I would be less worried about Google doing this, and more concerned if there is some sketchy neocloud in a van offering suspiciously low pricing.

> if Anthropic models run in a Google cage, does that not also mean Google can distill Anthropic models even easier (both fast and unseen)?

Not really in the interest of the cloud org to allow that, they don't really care how well deepmind is doing as long as they can sell TPU and API (incl. reselling openai and anthropic).

AIUI our Claude traffic runs on GCP and so never "leaves the building".

No, GCP has been selling Anthropic models for a while (and soon to be OpenAI models).