Anthropic Report Says Chinese Labs Routed User Chats to Claude Without Users Knowing

A threat intelligence report published by Anthropic on 10 September alleges that two of China’s most prominent AI companies — Moonshot AI, maker of the Kimi models, and DeepSeek — quietly routed some of their own customers’ requests to Anthropic’s Claude, showed the users Claude’s answers as if they came from Chinese models, and saved the exchanges to train their own systems. Moonshot has denied using distillation to build its Kimi K3 model, and both companies dispute Anthropic’s characterisation. The report is Anthropic’s own account of what its investigation found; the accused parties reject it.

The report’s most consequential claim is not about model theft. It is about data. According to Anthropic, the requests relayed to its servers included material the users never chose to share with a US company: CCTV surveillance footage from hundreds of cameras in Chengdu, internal code and live credentials from major Chinese companies, the specifications of a flagship AI programme, and even live credentials for a Russian government database. Anthropic says it does not know whether those users were ever told their data had left China.

What the Report Claims Happened

In the case designated GTG-16002, Anthropic alleges that Moonshot silently forwarded customer requests to Claude instead of processing them with Kimi, then displayed Claude’s responses to users who believed they were talking to a Chinese model. In one ten-day stretch, the report claims, Moonshot relayed almost 300,000 customer requests, most of them routed to Claude Opus — the most capable model in Anthropic’s lineup. The company attributes over 23 million exchanges to Moonshot between May and July 2026, passing through a proxy network of 5,380 fraudulent accounts, most appearing to be located in Singapore and Japan.

The DeepSeek case, GTG-16001, describes a different entry point: DeepSeek allegedly checked incoming requests for strings identifying coding tools such as Claude Code and OpenCode, tagged those users, and relayed their requests to Claude Opus — over 12.1 million exchanges in the first 14 days of July 2026 alone. Both companies are alleged to have run chain-of-thought extraction pipelines: saving Claude’s “thinking signatures” and replaying them in fresh sessions to trick the model into converting them back into full reasoning transcripts, a workaround for Anthropic’s anti-distillation controls.

The report also names Zhipu (Z.ai) as running a 10-day reasoning-extraction campaign through 273 rotating fraudulent accounts, and says it has identified and disrupted distillation attacks from seven labs based in China since February.

The Accused Parties’ Position

Moonshot AI has denied using distillation for its Kimi K3 model, pointing to proprietary advances instead. China’s Ministry of Commerce, responding to a related US government advisory two days before Anthropic’s report, called the allegations “groundless” and argued that distillation is “essentially a neutral technical approach used by model developers around the world, including US companies.” No detailed rebuttal of the report’s specific case studies has been published.

That leaves a structural problem with the evidence: the report is the accusing party’s own investigation, published by the company that says it was harmed. The Wall Street Journal, which obtained the document, reported the allegations as Anthropic’s — attribution “with high confidence” to specific Chinese labs, but not independent verification. The US government’s own advisory (AA26-251A, issued jointly by CISA, the FBI and the NSA on 8 September) repeats the same claims and is drawn from the same industry reporting pipeline. The accused companies say the campaigns do not exist as described; the primary evidence for them has not been independently examined.

What Both Sides Agree On

The agreement underneath the dispute is worth stating plainly. Moonshot has not disputed that some requests were relayed; it has denied that distillation was used to build Kimi K3. Beijing’s objection, as put to the WSJ and in the ministry’s statement, is that distillation is standard practice everywhere — a framing that contests the characterisation, not the technique. OpenAI has complained of the same behaviour since early 2025, and Google published its own tracker for adversarial distillation this year. Nobody in the dispute argues that the technique is unusual; the fight is over who is doing it, covertly, and to whom.

The Uncomfortable Part for Users

For the people whose chats were allegedly relayed, the geopolitics is beside the point. A Kimi user in Beijing had no way of knowing that their requests were leaving the country. An engineer at a Chinese state-owned enterprise exposed internal code and live credentials to a US company they had no relationship with. An IT operator working with Russian defence data leaked live database credentials to the same destination. None of them chose to send anything to Anthropic.

Anthropic’s own framing acknowledges this: it says it does not know whether Moonshot notified its customers that their requests were being rerouted to a third party. The company barred entities majority-owned by Chinese businesses from its services in September 2025 — so the data arrived in its systems through channels it prohibits, carrying content it says included PLA-affiliated surveillance material it could not refuse, because the requests came dressed as ordinary customer traffic from a rival’s product.

The report’s wider count: since February, Anthropic says it has disrupted distillation attacks from seven China-based labs. The US advisory names six companies — DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI — and describes the campaigns as industrial-scale, involving millions of requests and billions of tokens. Beijing has threatened “resolute countermeasures” if the allegations are used to justify new restrictions on Chinese AI firms — even as it requires AI researchers to surrender their passports to slow the talent drain.

❓ FAQ

Is this confirmed? No. The claims come from Anthropic’s threat intelligence report and are repeated in a US government advisory built on industry reporting. The named companies deny them, and no independent body has examined the evidence. Anthropic says it attributes the campaigns “with high confidence” to specific labs.

What is distillation? A legitimate training method: a smaller “student” model learns from a larger “teacher” model’s outputs. Anthropic defines it as “illicit” when done covertly at industrial scale, through fraudulent accounts, without authorisation — which it alleges is what happened here.

What data was exposed? Anthropic’s report describes sessions containing names, email addresses, company data, Chengdu CCTV surveillance footage, internal corporate code, live credentials for Chinese companies and a Russian government database, and police case-management data from a Chinese municipal Public Security Bureau.

Did Anthropic keep the data? The report does not say. It confirms the data reached Anthropic’s systems and notes it does not know whether the affected users were ever informed.

🔍 THE BOTTOM LINE

Two things can be true at once: the report may accurately describe a real industrial-scale operation, and it is still one company’s account of activity only it observed, published two days after its government escalated the same dispute. The testable part is the data — names, credentials, and surveillance footage from users of Chinese apps sitting on Anthropic’s servers. If regulators in Beijing, Moscow or anywhere else ask where that data is and how it got there, Anthropic’s report is simultaneously the accusation and the evidence that the data exists.