Moonshot and DeepSeek Secretly Served Claude Instead of Their Own Models

Anthropic's September 10, 2026 threat intelligence report — covered at a high level in explainx.ai's companion overview of the full report — contains one disclosure that stands apart from the rest: two major Chinese AI labs didn't just steal Claude's outputs to train their own models. They served Claude's actual responses to their own paying customers while pretending those answers came from their own models.

TL;DR

The distinction that matters: distillation vs. impersonation

Illicit model distillation — training a cheaper model to mimic a frontier model's outputs, without authorization — has been a running story on explainx.ai all year, from Anthropic's June accusation against Alibaba over 25,000 fake accounts to the AI token black market reselling stolen access. Every prior case followed the same basic shape: someone captures Claude's outputs, offline, to use as training data for a separate model later.

Moonshot and DeepSeek's disclosed behavior is different in kind, not just degree. Per Anthropic: "Moonshot AI... silently forwarded customer requests to Claude, instead of processing them using Kimi. Moonshot then displayed Claude's responses to users." A Kimi customer typing a question into what they believed was Moonshot's own model was, in some fraction of cases, actually talking to Claude in real time — with the response served back to them under Moonshot's branding. Anthropic says it doesn't know whether Moonshot ever disclosed this to its customers. DeepSeek is reported doing the same thing, checking for requests routed through third-party or Anthropic-native coding harnesses — Claude Code, the Claude Agent SDK, OpenCode — and quietly relaying tagged users' requests to Claude Opus.

This means real customers of two major Chinese AI products may have been unknowingly sending sensitive data — internal documentation, live credentials, business specifications — directly to Anthropic's infrastructure, with neither their consent nor, in some documented cases, their own provider's disclosure.

The sensitive data that leaked through the relay

Anthropic's report includes specific, named examples of what got exposed through DeepSeek's silent relaying:

• A PRC technology company's flagship AI program — an employee analyzing internal documentation had it relayed to Claude, exposing "the full specifications, organizational structure, and strategic objectives" of the program
• A Russian government agency's live credentials — an IT operator working with data from a Russian Ministry of Defense-affiliated agency had requests relayed that exposed live database credentials
• PRC police case-management data — engineers building a public security bureau case-management system had their work relayed, exposing a tool that compares individuals' movements against police records by national ID

None of these users had any way of knowing their prompts were leaving DeepSeek's own infrastructure. That's the sharper edge of this story relative to prior distillation coverage: the harm isn't confined to Anthropic and Moonshot/DeepSeek as competing companies — it extends to those companies' own customers, whose data moved to a third party without consent.

How the reasoning theft actually worked

Both Moonshot and DeepSeek used the same specific technique to defeat one of Anthropic's existing anti-distillation defenses. Claude's API returns a thinking signature — a reference to the model's internal reasoning — rather than the raw chain-of-thought text, specifically so a captured API response can't be replayed to extract the full reasoning trace directly. Moonshot and DeepSeek's workaround: save the signature from a real response, open a new session, and prompt Claude to convert that signature back into the full reasoning trace. Anthropic calls this a cross-session replay attack, and says it's introducing new defenses specifically against it.

This detail matters beyond the two labs named here — it's a demonstrated, working method for extracting reasoning traces that Anthropic's existing summarization-based protection didn't fully close, and other actors in the report used variations on the same idea (asking Claude to "translate" its reasoning into another language, for instance, as a workaround to direct extraction requests).

Alibaba: the largest distillation attack Anthropic has measured

Separate from Moonshot and DeepSeek's live-serving scheme, Alibaba (Qwen/Tongyi Lab) ran what Anthropic explicitly calls the largest distillation attack we have ever measured:

This dwarfs the scale Anthropic disclosed in its June accusation against Alibaba, which cited roughly 25,000 fake accounts and 28.8 million exchanges. The September figure — 151 million exchanges — is more than five times the exchange volume of the earlier disclosure, suggesting either the campaign continued to scale after June's public accusation, or that June's numbers captured only part of a larger, ongoing operation Anthropic has since measured more completely. Alibaba's operation also fed traffic from other labs: Anthropic found some of Alibaba's fraudulent accounts were "funneling requests from DeepSeek and Xiaomi," confirming shared proxy infrastructure serves multiple unauthorized distillers at once.

The rest of the field: Zhipu, Xiaomi, SenseTime, MiniMax

The report names four more labs, each with a distinct method worth distinguishing:

• Zhipu (Z.ai) ran a chain-of-thought extraction pipeline against Claude Opus 4.8 (770,609 exchanges through its extraction cleaner in 10 days; 3.4 million+ total exchanges over 17 days), and separately targeted Claude's cyber capabilities specifically ahead of releasing GLM-5.3. Notably, Zhipu first tried to distill Anthropic's Fable model's cyber skills and gave up after Fable's cyber safeguards degraded the attack — then switched to Claude Opus 4.6 and a competing lab's model specifically because their safeguards were assessed as weaker.
• Xiaomi replayed its own MiMo model's user sessions — captured through OpenClaw and OpenCode coding harnesses — through Claude, generating training data rather than serving Claude's live responses to users. Anthropic notes the bulk of Xiaomi's distillation activity began right as a MiMo-V2-Pro free trial period was ending, suggesting the trial was used deliberately to harvest a surge of international developer traffic.
• SenseTime bought harvested Claude transcripts from third-party data resellers rather than running its own capture infrastructure — a lower-effort approach that depends on the broader reseller ecosystem Anthropic describes forming around stolen model access.
• MiniMax ran an undisclosed shell-company proxy service that offered access only to Anthropic and OpenAI models — never its own MiniMax models — which Anthropic reads as strong evidence the service existed specifically to harvest competitor exchanges for training rather than as a legitimate reseller business.

What Anthropic changed in response

Anthropic describes two concrete defensive changes tied directly to this wave of attacks:

1. Default reasoning summarization — Claude now summarizes its internal reasoning before responding rather than exposing a raw trace, making a captured response less useful as training data even before the signature/replay issue.
2. Preserved thinking (Fable 5.1) — blocks new API accounts from altering the system prompt, tools, or prior messages that precede Claude's reasoning in a multi-turn conversation — directly closing the cross-session replay technique Moonshot and DeepSeek used, since editing that preceding context was the mechanism that tricked Claude into reconstructing its reasoning from a saved signature.

Honest limitations

• Anthropic is a party to this dispute. Every figure in this post comes from Anthropic's own investigation and reporting — there's no independent third-party audit of Moonshot's, DeepSeek's, or Alibaba's internal systems confirming these numbers.
• No response from the named labs is included in Anthropic's report — treat this as one side's account of a genuine security and IP dispute, pending any rebuttal from Moonshot, DeepSeek, Alibaba, Zhipu, Xiaomi, SenseTime, or MiniMax.
• The 151M-exchange Alibaba figure and the earlier 28.8M figure aren't stated as directly comparable — Anthropic doesn't explicitly say whether September's number supersedes, extends, or measures a different slice of the same underlying campaign as June's disclosure.
• "Silently served Claude" doesn't establish scale of harm to end users — Anthropic quantifies the volume of relayed requests but doesn't estimate what fraction of total Kimi or DeepSeek traffic this represents, so readers shouldn't assume most interactions with these products involved Claude.

The takeaway

Distillation stories in 2026 have mostly followed a familiar shape: a lab scrapes or buys a frontier model's outputs to train a cheaper competitor. What Anthropic's September report adds is a sharper, more consumer-relevant version of the same story — Moonshot and DeepSeek customers who thought they were using a sovereign Chinese model may, in a measurable slice of interactions, have been talking to Claude the entire time, with their prompts and any sensitive content inside them relayed to a third party neither they nor arguably their own provider fully disclosed. Alibaba's 151-million-exchange campaign is the scale story; Moonshot and DeepSeek's live-serving disclosure is the trust story — and for anyone choosing an AI provider based on data-sovereignty or "runs on our own model" claims, it's the one worth reading twice.

Related on explainx.ai:

• Anthropic's September 2026 Threat Intelligence Report: Full Overview — cyber operations, weapons, surveillance, and biology cases from the same report
• Anthropic Accuses Alibaba of Distilling Claude via 25,000 Fake Accounts — the June disclosure this post's 151M figure now dwarfs
• White House Accuses Moonshot AI of Distilling Claude Fable 5 Into Kimi K3 — the prior US government accusation against the same lab
• AI Token Black Market: How Claude and Codex Get Resold — the reseller ecosystem SenseTime and MiniMax's schemes plug into
• Stealing Reasoning Traces: The Encrypted CoT Vulnerability — deeper technical background on the thinking-signature attack surface
• GLM-5.3's "50% Coding Boost" Explained — the model Zhipu's cyber-capability distillation attempt was aimed at supporting

Details in this post reflect Anthropic's September 10, 2026 threat intelligence report. None of the named labs' own statements on these allegations are included here — check for direct responses from Moonshot, DeepSeek, Alibaba, Zhipu, Xiaomi, SenseTime, or MiniMax before treating any single figure as final.