The Pulse
Anthropic Report Alleges Moonshot and DeepSeek Routed User Requests to Claude
Anthropic’s September 2026 report describes alleged customer-request routing and model-distillation activity involving Moonshot AI and DeepSeek.
AI.info Team · Written with AI · fact-checked ·
Anthropic’s September 2026 threat-intelligence report alleges that Moonshot AI and DeepSeek routed some customer requests to Claude without users’ knowledge. The company says the activity exposed sensitive information and was also used to collect Claude outputs and reasoning traces for model training.
The report describes Anthropic’s own investigation and allegations. It does not report a Chinese regulatory inquiry, visits to the firms, summonses, or possible sanctions.
Moonshot’s Kimi Requests
Anthropic says Moonshot AI, which produces the Kimi family of models, silently forwarded some customer requests to Claude instead of processing them with Kimi. The report says Moonshot displayed Claude’s responses to users who believed they were using Kimi.
In one ten-day period, Moonshot allegedly relayed almost 300,000 customer requests to Anthropic, most of them routed to Claude’s Opus model. Anthropic says Moonshot used a proxy service network involving 5,380 fraudulent accounts, most of which appeared to be in Singapore and Japan.
Anthropic says Moonshot saved at least some of the exchanges and built a pipeline to extract Claude’s chain-of-thought transcripts for model training. The report describes a cross-session replay method: Moonshot saved a reasoning signature from Claude’s response, started a new session, and elicited the corresponding reasoning trace. Anthropic says it is introducing additional defenses against such tactics.
The report says some rerouted queries contained sensitive customer information. In one case, a user Anthropic assessed as likely affiliated with the People’s Liberation Army used what they thought was Kimi to analyze surveillance footage of one person collected from hundreds of cameras in Chengdu. The cameras included locations outside PLA facilities, institutes affiliated with the China Electronics Technology Group Corporation, and a major state-owned enterprise.
In another case, an engineer used Kimi to build an internal system for a major Chinese state-owned enterprise. Anthropic says the requests revealed internal code and live credentials from several major Chinese companies. The report says the engineer had no way of knowing the requests were being forwarded to Claude. Anthropic estimates that Moonshot was responsible for more than 23 million exchanges between May and July 2026.
DeepSeek’s Routing Activity
Anthropic says DeepSeek used similar methods, silently relaying some exchanges to Claude and targeting Claude’s reasoning traces. According to the report, DeepSeek used a cross-session replay technique to extract reasoning transcripts that Claude would otherwise return only as a protected reference.
The report says DeepSeek identified users trying to access its models through third-party or Anthropic coding tools, including Claude Code, the Claude Agent SDK, and OpenCode. It then relayed selected requests to Claude Opus. Anthropic says customers were likely not aware that their requests were being sent to Claude.
One example involved an employee of a Chinese technology company who used what they believed was DeepSeek to analyze internal documentation. Anthropic says the relayed material included the specifications, organizational structure, and strategic objectives of a major artificial-intelligence program.
In a separate case, DeepSeek allegedly relayed requests from an information-technology operator working with data from a Russian government agency associated with the country’s Ministry of Defense. The requests exposed live credentials for a Russian government database.
Anthropic also describes a police-surveillance case involving engineers building a case-management system for a municipal Public Security Bureau in China. The engineers used DeepSeek while developing a tool that compared a person’s movements with police records containing citizens’ national identification numbers. The company says DeepSeek generated more than 12.1 million exchanges over 14 days in July 2026.
Anthropic’s report presents its claims about routing and distillation; it does not establish whether the companies or their users have independently confirmed those accounts. The report also does not describe any Chinese government finding or enforcement action related to the alleged activity.