Anthropic published its September 2026 threat intelligence report this week, and buried in 154 pages of cyber-operations and fraud case studies is a story that lands squarely in this blog’s recurring beat: Chinese AI labs allegedly stealing Claude’s outputs to train their own competing models, dressed up as ordinary usage. The headline accusation, per Bloomberg, the South China Morning Post, and CNBC: Moonshot AI silently routed users of its Kimi chatbot to Claude, served them Claude’s answers under the Kimi brand, and kept the transcripts — including Claude’s reasoning traces — to train its own models.
The numbers#
Anthropic’s report puts a figure on it. In one window, the company says it caught almost 300,000 requests — over a roughly ten-day span — funneled primarily to Claude Opus through 5,380 fraudulent accounts, most of them geolocated to Singapore and Japan rather than mainland China, where Anthropic doesn’t permit direct access to its models. That’s the evasion layer: since Moonshot can’t legitimately reach Claude from inside China, the accounts were structured to look like ordinary offshore usage. Zoomed out, Anthropic attributes more than 23 million Claude exchanges to Moonshot between May and July alone.
This isn’t Moonshot’s first appearance in one of these reports. Per the Arabian Post’s reading of the document, Anthropic says it had already named Moonshot back in February 2026, alongside DeepSeek and MiniMax, in a disclosure describing “industrial-scale distillation campaigns” — a separate incident involving more than 3.4 million exchanges. And this blog covered a related but distinct case in June: Anthropic’s accusation that Alibaba’s Qwen lab ran 28.8 million exchanges through roughly 25,000 fraudulent accounts over seven weeks, in what was then described as the largest known distillation attack against any AI lab. The September report adds DeepSeek and Xiaomi to the list of companies Anthropic says engaged in similar behavior alongside Moonshot, though the public reporting so far is thinner on their specific numbers.
Distillation, not just theft#
The mechanism matters here as much as the scale. This isn’t simple API-key sharing or scraping — it’s what Anthropic and the industry call distillation: using a more capable model’s outputs (and, in Moonshot’s case, its intermediate reasoning steps) as training signal to make a cheaper model behave more like the expensive one. Reasoning traces are the valuable part. A chat completion tells you what the answer was; a reasoning transcript tells you how a frontier model got there, which is exactly the kind of signal that’s expensive to generate from scratch and cheap to copy if you can get your hands on it.
Anthropic’s report also documents an unrelated but structurally similar case worth a footnote: a fraudulent reseller operation it labels GTG-50021, which silently proxied customer traffic to a different AI model entirely while its own tooling harvested the victims’ Anthropic credentials in the background. Different target, same underlying lesson — API traffic that looks legitimate on the surface can be doing something else entirely underneath, and the only way labs like Anthropic catch it is through account-pattern forensics after the fact, not real-time enforcement.
China’s response, and what’s still unconfirmed#
China’s Commerce Ministry pushed back hard, per Yahoo Finance’s reporting, saying there is “no factual or legal basis” for the accusations and threatening countermeasures if the U.S. “takes action to contain and suppress” Chinese AI companies. Representatives for Moonshot, DeepSeek, and Xiaomi reportedly did not respond to requests for comment by publication time. None of that is a denial on the merits — it’s a geopolitical framing shot — but it’s worth being precise that as of this writing, no company named in the report has directly rebutted the specific account and exchange counts Anthropic published.
Why this matters beyond the headline#
This blog has spent the summer tracking a pattern: Chinese labs shipping genuinely capable open-weight models — Kimi K3, Qwen3.8-Max, and the Ox Alpha stealth model that turned out to be Z.ai’s GLM-5.3-Flash — at prices Western labs can’t match, followed almost immediately by license-fine-print surprises or provenance questions once the dust settled. This report adds a sharper edge to that thread: it’s not just that some of these models undercut Claude Opus on price while apparently inheriting more of its behavior than their papers disclose. Anthropic is now alleging some of that inheritance came from directly impersonating Claude to millions of end users, not from published open weights at all.
It’s also a reminder of the asymmetry underneath the “who owns the frontier model” debate this blog keeps returning to — most recently with Cognition’s $48B round resting partly on Moonshot’s own Kimi K2.7 Code as a base model. Anthropic trains Opus and Sonnet from scratch at enormous cost, then has to spend additional engineering effort just detecting and shutting down attempts to copy that investment for free. A lab that skips the training run and instead builds detection-evasion tooling to harvest a competitor’s reasoning traces is playing a fundamentally cheaper game — right up until the lab it’s copying from gets good enough at forensic account analysis to catch it, which is exactly what this report claims happened here.
For engineering teams evaluating cheap, fast-improving open-weight coding models from Chinese labs, the practical takeaway isn’t “don’t use them” — it’s “verify what you’re actually being told about how they were built.” A model’s self-reported benchmark table doesn’t disclose its training data provenance, and this year alone has produced multiple instances of that provenance turning out to be more Claude-shaped than advertised.
Sources: Bloomberg, “Moonshot Secretly Routed User Requests Through Claude, Anthropic Says” (Sept 10, 2026); South China Morning Post (Sept 11, 2026); CNBC (Sept 11, 2026); Yahoo Finance (Sept 10-11, 2026); The Arabian Post; officechai; Anthropic’s own September 2026 threat intelligence report, referenced across the above (direct fetch of anthropic.com did not surface company names in the report excerpt retrieved, so company attributions here are sourced to the news outlets above, all of which cite the report directly). This blog’s prior coverage of the June 2026 Alibaba distillation attack.