Anthropic alleges that Moonshot AI silently forwarded customer requests intended for its Kimi models to Claude, displayed Claude's answers to those users as Kimi's own, and saved the exchanges to train its own models. The allegation appears in the illicit distillation chapter of Detecting and countering misuse of AI: September 2026, published on 10 September 2026.
Anthropic tracks the Moonshot activity as GTG-16002. Over a 10-day period, the report says Moonshot relayed almost 300,000 customer requests to Anthropic, with the vast majority routed to Claude Opus. Moonshot used a proxy network of 5,380 fraudulent accounts, most of which appeared to be located in Singapore and Japan. Anthropic does not serve customers in China, which is why the report gives the account network as the reason it exists at all.
Anthropic attributes more than 23 million Claude exchanges to Moonshot between May and July 2026.
Why This Is Not Ordinary Distillation
Distillation is a legitimate training method, and the report says so directly: a larger "teacher" model generates responses, and those exchanges train a smaller "student" model to mimic it. Anthropic defines illicit distillation as an industrial-scale covert campaign to extract a model's capabilities and replicate them in another model without authorization, typically enabled by networks of fake accounts created with stolen credit cards, login credentials, and API keys.
The allegation against Moonshot and DeepSeek goes a step beyond harvesting outputs. Both are accused of live re-routing: taking a request a customer submitted to a Chinese model and answering it with Claude, without telling the customer. Anthropic states plainly that it does not know whether Moonshot notified its customers that their requests were being rerouted to Anthropic and exposed to a third party.
How Anthropic's Anti-Distillation Control Was Defeated
Claude does not return raw reasoning to API callers. It returns a reference called a thinking signature, which Anthropic's API uses to look up the raw reasoning trace on subsequent calls. That design exists specifically to make distillation harder.
According to the report, Moonshot circumvented it by saving the reasoning signature from a Claude response, opening a fresh session, and eliciting Claude to convert that signature back into the full reasoning trace. Anthropic calls this a cross-session replay attack and says DeepSeek used the same method against Claude Opus' reasoning traces, extracting traces that would otherwise have been summarised. Anthropic says it is introducing new methods to defend against the technique.
The Customer Data Exposed by the Re-Routing
Because the re-routed prompts were real customer work, Anthropic says it saw sensitive material belonging to those customers. The report lists specific examples.
One user, whom Anthropic assessed as likely affiliated with the People's Liberation Army, used what they believed was Kimi to load surveillance data from a CCTV archive covering a single targeted individual and asked the model to determine whether the tracked person was behaving abnormally. The archive drew on hundreds of cameras in Chengdu, including cameras outside PLA facilities, institutes affiliated with the China Electronics Technology Group Corporation, and a major state-owned enterprise.
In a second case, an engineer at a major Chinese state-owned enterprise used Kimi to build an internal system and, in the process, revealed internal code and live credentials from multiple major Chinese technology companies. Anthropic notes the user had no way of knowing the session was being forwarded to Claude.
The DeepSeek examples follow the same pattern. Anthropic says DeepSeek inspected inbound requests for strings identifying third-party coding harnesses, including Claude Code, the Claude Agent SDK, and OpenCode, tagged those users, and relayed selected requests to Claude Opus.
The material exposed that way included the full specifications, organisational structure and strategic objectives of a flagship AI programme at a Chinese technology company; live credentials for a Russian government database, relayed from an IT operator working with an agency associated with Russia's Ministry of Defence; and work by engineers building a case management system for a municipal Public Security Bureau in China, comparing a person's movements against police records by national ID number.
Anthropic attributes more than 12.1 million exchanges to DeepSeek over 14 days in July 2026, and writes that these practices are "likely inconsistent with privacy laws and the labs' own terms of service".
The Seven Labs Named and the Volume Attributed to Each
| Lab | Method described in the report | Exchanges attributed | Window |
|---|---|---|---|
| Alibaba (Qwen / Tongyi Lab) | Fixed prompt injected into every request, forcing Claude to write reasoning inline; transcripts used for supervised fine-tuning of Qwen 3.5, 3.6, and 3.7 | Over 151 million | May–July 2026 |
| Moonshot AI (Kimi) | Live re-routing of Kimi customer requests to Claude, plus cross-session replay to extract reasoning | Over 23 million | May–July 2026 |
| DeepSeek | Live re-routing of users on third-party coding harnesses, plus cross-session replay | Over 12.1 million | 14 days, July 2026 |
| Zhipu (Z.ai) | Captured reasoning traces replayed back through Claude to clean them for GLM training, via 273 fraudulent accounts | Over 3.4 million | 17 days, June–July 2026 |
| Xiaomi | MiMo user sessions replayed through Claude to generate training data; Claude responses not served to users | Over 400,000 | 20 days, March–April 2026 |
| SenseTime | Claude transcripts were purchased from third-party data vendors that logged and sold user exchanges | No figure given | — |
| MiniMax | Proxy network operated through an undisclosed shell company, selling access only to Anthropic and OpenAI models | No figure given | — |
Anthropic describes Alibaba's campaign as the largest distillation attack it has ever measured, peaking at nearly 3 million exchanges in a single day and targeting agentic tasks, software engineering, kernel development, and long-horizon tasks.
It ran through two pools of fraudulent accounts: when Anthropic banned the first pool of nearly 5,000 accounts that used residential proxies, disposable emails, and virtual-card payments, traffic shifted to the second pool. Some accounts in those pools were also funneling requests from DeepSeek and Xiaomi, which Anthropic says shows the same proxy networks serve multiple organizations.
Beyond distillation, the report says Alibaba used Claude to help develop its internal model-development infrastructure, reinforcement learning environments, and model-architecture research.
The Zhipu Finding Worth Reading Twice
Anthropic reports that Zhipu first targeted Claude Fable's cyber capabilities, then abandoned the attempt after Anthropic's strengthened cyber safeguards degraded the attacks. Zhipu employees switched to Claude Opus 4.6 and the leading model of another US lab, which the report says they assessed as having weaker safeguards. Anthropic also says it has observed no distillation attempts against Mythos 5 or Mythos Preview, which are not available to the general public.
Anthropic adds a research finding that explains why it treats distillation as a safety issue rather than a commercial one: in its own testing, a model distilled from a frontier model can reach dangerous capabilities in the biological and cyber domains even when the harvested exchanges contain little about those subjects, because the safeguards that constrain Claude do not transfer to the distilled model.
What Anthropic Changed in Response
- Claude now summarises its internal reasoning before responding, which Anthropic says makes stolen transcripts less useful as training data.
- Fable 5.1 introduced preserved thinking, which prevents new API accounts from altering the system prompt, tools, or preceding messages in multi-turn conversations — the context editing that Anthropic says attackers use to make Claude reveal its reasoning.
- Anthropic now attributes proxy activity to an organization and enforces against that organization, rather than banning accounts one at a time.
- Accounts showing abuse signals, including unauthorized resale of Claude or operation from unsupported countries such as China, Russia, and Iran, can be required to verify identity and are banned if they fail.
What the Named Companies Have Said
None of the seven named labs had publicly accepted the allegations at the time of writing. Reporting by CNBC, Business Insider, and the South China Morning Post recorded no immediate response from Alibaba, Moonshot, DeepSeek, Zhipu, or Xiaomi. China's Commerce Ministry issued a separate US government advisory on 9 September 2026, calling the accusations of distillation groundless, describing distillation as a common industry practice, and warning of countermeasures if Chinese AI companies are suppressed. Every figure in this article is Anthropic's own attribution, drawn from its own logs.
Anthropic first published allegations of distillation against DeepSeek, Moonshot, and MiniMax in February 2026, citing more than 16 million exchanges across roughly 24,000 fraudulent accounts. The September report covers seven labs and a substantially larger volume.
What This Means If You Use These Models
The exposure described in the report is not about model quality. It is possible that a prompt submitted to one provider may have been processed and stored by another. Anthropic says the re-routed sessions it observed contained names, email addresses, company data, and other sensitive material from hundreds of end users in at least a dozen languages, much of it relayed from third-party model routing services commonly used in the United States and Europe.
Three things follow for anyone sending production work through a third-party model router or a discounted model reseller. Treat prompt content as potentially disclosed to an unknown third party. Rotate any credential, token, or API key that has ever been pasted into a session with a reseller-fronted model.
And check whether your provider discloses which model actually serves your request. Anthropic's guidance in the same report is to buy AI access only through authorized channels, and it notes that an alleged discount that requires traffic to be routed through an unknown intermediary carries substantial risk to user data and systems.