Kimi and DeepSeek users were quietly talking to Claude, Anthropic says

Distillation is an ordinary training method: a larger teacher model answers a set of inputs, and those answers train a smaller student. What Anthropic describes in its September report is the industrial version of it, built on fraud — thousands of accounts opened with stolen cards and stolen API keys, routed through proxy services that exist to defeat geographic restrictions. The part that reaches ordinary users is quieter than the fraud, and worse: some of those exchanges were their own.

What the report covers

The report describes activity disrupted between December 2025 and August 2026, across seven harm areas, of which illicit distillation is one. Anthropic says that since its first disclosure in February 2026 it has identified campaigns from seven labs based in China, and names Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax.

All of the attacks went after generally available models, with Opus-class reasoning as the prize. Anthropic says it has seen no attempts against Mythos 5 or Mythos Preview, which the public cannot reach in the first place.

The users whose questions were forwarded

Moonshot relayed almost 300,000 customer requests to Claude over a ten-day period rather than answering them with its own Kimi model, and displayed the results as Kimi's. The traffic moved through a proxy network of 5,380 fraudulent accounts, most of them appearing to sit in Singapore and Japan. Moonshot then kept at least part of those exchanges and fed them into its own training.

DeepSeek did the same thing selectively. It inspected strings in incoming requests, tagged the users who arrived through third-party harnesses such as Claude Code, the Claude Agent SDK and OpenCode, and routed the tagged requests to Claude Opus. Over 14 days in July 2026 that came to more than 12.1 million exchanges.

• One relayed session exposed live credentials for a database belonging to a Russian government agency tied to its defense ministry.
• Engineers building a case-management system for a municipal public security bureau in China were working through relayed requests.
• A user Anthropic assesses as likely affiliated with the PLA asked for analysis of CCTV footage tracking one individual.
• Requests relayed from third-party routing platforms carried names, contact details and corporate data from hundreds of end users in at least a dozen languages.

How the reasoning trace was pulled out

Claude returns a thinking signature rather than the raw reasoning trace, precisely so that the trace cannot be harvested. Moonshot saved that signature, opened a fresh session and got the model to expand it back into the full trace. Anthropic calls this a cross-session replay attack and says new defences against it are being introduced.

The rest is cruder. One lab ran a test of more than 12,000 requests, each trying a different extraction technique, then used whichever ones worked in a full campaign. Another asked the model to translate its previous working memory into katakana-only Japanese, which produced the same content in a form the anti-distillation checks did not recognize.

The largest campaign measured so far

Operators affiliated with Alibaba account for the biggest number in the report: more than 151 million exchanges between May and July 2026, peaking near three million a day, launched from more than 3,500 fraudulent accounts. The target was the chain-of-thought reasoning of Opus 4.6 and 4.7, and the harvested transcripts were used to train the Qwen 3.5, 3.6 and 3.7 models.

The other campaigns are smaller and shaped the same way. Moonshot is credited with more than 23 million exchanges in the same period, Zhipu with more than 3.4 million over 17 days, and Xiaomi with more than 400,000 over 20 days in the spring of 2026. SenseTime, Anthropic says, bought harvested transcripts from third-party data vendors, while MiniMax ran its own proxy service through a shell company that sells access to American models only.