--- title: Anthropic Accuses Kimi and DeepSeek of Sending Users' Prompts to Claude Without Their Knowledge description: Anthropic says Moonshot AI and DeepSeek relayed customers' requests to Claude without their knowledge and used the answers to train their own models. author: Darie Nani (Editor-in-Chief) date: 2026-09-11T10:02:42.606Z updated: 2026-09-11T11:03:18.910Z canonical: https://www.sovereignmagazine.com/article/kimi-deepseek-claude-prompts-anthropic image: https://cdn.nanimediahouse.com/pexels-person-coding-on-a-laptop-with-html-code-on-screen-showcasin-574077.jpg categories: Artificial Intelligence, Science & Tech content_type: News region: Global publication: Sovereign Magazine about: - type: Organization name: Moonshot AI description: Moonshot AI is a Beijing-based artificial intelligence company founded in 2023, known for its Kimi family of large language models. In July 2026 it released Kimi K3, a 2.8 trillion parameter mixture-of-experts model billed as the largest ever intended for an open-weight release. url: https://www.moonshot.ai foundingDate: 2023-03-01T00:00:00.000Z industry: Artificial Intelligence sameAs: - https://huggingface.co/moonshotai - https://x.com/Kimi_Moonshot - type: Organization name: DeepSeek description: DeepSeek is a Hangzhou-based AI company founded by Liang Wenfeng and backed by the hedge fund High-Flyer. --- Moonshot AI, the Beijing company behind the Kimi models, sent its customers' requests to Anthropic's Claude instead of answering them with Kimi, and showed those customers Claude's replies, Anthropic says in [a threat intelligence report published on 10 September](https://www.anthropic.com/threat-intelligence-report-september-2026). In one ten-day period, Anthropic says, Moonshot relayed almost 300,000 customer requests, the vast majority of them to Claude Opus. DeepSeek used similar tactics, according to the report, picking out some developers who were using DeepSeek's models through [coding tools](https://www.sovereignmagazine.com/article/ai-coding-agents-sandbox-escape-security-2026) such as Claude Code and OpenCode and relaying their requests to Claude Opus. Anthropic says both companies used Claude's responses as training data for their own models, and it attributes the campaigns "with high confidence" to specific labs based in China. Anthropic says the people sending those requests thought they were using Kimi or DeepSeek, and that the requests included live credentials and CCTV surveillance data. It also says many of the exchanges DeepSeek, Xiaomi and Moonshot fed into Claude came from users of third-party model routing services commonly used in the United States and Europe. "Those sessions contained names, email addresses, company data, and other sensitive data of hundreds of end users in at least a dozen languages," the report says. ## CCTV Footage From Chengdu Was Among the Kimi AI Requests Anthropic has barred companies more than 50% owned by businesses headquartered in China from its services since September 2025, and says Moonshot reached Claude through a proxy network of 5,380 fraudulent accounts, most of which appeared to be in Singapore and Japan. Moonshot captured and saved at least a portion of the relayed exchanges and built a pipeline to extract Claude's written-out reasoning from them to train its models, according to Anthropic. It counts more than 23 million exchanges in distillation attacks attributable to Moonshot between May and July 2026. Anthropic says the requests Moonshot rerouted included sensitive information about its customers, and that it does not know whether Moonshot told those customers their requests were being sent to Anthropic. In one case, a user Anthropic assesses was likely affiliated with the People's Liberation Army, China's military, loaded CCTV data about a single targeted individual into what they thought was Kimi and asked whether the tracked person was behaving abnormally. The data included video from hundreds of cameras in Chengdu, among them cameras outside PLA facilities, institutes affiliated with the China Electronics Technology Group Corporation and a major state-owned enterprise. > "The user had no way of knowing that their use of Kimi was being forwarded to Claude." > — Anthropic threat intelligence report, September 2026 In another case, an engineer used Kimi to build an internal system for a major Chinese state-owned enterprise and, in doing so, exposed internal code and live credentials from multiple major Chinese companies, including high-profile technology firms, Anthropic says. ## DeepSeek Tagged Developers Using Claude Code and OpenCode DeepSeek, the Hangzhou company founded by Liang Wenfeng and backed by his hedge fund High-Flyer, checked strings in incoming requests to tag users running its models through coding tools such as Claude Code, the Claude Agent SDK or OpenCode, according to Anthropic. "Selected tagged users then had their requests relayed to Claude Opus," the report says. Anthropic says the data was likely routed to it without the knowledge or consent of DeepSeek's customers, and it counts more than 12.1 million exchanges attributable to DeepSeek over 14 days in July 2026. An employee of a Chinese technology company used what they believed was DeepSeek to analyse internal documentation, including the full specifications, organisational structure and strategic objectives of a flagship AI programme, and DeepSeek relayed that data to Claude, Anthropic says. It says the company was "almost certainly not made aware" that its data was going to Claude. DeepSeek also relayed requests from an IT operator working with data from a Russian government agency associated with the country's Ministry of Defence, requests that contained live credentials for a Russian government database, according to Anthropic. Engineers building a case management system for a municipal Public Security Bureau, a local police authority in China, also had their DeepSeek requests relayed to Claude. One engineer built a tool that compares a person's movements against police records using citizens' national ID numbers. To reduce the risk of unauthorised distillation, Claude returns a reference to its reasoning, which Anthropic calls a "thinking signature", and Anthropic's API uses that reference to look up the full reasoning in later calls. Anthropic says Moonshot and DeepSeek both got around this control by saving the signature, starting a new session and getting Claude to convert it back into the full reasoning trace, a method it calls a cross-session replay attack. DeepSeek used it to extract reasoning that would otherwise have been summarised, according to Anthropic. ## Seven Chinese Labs Named Since February Anthropic [first named DeepSeek, Moonshot AI and MiniMax in February](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks), when it said the three had generated more than 16 million exchanges with Claude through about 24,000 fraudulent accounts. In the September report, which also covers Russian espionage, influence operations, surveillance and weapons cases, Anthropic says it has since identified and disrupted distillation attacks from seven labs based in China, which it names as Alibaba, Moonshot, DeepSeek, Zhipu (branded Z.ai outside China), Xiaomi, SenseTime and MiniMax. [Anthropic accused Alibaba of distilling Claude in June](https://www.sovereignmagazine.com/article/anthropic-alibaba-distillation-export-ban), and now says Alibaba ran "the largest distillation attack we have ever measured", with more than 151 million exchanges between May and July 2026. All of the attacks targeted Anthropic's generally available models, and Anthropic says it has not seen attempts against its Mythos models. Anthropic says a model distilled from a frontier model can help achieve dangerous capabilities, including in the biological and cyber domains, even when the harvested exchanges contain little about those subjects. "The robust safeguards that prevent Claude from being misused by bad actors do not transfer when our models are distilled by an unauthorized lab," it says. Instead of banning proxy accounts one at a time, Anthropic says it now tries to attribute their activity to a specific organisation, and it has strengthened classifiers built to detect adversarial extraction. Claude now summarises its internal reasoning before responding, which Anthropic says makes stolen transcripts less useful for training another model. Accounts showing signs of abuse, such as unauthorised resale of Claude or operating from unsupported countries including China, Russia and Iran, can be required to verify their identity, and are banned if they fail to. ## China's Commerce Ministry Calls Distillation Normal Practice On 8 September, two days before Anthropic's report, the US National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI issued a joint advisory naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as China-based AI companies running industrial-scale distillation campaigns against US AI companies. A spokesperson for China's Ministry of Commerce responded to the advisory the next day, calling the accusations groundless and without legal basis, according to the state news agency Xinhua. The spokesperson said the US was politicising distillation, which the ministry described as a normal technical and commercial issue in the AI industry, and said China would take resolute countermeasures if the US used it as a pretext to suppress Chinese AI companies. Anthropic has faced its own [criticism over the data it used to train Claude](https://www.sovereignmagazine.com/article/anthropic-distillation-built-on-copying). Separately from the argument over distillation, Anthropic says the labs' handling of their own users' data is "likely inconsistent with privacy laws and the labs' own terms of service". Anthropic does not say in the report whether it has told the affected customers or the two companies what it found. DeepSeek and Moonshot have not responded publicly to the report. ## FAQ **Q: Is Kimi AI from China?** Yes. Kimi is made by Moonshot AI, a Beijing-based company founded in 2023 by Yang Zhilin and backed by Alibaba and Tencent. Its latest flagship model, Kimi K3, was announced on 16 July 2026. Anthropic says that in one ten-day period Moonshot sent almost 300,000 Kimi customer requests to Claude, and that those users received Claude's responses while believing they were using a Kimi model. **Q: What is a distillation attack in AI?** Distillation itself is a standard training method, in which a larger "teacher" model generates responses that are used to train a smaller "student" model to mimic it. Anthropic uses the term illicit distillation for "an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization", usually run through networks of fake accounts set up with stolen credit cards, login credentials and API keys. In the cases of Moonshot and DeepSeek, Anthropic says the exchanges came from real customer requests relayed to Claude, whose answers the two companies then used as training data. **Q: Is AI distillation illegal?** The technique is legitimate and widely used in AI development. Anthropic's commercial terms bar customers from using its services to build a competing product, including to train competing AI models, and Anthropic says Moonshot reached Claude through thousands of fraudulent accounts. China's Ministry of Commerce, responding to the US advisory, has described distillation as a normal technical and commercial issue in the AI industry. Anthropic's separate concern is how DeepSeek, Xiaomi and Moonshot handled their own users' data, which it says is "likely inconsistent with privacy laws".