Breaking: Chinese Labs DeepSeek and Moonshot were Found Quietly Relaying Customer Prompts to Claude!

Anthropic says two prominent Chinese AI labs did more than query Claude to copy its capabilities. Moonshot AI and DeepSeek allegedly routed live customer prompts to Claude through fraudulent accounts, returned some of Claude’s answers under their own services, and retained exchanges to help train competing models.

The claims appear in Anthropic’s September 2026 threat intelligence report, published on September 10. In one ten-day period, Moonshot allegedly forwarded almost 300,000 customer requests, mostly to Claude Opus. The disclosed prompts included surveillance data, corporate source code, internal documents, and active credentials for government and commercial systems.

These remain Anthropic’s allegations. The public report does not provide raw traffic logs or an independent forensic audit that outsiders could use to reproduce its attribution. Even with that limitation, the findings identify a serious AI security problem: users may not know which company or model is processing the information they enter.

Kimi and DeepSeek Allegedly Became Claude Front Ends

Model distillation usually involves a capable “teacher” model generating examples that train a smaller “student” model. Companies routinely distill their own models or use another provider’s outputs under an agreement.

Anthropic uses the term illicit distillation for coordinated, unauthorized campaigns that use fraudulent accounts, stolen payment methods, compromised API keys, and proxy infrastructure to extract Claude’s capabilities. The company first accused DeepSeek, Moonshot, and MiniMax of industrial-scale distillation in February 2026, when it said the three labs generated more than 16 million exchanges through approximately 24,000 fraudulent accounts.

The latest report adds a more troubling detail. Anthropic alleges that Moonshot did not always process Kimi users’ requests with a Kimi model. Instead, its system silently forwarded selected prompts to Claude and displayed Claude’s responses as if they came from Kimi.

Moonshot allegedly relayed nearly 300,000 customer requests during one ten-day period. Most went to Opus through a proxy network containing 5,380 fraudulent accounts, primarily appearing to operate from Singapore and Japan. Anthropic says Moonshot also captured at least some of these exchanges and built a pipeline for extracting Claude’s reasoning traces.

DeepSeek allegedly ran a similar operation. Its systems inspected strings inside incoming requests to identify people using DeepSeek models through Claude Code, the Claude Agent SDK, OpenCode, and other coding harnesses. Some tagged requests were then redirected to Claude Opus without the customer’s knowledge.

That routing meant a developer could select DeepSeek as the model inside a coding tool, send repository context or credentials, and unknowingly have the request processed by Anthropic’s infrastructure.

The Relayed Prompts Included Surveillance and Credentials

The most serious part of Anthropic’s report is not the potential copying of Claude. It is the sensitive customer information that allegedly crossed an undisclosed trust boundary.

Anthropic describes a Moonshot user it assessed as likely affiliated with China’s People’s Liberation Army. The user loaded CCTV archive data concerning one targeted person and asked what they believed was Kimi to determine whether the individual was behaving abnormally.

The surveillance material drew on hundreds of cameras in Chengdu. The locations included cameras outside PLA facilities, institutes associated with China Electronics Technology Group Corporation, and a major state-owned enterprise. Moonshot allegedly forwarded the request and data to Claude.

In another Moonshot case, an engineer building an internal system for a Chinese state-owned enterprise submitted source code and active credentials belonging to several major Chinese companies. Anthropic says the engineer had no way to know that Claude was receiving the information.

The DeepSeek examples were similarly sensitive:

• An employee at a Chinese technology company submitted internal documentation containing the specifications, organizational structure, and strategic objectives of a flagship AI program.
• An IT operator handling data from a Russian government agency associated with the Russian Ministry of Defense exposed live credentials for a government database.
• Engineers working on a case-management system for a municipal Chinese Public Security Bureau shared details of a tool that compared an individual’s movements with police records using citizens’ national identification numbers.

Anthropic clearly received and processed these requests, and its investigators accessed enough information to describe them. That does not establish that every affected prompt remains stored today.

Anthropic’s published API retention policy says standard inputs and outputs are normally deleted from its back end within 30 days. Exceptions apply when content must be kept to investigate policy violations or satisfy legal obligations. Inputs and outputs associated with detected violations can be retained for up to two years.

The accurate conclusion is therefore that the customer data was exposed to Anthropic, not that Anthropic necessarily retains every exchange indefinitely. The report does not disclose the current retention status of the individual prompts it describes.

How Customer Traffic Became Training Data

The alleged relay system served two purposes. It could give users an answer from a stronger model, while also creating valuable training examples for the Chinese lab operating the service.

Each relayed session contained several useful components:

• A real user request, often based on a practical problem
• Claude’s response to that request
• Tool calls and multi-step agent behavior
• Feedback implied by subsequent user messages
• Potentially, a reconstruction of Claude’s hidden reasoning

Real customer sessions can be more valuable than synthetic prompts because they reflect actual coding environments, documents, errors, credentials, and workflows. They also cover unusual tasks that a lab may not think to create internally.

Anthropic says Claude normally returns a “thinking signature,” a reference that supports continued reasoning without exposing the complete internal trace. Moonshot and DeepSeek allegedly saved these signatures, opened new sessions, and persuaded Claude to reconstruct the underlying reasoning. Anthropic calls this technique a cross-session replay attack.

The resulting chain-of-thought transcripts could then be cleaned and converted into supervised fine-tuning data or used in reinforcement-learning pipelines. Rather than copying only a final answer, the labs were allegedly attempting to capture how Claude decomposed and solved complex tasks.

Anthropic says it has since introduced additional controls to make those attacks less effective. Its newer protections summarize internal reasoning, restrict modifications to earlier conversation context, detect coordinated extraction patterns, and require identity verification when accounts show signs of unauthorized resale or access from unsupported countries.

Alibaba’s Campaign Was Far Larger

DeepSeek and Moonshot are only two of the seven China-based laboratories named in the report. Anthropic also attributes campaigns to Alibaba, Zhipu AI, Xiaomi, SenseTime, and MiniMax.

The reported numbers cover different periods and tactics, so they should not be treated as a direct performance comparison.

Alibaba’s campaign was the largest Anthropic says it has measured. It allegedly peaked at nearly three million exchanges per day from more than 3,500 fraudulent accounts. A first pool of almost 5,000 accounts used residential proxies, disposable email addresses, and virtual payment cards. When Anthropic blocked it, the operators shifted traffic to another pool.