Anthropic has accused several of China's leading AI laboratories, including Moonshot AI and DeepSeek of secretly routing customer prompts to its Claude models through networks of fraudulent accounts, then presenting Claude's responses to users as if they had come from their own systems. The allegations, detailed in Anthropic's latest threat intelligence report, mark an escalation in the company's ongoing dispute with Chinese AI developers over what it calls 'illicit distillation' - a rival's more powerful model to train and improve a competitor's own product.
How the alleged scheme worked
According to Bloomberg, Moonshot AI, the Beijing-based maker of the Kimi chatbot, covertly diverted thousands of user requests to Claude and passed off the responses as its own, without informing users that their queries were being redirected. Since Anthropic does not permit access to its technology from within China, Bloomberg reported that Moonshot relied on 5,380 fraudulent accounts, most of which appeared to be based in Singapore and Japan, to circumvent the restriction. In one 10-day stretch alone, Anthropic said Moonshot relayed nearly 300,000 customer requests, the vast majority of which were routed to Claude's Opus models. Anthropic said the diverted exchanges were then used to train Moonshot's own software, with the company extracting Claude's reasoning transcripts specifically to serve as training data — a technique known in the industry as distillation. Anthropic said Moonshot's activity totalled more than 23 million exchanges between May and July.
DeepSeek was accused of a similar tactic, according to Bloomberg, routing live customer conversations through Claude rather than processing them through its own systems. Reports also named Xiaomi as having engaged in comparable behaviour.
Sensitive Data Exposed In The Process
Anthropic said that because users of the Chinese platforms had no idea their queries were being forwarded, sensitive information ended up flowing directly onto its servers. Among the cases cited: a user Anthropic assessed as likely affiliated with China's People's Liberation Army used the Kimi platform to ask whether an individual tracked across hundreds of CCTV cameras in Chengdu was behaving abnormally. In a separate instance, traffic relayed through DeepSeek exposed live credentials for a Russian government database tied to an IT operator handling data for an agency linked to Russia's Defense Ministry. Anthropic also said relayed traffic included material from a Chinese police case-management system.
Wider Roster Of Labs Named
Beyond Moonshot, DeepSeek and Alibaba, Anthropic's report named several other Chinese firms. Zhipu, developer of the GLM models, and SenseTime were accused of similar extraction practices, with Anthropic alleging that SenseTime's training pipeline incorporated Claude transcripts purchased from third-party data vendors. MiniMax was separately accused of operating a proxy service through an undisclosed shell company that sells access exclusively to Anthropic and OpenAI models. Anthropic first raised distillation allegations against DeepSeek, MiniMax and Moonshot in February, when it said the three labs had generated more than 16 million exchanges using roughly 24,000 fraudulent accounts — figures that Thursday's report suggests have since grown substantially.
Privacy and legal concerns
Anthropic said in its report that the findings "raise concerns about the misuse of user data by PRC AI labs," and that the practices it uncovered are likely inconsistent with both privacy laws and the labs' own terms of service. The company said it has disrupted the schemes it identified and continues to monitor for further activity.
