On September 10, 2026, Anthropic published a report titled "Detecting and Countering AI Misuse: September 2026," alleging that Chinese company Moonshot AI, developer of the Kimi model family, secretly redirected its users' queries to Claude instead of processing them with its own models. In doing so, Moonshot presented clients with responses obtained from Claude, passing them off as results from Kimi.
Users believed they were interacting with the Kimi model, but in reality, they were receiving responses from Claude—without any notification of the substitution.
Scale of Redirection
In one recorded incident, Moonshot redirected nearly 300,000 client queries to Anthropic over ten days, with the vast majority directed to models in the Opus line. To orchestrate this scheme, the company used a network of 5,380 accounts, most of which, according to Anthropic, were registered in Singapore and Japan.
Beyond substituting responses, Moonshot retained at least a portion of the intercepted conversations. The company built a separate pipeline to extract chains of thought (CoT)—transcripts of the logic Claude used to arrive at answers—from the saved redirected exchanges, using this data to train its own models. To bypass Anthropic's technical restrictions on access to full reasoning transcripts, they employed attacks involving replay between sessions.
Anthropic estimates that from May to July 2026, the volume of distillation attacks attributed to Moonshot exceeded 23 million exchanges.
DeepSeek Employed Similar Tactics
In the same report, Anthropic indicated that DeepSeek used similar methods. The company also redirected its clients' queries to Claude without their knowledge and built its own CoT extraction pipeline, employing the same session replay technique.
A particular feature of DeepSeek's scheme was that redirection targeted queries from users attempting to access DeepSeek models through third-party tools or Anthropic's developer products—including Claude Code, Claude Agent SDK, and OpenCode. Specifically flagged users received responses directly from the Claude Opus model.
Over 14 days in July 2026, the scale of distillation attacks attributed to DeepSeek amounted to more than 12.1 million exchanges.
Anthropic's View on Client Risks
Anthropic noted that the redirected queries contained personal information about the clients of both companies. It remains unknown whether Moonshot and DeepSeek informed their users that their requests were actually processed by Anthropic's models.
The report describes two separate but methodologically similar schemes: both companies covertly redirected user queries to Claude and built infrastructure to extract chains of thought for the purpose of training their own models. The combined scale of recorded exchanges for both companies exceeds 35 million.
To bypass restrictions on access to full reasoning transcripts, both companies used the identical attack technique—session replay—indicating possible coordination of approaches or the use of shared model distillation methods.
AI Commentary
A similar case has already been recorded on this platform: in February 2026, Anthropic had already accused DeepSeek, Moonshot, and MiniMax of unauthorized use of Claude to train their own models—at that time, it involved 16 million interactions through 24,000 fake accounts. Six months later, the scale more than doubled to 35 million exchanges, indicating the ineffectiveness of the technical barriers previously applied.
The situation demonstrates an interesting side effect of such schemes: users in the same report mentioned that when asked about its own identity, Claude sometimes identified itself as DeepSeek or ChatGPT—likely a consequence of training on mixed data from different models. Technically, the boundary between "original" and "distillate" blurs faster than legal and contractual mechanisms can define it. Is the industry capable of developing a verifiable standard for the provenance of model responses before this problem becomes systemic?
