The distillation chapter of today’s threat report contains the case Bloomberg and the Wall Street Journal are both writing about. It’s uglier than the usual «they’re copying our models» complaint.
What Moonshot did
Moonshot AI, the company behind the Kimi models, silently forwarded customer requests to Claude instead of answering them with Kimi. Claude’s response was then shown to the user as a Kimi response.
Over a ten-day window that came to almost 300,000 customer requests, most of them routed to Opus. The traffic ran through a proxy network of 5,380 fraudulent accounts, most appearing to sit in Singapore and Japan. Between May and July 2026 Anthropic attributes over 23 million exchanges to Moonshot.
Moonshot also saved those conversations and built a pipeline to extract Claude’s reasoning transcripts from them. The fact that Claude returns a «thinking signature» rather than raw thinking wasn’t much of an obstacle: Moonshot saved the signature, opened a fresh session, and got Claude to turn it back into the full reasoning trace.
Where it turns
Anthropic lists what was riding along inside those rerouted requests. Two examples:
- A user Anthropic assesses as likely PLA-affiliated uploaded CCTV material about one specific person – to what they believed was Kimi – and asked for an analysis of whether the person was behaving abnormally. The footage came from hundreds of cameras in Chengdu, including cameras outside PLA facilities.
- An engineer at a major Chinese state-owned enterprise used Kimi to build an internal system, and in doing so exposed internal code and live credentials belonging to several well-known technology companies.
Neither of them knew. Whether Moonshot told its customers their requests were going to a third party, Anthropic says it does not know.
DeepSeek did the same, more selectively
According to the report DeepSeek ran the same play with a filter in front of it. Incoming requests were checked for strings suggesting Claude Code, the Claude Agent SDK or OpenCode. Selected users from that group were then relayed to Claude Opus.
The examples here: specifications and strategic objectives of a flagship Chinese AI programme, live credentials for a database belonging to a Russian defence agency, and a case management system for a municipal Public Security Bureau that matches a person’s movements against police records via national ID numbers. Over 14 days in July, Anthropic counted more than 12.1 million exchanges.
What Anthropic is doing about it
Claude now summarises its internal reasoning before answering, which makes stolen transcripts less useful for training. Fable 5.1 added preserved thinking: new API accounts can no longer alter the system prompt, tools or preceding messages after the fact, which was exactly the lever these replay attacks used. On top of that, classifiers aimed at adversarial extraction, and identity verification when abuse signals show up.
The part worth sitting with
The distillation fight has been an economic story so far. Who copied whose capabilities, and what did it cost. These cases flip that. The injured party here isn’t the lab – it’s the lab’s own customers, people who thought they were using a Chinese model and whose data ended up on an American server.
If you’re the person deciding which model sits behind a product, that’s a new problem. Knowing which model is named in the contract isn’t enough. You also need to know who’s actually answering.
Sources: Anthropic: Detecting and countering misuse of AI, September 2026 · Bloomberg: Moonshot Secretly Routed User Requests Through Claude, Anthropic Says · Techmeme/WSJ: Anthropic details distillation efforts by Chinese companies