Anthropic says Moonshot and DeepSeek quietly routed their own customers' prompts to Claude
The distillation totals are what the wires quoted, but the September report also puts Chinese police and military users in front of an American model without their knowing it.
Somewhere in Chengdu this summer, a user Anthropic assesses was likely affiliated with the People's Liberation Army loaded footage from hundreds of surveillance cameras into what they believed was a Chinese model and asked whether the man being tracked was "behaving abnormally". They were talking to Claude.
They did not know that. Anthropic's threat report, published on 10 September 2026, says Moonshot AI silently forwarded its Kimi customers' requests to Anthropic and showed them Claude's answers as Kimi's. DeepSeek did the same. Over one ten-day stretch Moonshot relayed almost 300,000 customer requests through a network of 5,380 fraudulent accounts, most of them registered in Singapore and Japan.
That is not the number the wires led with. They led with the distillation totals — training your model on a rival's outputs — which add up, across the five campaigns Anthropic measured, to 189.9 million exchanges. Alibaba's Qwen team accounts for 151 million of them between May and July, peaking near three million a day. Seven China-based labs have been caught since the February disclosure.
Those figures are a commercial grievance with an export-policy argument attached, and Anthropic surely knows it. The relay findings are something else.
What the relay actually sent to San Francisco
Anthropic lists what arrived. Engineers building a case-management tool for a municipal Public Security Bureau, comparing a person's movements against police records by national ID number. And, through DeepSeek, an IT operator handling data from a Russian government agency tied to its defence ministry, whose relayed requests exposed live credentials for a Russian government database.
So what does that mean for the customer at the other end? It means their prompts went to an American company, under a contract they never signed, in a jurisdiction they may have been specifically avoiding.
Two Chinese labs spent the spring turning themselves into an intelligence feed for a firm in San Francisco. Not on purpose. That is arguably worse, because nobody was watching the pipe.
The part a security team should read twice
The Russian espionage case is the one that changes anyone's Monday. Anthropic designates the actor GTG-20006 — an internal label for an actor abusing AI, not a public one — and says its attribution is consistent with public reporting linking the actor to Midnight Blizzard. One operator used the handle "JackPoterz". The toolkit was ordinary: two families of Windows implants, a mobile exploitation kit, a credential stealer, a phishing platform, an admin console.
The loop around it was not.
If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006's toolkit until it was undetected.
Static signatures have been the economic backbone of endpoint security. A defender writes one, and the attacker pays in engineer-hours to route around it. An agent that rebuilds a binary until it comes back clean charges that cost to an API meter instead, and meters are cheaper than people. Anthropic's own line, that sophistication has stopped being a reliable signal of who is behind an operation, is the sentence security vendors will spend a year arguing with.
More than 20 organisations sat in the actor's planning, reconnaissance or live operations: ministries, defence and intelligence bodies, embassies, think tanks, defence-industrial firms, concentrated in Ukraine and Europe. They bulk-exported the mailboxes of at least two drone component makers and stole a complete software development kit for a drone vision system, then reverse-engineered it down to the bill of materials and an unannounced product. To reach targets indirectly they compromised three vendors running hotel guest WiFi and rewrote DNS records, so a traveller connecting from a lobby handed over their traffic.
Reasons to hold some of this at arm's length
Anthropic is grading its own homework here, naming commercial rivals on evidence it does not show, in a week when its own safety record is the subject of a resignation that went around the industry. No methodology accompanies the attribution of an account cluster to a named company.
Two things pull the other way. Google published an adversarial-distillation threat tracker earlier this year and OpenAI has made the same complaint since early 2025, so this is not one vendor's invention. And the relay finding is the rare accusation the accused party's own customers can check: if you ran a Kimi or DeepSeek session through a coding harness this summer, where your tokens actually went is now a live question, and neither company has answered it.
We would expect at least one major endpoint vendor to publish evasion telemetry showing a step change in unique hashes per campaign before the end of the first quarter of 2027. If that data comes back flat, this was a capability demonstration rather than a shift, and we will say so.
The report's own footnote is the sharpest thing in it. A proxy platform serving virologists, blocked by Anthropic's biosecurity classifier while helping draft a chikungunya gain-of-function grant, built a fallback that forwarded refused prompts to a competitor's model. Safety, at that point, is a routing decision made by somebody else.
