Moonshot Secretly Routed User Requests Through Claude, Anthropic Says

Anthropic PBC accused China’s artificial intelligence champion Moonshot AI of covertly routing thousands of user requests to the US firm’s Claude models and passing off the responses as its own in a bid to gain an edge in the AI race.

Moonshot diverted queries to chatbots from Anthropic, without letting users know, rather than processing them through its Kimi model, according to a report Anthropic published Thursday. In one instance, Anthropic said it spotted nearly 300,000 customer requests that Moonshot sent primarily to Anthropic’s Opus AI model. Since Anthropic does not allow its technology to be accessed from inside China, Moonshot used 5,380 fraudulent accounts, most of which appeared to be located in Singapore and Japan, according to the report.Anthropic determined Moonshot’s activity was part of a process known as distillation, in which a developer uses data from a more powerful AI model to improve a less powerful system. In this case, Anthropic said it believes the responses Moonshot received from Anthropic’s systems were then used to train Moonshot’s own software. DeepSeek and Xiaomi Corp. engaged in similar practices, Anthropic said.

The report comes shortly after US security agencies accused China’s top AI companies, including DeepSeek and Moonshot, of systematically extracting proprietary knowledge from American firms through their distillation practices. The government warned Silicon Valley developers to protect their work. US tech firms, including Anthropic, have also previously accused Chinese firms, including Moonshot, of distillation. Moonshot has since emerged as one of the most prominent AI challengers in the country thanks to the breakout success of its Kimi K3 model this summer.Moonshot declined to comment. Representatives for DeepSeek and Xiaomi did not respond to a request for comment outside normal business hours.The Chinese Commerce Ministry recently said there is “no factual or legal basis” for accusations of industrial-scale distillation of US models by Chinese AI companies. It also threatened to take countermeasures if the US “takes action to contain and suppress” Chinese AI companies.Distillation is a common technique for enhancing AI models. Anthropic, too, has seen improvements when distilling its own models, said Jacob Klein, the company’s head of threat research. But unauthorized distillation risks allowing other developers to take shortcuts to build better models and offer them for less money, potentially undercutting firms like Anthropic as it prepares to go public.The technique, and the alleged prompt-diversion tactics, may also raise fresh questions about the data privacy practices of Chinese AI labs. “If we were to do that, or if one of our competitors would do that, that would be a large privacy scandal,” Klein said in an interview.

Anthropic’s 145-page report outlines a range of threats involving its software that the company said it discovered and disrupted from last December to this August. That included suspected state-sponsored and financially motivated cyberattacks, surveillance operations and disinformation campaigns.

The report found that one Kimi user uploaded Chinese surveillance data into the model to seek analysis on whether a specific person was behaving abnormally. Though this user likely thought this request would be fielded by Moonshot, it ultimately ended up being posed to an Anthropic model, becoming visible to the US company. This request included video surveillance from hundreds of cameras including those outside of People’s Liberation Army Facilities, Anthropic said in the report.Examples in the report show how AI is speeding up the making of malware, monitoring of social media and spreading of political propaganda. Anthropic said that in each case it blocked the offending accounts and developed safeguards to guard against similar behavior.

Anthropic and the broader AI industry are under scrutiny for a series of breaches that were disclosed this summer involving AI models and cybersecurity tests gone wrong, raising concerns about the companies’ abilities to safeguard their most advanced software. On Wednesday, Anthropic disclosed that it had discovered an additional hack by one of its models during security testing. The incident involved an early version of Claude Opus 4.6, the company said.