Anthropic Accuses Moonshot's Kimi of Routing Users to Claude—and Exposing Surveillance Data

On September 10, 2026, Anthropic published Detecting and countering misuse of AI, a threat-intelligence report covering activity disrupted between December 2025 and August 2026. Buried in the illicit-distillation chapter is a sharper claim than the familiar accusation that Chinese labs farm frontier-model outputs for training: Anthropic says Moonshot AI—the Beijing company behind Kimi—silently forwarded some customer requests intended for Kimi to Claude, showed Claude's answers as if they came from Kimi, and saved at least some of those exchanges to train its own models. Follow-on coverage also highlighted a second twist: because those prompts landed at Anthropic, investigators reportedly saw Chinese surveillance material that a Kimi user believed would stay inside Moonshot's stack. Moonshot declined to comment in press accounts; Beijing has separately rejected U.S. distillation accusations as lacking factual or legal basis.

What Anthropic Alleges About Kimi

In case study GTG-16002, Anthropic states that Moonshot forwarded customer traffic to Claude instead of processing it with Kimi, then displayed Claude responses to users who thought they were talking to a Moonshot model. In one roughly ten-day window, Anthropic says Moonshot relayed almost 300,000 customer requests—the vast majority to Claude Opus—through a proxy network of 5,380 accounts Anthropic describes as fraudulent. Most of those accounts, Anthropic says, appeared to operate from Singapore and Japan, consistent with Anthropic's restrictions on China-based use.

Anthropic further alleges Moonshot retained portions of the relayed exchanges and built a pipeline to extract Claude chain-of-thought (CoT) transcripts for training. Across May–July 2026, Anthropic attributes more than 23 million exchanges to Moonshot in this family of activity. The company also describes a related pattern for DeepSeek (GTG-16001): silently relaying selected user sessions to Claude and extracting reasoning traces, including traffic tagged from third-party coding harnesses.

These are Anthropic's findings from its own telemetry and investigation—not independently adjudicated court facts. They do, however, sit days after a joint U.S. advisory from CISA and partner agencies accusing several China-based firms of industrial-scale distillation campaigns against U.S. frontier models.

Alleged Distillation Scale by Lab

Anthropic's September report names multiple PRC-linked labs in the distillation chapter. Figures below are Anthropic's attributed volumes for the windows it reports—not a complete industry census.

How the Alleged Routing Worked

Anthropic frames illicit distillation as industrial-scale capability extraction enabled by fraud: networks of fake accounts, stolen cards and API keys, and "transfer station" proxies that obscure who is really calling the model. For Moonshot specifically, the product-routing claim adds a privacy layer: end users of Kimi would not know their prompts were leaving Moonshot's product boundary.

On reasoning traces, Anthropic says Claude APIs return a "thinking signature"—a reference token rather than raw internal reasoning—to reduce unauthorized CoT harvesting. The report alleges Moonshot (and DeepSeek) circumvented that control with cross-session replay: save the signature, open a new session, and elicit Claude to reconstruct the full reasoning transcript. Anthropic says it is hardening defenses against that pattern. This article does not reproduce attack steps beyond what Anthropic disclosed at a high level.

Separately, two days earlier, CISA advisory AA26-251A accused DeepSeek, Moonshot, Alibaba, MiniMax, StepFun, and Z.AI of industrial distillation against U.S. frontier models—including Claude and others—likely with Chinese government awareness. China's Commerce Ministry rejected those accusations and warned of countermeasures if Washington moves to suppress Chinese AI firms.

Sensitive Data That Allegedly Reached Anthropic

The headline privacy scandal is not only that Claude answers may have been sold under another brand. It is that users who thought they were inside a Chinese product boundary may have sent highly sensitive material to a U.S. AI company. Anthropic lists examples from the Moonshot and DeepSeek routing cases:

Broader Report Context

Distillation is only one of seven harm areas in Anthropic's September report: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation. Cases involve Claude Haiku, Sonnet, and Opus; Anthropic says Mythos-class models were generally not implicated in the misuse set, with a limited exception in one distillation case.

The geopolitical overlay is unmistakable. U.S. agencies and frontier labs are casting distillation and silent proxying as national-security and IP problems; Chinese officials cast the same narrative as containment. For product teams, the actionable middle ground is narrower: treat unverified third-party model routing as a data-exfil risk, regardless of which capital is making the accusation.

Why It Matters for Users and Enterprises

If Anthropic's product-routing claim is accurate, the issue is not only competitive cloning of model behavior. Users and enterprises lose a basic promise of a chat product: that their prompts stay with the vendor they chose. Jacob Klein, Anthropic's threat research lead, told Bloomberg that unauthorized forwarding of this kind would be a major privacy scandal whether Anthropic or a rival did it.

For buyers evaluating Chinese open-weight or consumer AI stacks, the diligence checklist now includes: where inference actually runs, whether traffic can be proxied to another frontier API, what is logged for training, and how geo-restriction workarounds are handled. Distillation itself is a legitimate ML technique when done on authorized teacher models; the disputed pattern is covert, fraud-enabled extraction—and, in this week's allegations, live customer proxying without notice.

Takeaways

Until Moonshot, DeepSeek, and other named labs publish detailed rebuttals—or independent audits appear—the responsible framing remains allegation-first. What is already durable is the product lesson: in a market full of proxies, transfer stations, and geo-workarounds, "which model answered me?" is now a security question, not only a branding one.