You thought you were talking to DeepSeek and Kimi, but it might have been Claude: Anthropic’s revelations

Distillation, in AI jargon, refers to a perfectly legitimate training method: a large “teacher” model is made to answer thousands of questions, and then a smaller “student” model is trained to imitate it. In other words, the student studies the top student’s notes, and the problem begins when the teacher never requested it.In its semiannual report on malicious uses of Claude, published on September 10, Anthropic accuses seven Chinese laboratories, including Alibaba, DeepSeek, Moonshot AI (the publisher of Kimi), and Xiaomi, of having siphoned off its model at industrial scale since December.

Are Moonshot and DeepSeek secretly having you talk to Claude?

The two most embarrassing cases involve consumer-facing services. According to Anthropic, Moonshot AI silently forwarded nearly 300,000 requests from its customers to Claude over a single ten-day period, using 5,380 fraudulent accounts located in Singapore and Japan. The responses were then displayed as though they had come from Kimi. DeepSeek allegedly did the same, with a refinement: its systems identified developers using tools such as Claude Code or OpenCode and selectively redirected their sessions to Claude Opus. In both cases, the exchanges were recorded to extract the reasoning chains of the American model and feed the training of Kimi and DeepSeek.

Alibaba, with its Qwen models, allegedly conducted the largest operation ever measured by Anthropic: 151 million exchanges between May and July, reaching 3 million per day (yes, per day), through more than 3,500 accounts created using false identities and stolen bank cards. Zhipu allegedly extracted 3.4 million exchanges over seventeen days, and Xiaomi allegedly replayed its own users’ sessions in Claude.SenseTime reportedly bought transcripts from resellers, while MiniMax reportedly set up a shell company offering only American models, with no Chinese models whatsoever in its catalog (subtle). In total, nearly 200 million exchanges, compared with the three labs targeted in Anthropic’s first alert in February.

Why the case goes beyond the dispute between labs

As early as January 2025, OpenAI accused DeepSeek of having distilled its models, when R1 was causing a stock-market frenzy; Google documented the same phenomenon this year, and Anthropic is therefore launching its second round of accusations. What changes with this report is the mechanics it describes. The labs would be using networks of accounts opened with stolen cards and stolen API keys, along with commercial relays that resell access to Claude where it is not offered. These intermediaries also record conversations and sell them to anyone who wants to train a model: the theft of capabilities now has a supply chain, with wholesalers and retailers.

In the relayed requests, Anthropic says it recovered names, email addresses, still-active access tokens and investment forecasts for a pharmaceutical laboratory, all in a dozen languages. A user apparently linked to the Chinese military even had surveillance-video data analyzed through it, believing they were contacting Kimi.Some of this traffic passed through third-party routing platforms widely used in Europe, where the GDPR compliance of these silent redirects would raise a few questions (Anthropic politely refers to practices “probably incompatible” with privacy laws). A blind spot remains, and it is a major one: the accuser is a direct competitor of the accused, none of the seven labs has publicly responded at this stage, and the evidence still comes from only one party. Anthropic says it has strengthened its filters and now summarizes Claude’s reasoning, making the stolen transcripts less useful.

👉🏻 Follow tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.

Source: Anthropic