DeepSeek and Moonshot Routed Customer Data Through Claude While Stealing Its Reasoning

A threat intelligence report from Anthropic shows Chinese AI labs DeepSeek and Moonshot secretly relayed hundreds of thousands of customer prompts, including PLA surveillance data and Russian defense credentials, through Claude while harvesting its reasoning traces to train their own models.

What the report actually says

I’ve spent some time going through Anthropic’s Threat Intelligence report, and it’s one of the more unsettling disclosures I’ve read this year. It documents how seven Chinese AI labs ran coordinated campaigns to extract Claude’s reasoning capability while, in the process, exposing their own customers’ most sensitive data to infrastructure those customers never agreed to use. The operations ran from December 2025 through August 2026.

The two clearest cases involve DeepSeek and Moonshot, the company behind the Kimi chatbot. Both were caught quietly forwarding customer prompts to Claude Opus through networks of fraudulent accounts, then storing the exchanges to train their own competing models. Users, including software engineers, military analysts, and government IT staff, believed they were talking to domestic Chinese systems under local data sovereignty rules. Instead, every query and every credential they typed was being sent to servers controlled by a US company, logged, and processed by a model they never chose.

The volume is hard to process at a glance. Moonshot relayed roughly 300,000 customer requests to Anthropic in a single ten-day window, using a proxy network of 5,380 fraudulent accounts spread across Singapore and Japan to get around regional access controls. DeepSeek’s operation, tracked internally by Anthropic as GTG-16001, processed more than 12.1 million exchanges in fourteen days during July 2026. Moonshot’s total between May and July exceeded 23 million exchanges. DeepSeek’s cumulative activity over its operational window reached a similar scale.

How the chain-of-thought theft worked

To understand why this matters, you need to understand what was actually being stolen. Claude Opus doesn’t just generate an answer. It works through a multi-step reasoning process, Chain-of-Thought (CoT), before producing a final response. That internal reasoning trace, the deductions, hypothesis testing, and iterative refinement happening before the answer appears, is arguably the most valuable part of a frontier model. It’s what separates a model that can recite facts from one that can work through a genuinely novel engineering problem.

Anthropic had built a specific safeguard against this. When Claude reasons internally, the API doesn’t return the raw thinking trace to the caller. Instead it returns a “thinking signature,” a cryptographic reference the API can use to look up the trace in later calls within the same session. The whole point was to stop outside parties from scraping that reasoning data.

Moonshot found a way around it that Anthropic now calls a Cross-Session Replay Attack. When Moonshot’s infrastructure got a response from Claude containing a thinking signature, its pipeline saved that signature, then opened a brand-new API session with no prior context and fed the captured signature back to Claude alongside a prompt engineered to make the model expand it into the full, verbatim reasoning text. Treating a cryptographic reference as something that could be replayed across session boundaries let Moonshot bypass the anti-distillation control entirely.

DeepSeek ran the same pipeline. That’s the detail that stands out to me: this wasn’t one engineer’s clever hack, it was a shared technique that had already spread across multiple Chinese labs. Both companies used the extracted CoT transcripts to fine-tune and run reinforcement learning on their own models, effectively using Claude’s own reasoning as free training curriculum for a competing product.

DeepSeek’s coding-harness trap

Moonshot’s operation was broad. DeepSeek’s was more targeted, and specifically aimed at developers. Its infrastructure inspected the strings in inbound API requests, looking for signatures tied to coding environments and agentic frameworks. The report names Claude Code, the Claude Agent SDK, and OpenCode as the harnesses DeepSeek’s detection systems watched for.

When the routing layer spotted a user working inside one of those environments, meaning they were likely deep into kernel development, system architecture, or agentic workflow design, the system tagged that session. Selected tagged sessions were then silently relayed to Claude Opus instead of being handled by DeepSeek’s own models. That’s a deliberate choice to go after the highest-value reasoning traces: the ones generated during the hardest coding tasks, where Claude’s agentic ability shows the most.

In practice, this created a tiered system. Ordinary queries might stay on DeepSeek’s own infrastructure. High-value developer traffic, exactly the kind of data most useful for training a next-generation coding assistant, went to Claude Opus instead, with the responses shown to the user as if DeepSeek had generated them.

The part that worries me more than the IP theft

The distillation is bad enough on its own, but the data exposure it caused is worse. Because DeepSeek and Moonshot proxied traffic without telling anyone, any sensitive information a user typed into either platform ended up on Anthropic’s servers. The report documents several cases with real geopolitical weight.

PLA surveillance analytics. A user Anthropic assessed as affiliated with the People’s Liberation Army used what they believed was Kimi to analyze CCTV footage tracking a specific individual across hundreds of camera feeds in Chengdu, a city that houses PLA facilities, institutes tied to the China Electronics Technology Group Corporation, and major state-owned enterprises. The goal was to flag abnormal behavior in the tracked person. Because Moonshot routed the request to Claude, the scope of that surveillance operation and its behavioral classification methodology ended up on US infrastructure.

Russian defense credentials. An IT operator working with a Russian government agency tied to the Ministry of Defense used DeepSeek’s coding assistant to troubleshoot a database issue. DeepSeek’s routing layer forwarded the prompt, plaintext included, to Claude. That prompt contained live authentication credentials for a Russian defense network. Neither the operator nor the agency had any way to know those credentials had just left the country.

Domestic surveillance architecture. Engineers building a case management system for a Chinese municipal Public Security Bureau used DeepSeek to build a tool comparing a person’s movements against police records using national ID numbers. The schema, matching logic, and cross-referencing algorithms behind that domestic surveillance system were relayed to Claude.

Corporate data. An employee at a major PRC tech company used what they thought was DeepSeek to review internal documentation for a flagship AI program. DeepSeek sent that data to Claude, exposing the program’s specifications, org structure, and strategic goals. The company was almost certainly never told. Separately, an engineer at a state-owned enterprise used Kimi to build an internal system and inadvertently exposed internal code and live credentials belonging to several major PRC companies.

Seven labs, one underground network

DeepSeek and Moonshot are the most dramatic cases because they routed customer traffic directly, but the report describes a wider pattern. Since February 2026, Anthropic says it has detected and disrupted distillation campaigns it attributes with high confidence to seven PRC-based labs: Alibaba (Qwen/Tongyi Lab), Moonshot, DeepSeek, Zhipu (Z.ai), Xiaomi, SenseTime, and MiniMax.

Alibaba ran the largest operation by raw volume, tracked as GTG-16005, peaking at nearly three million exchanges a day from more than 3,500 fraudulent accounts. Its pipeline injected a fixed prompt forcing Claude to write its reasoning into inline text tags before answering, then converted those transcripts into fine-tuning data for Qwen 3.5, 3.6, and 3.7. Alibaba’s distillation activity between May and July 2026 topped 151 million exchanges. It also used Claude to build internal RL environments and inform its own model architecture research.

Zhipu (Z.ai) replayed captured Claude reasoning traces back through the model to clean them up for training its GLM series. Anthropic counted 770,609 exchanges through Zhipu’s extraction pipeline over ten days in June, and more than 3 million over seventeen days. Ahead of releasing GLM 5.3, Zhipu ran a targeted campaign against the cyber capabilities of leading US frontier models, building capture-the-flag challenges from public vulnerability data and distilling solutions from those models. Zhipu tried this against Fable first, but backed off once Fable’s cyber safeguards degraded the attack, then switched to Opus 4.6 and a model from another US lab, judging their safeguards to be weaker.

Xiaomi, tracked as GTG-16008, launched its MiMo-V2-Pro model with a free trial that was later extended, apparently to generate a surge of international developer traffic it could replay through Claude. Xiaomi saved the full request and response history from its own users and reused those sessions to train both SFT and RL pipelines. The bulk of the distillation activity began right as the trial period was ending: over 400,000 requests across more than 1,500 accounts, via proxy services, during a twenty-day window in March and April 2026.

SenseTime and MiniMax worked the reseller angle. SenseTime’s pipeline included transcripts bought from third-party data vendors, conversations harvested from users accessing Claude through intermediaries that logged and resold them. MiniMax built its own proxy network through a shell company with no visible link to the parent org. That shell service offered access only to Anthropic and OpenAI models, none of MiniMax’s own, which suggests its sole purpose was harvesting exchanges with US frontier models for training.

The proxy economy behind all seven

All seven labs leaned on a shared underground economy of proxy services, sometimes called “transfer stations” in threat intel circles, to get around Anthropic’s geographic access restrictions. These services create thousands of accounts with false identities, stolen credit cards, and compromised API keys, often routed through residential proxies in Singapore, Japan, and other jurisdictions outside Anthropic’s restricted regions.

When Anthropic banned Alibaba’s first pool of nearly 5,000 fraudulent accounts, Alibaba simply moved to a second pool. Investigators found that same second network was simultaneously carrying traffic for DeepSeek and Xiaomi, meaning these proxy operations function as shared infrastructure serving multiple clients at once. The proxy operators often save exchanges between users and US models without anyone’s knowledge, creating a secondary market where harvested transcripts get resold to whichever lab wants training data. In many cases, the stolen API keys used to access Claude belong to legitimate companies or individuals, which means the attack traffic gets attributed to the key’s real owner instead of whoever actually ran it.

Anthropic’s defenses

Anthropic’s response is layered, and the report is upfront that no single safeguard closes this off on its own.

Preserved Thinking, introduced with Fable 5.1, stops new API accounts from editing the system prompt, tools, or prior messages that lead into Claude’s reasoning in multi-turn conversations. The reasoning itself is encrypted, but editing the preceding context used to be a common way to trick Claude into revealing its raw thought process.

Claude now summarizes its internal reasoning before responding, which makes stolen transcripts far less useful for training a competitor, since the raw CoT is no longer directly accessible even in a legitimate session.

Anthropic has also built classifiers aimed at the specific prompt patterns and behavioral signatures tied to distillation attempts. These were strengthened around the launch of Fable 5 and keep evolving as new extraction methods show up.

Rather than banning individual proxy accounts, which get replaced instantly, Anthropic uses metadata and behavioral signals to attribute suspicious activity to specific organizations, so it can take enforcement action against an entire operation at once. When systems flag potential abuse, including resale or access from unsupported countries, accounts can be required to verify identity or lose access.

What this means if you run a security or engineering org

For CISOs, government agencies, and individual developers, the takeaways are concrete.

Third-party model routers can’t be trusted by default. The report notes that many of the exchanges relayed to Claude came from people using third-party model routing services common among developers in the US and Europe, and those sessions contained names, email addresses, corporate data, and other sensitive content in at least a dozen languages. If your org uses gray-market API proxies or discount model routers, assume that traffic is being logged, sold, or fed into someone else’s training pipeline.

Treat AI API keys like production database credentials. The report shows stolen keys doing triple duty: resale value, free compute for attack workloads, and cover, since activity gets attributed to whoever the key legitimately belongs to. Rotation schedules, access logging, and anomaly detection should apply here the same way they’d apply to a database credential.

Data sovereignty claims are only as good as the routing layer behind them. Users who chose DeepSeek or Moonshot specifically because they needed data to stay inside Chinese jurisdiction had that data sent to US servers without their knowledge. Any org relying on an AI vendor without visibility into the actual routing architecture is in the same position.

A “free trial” can be a harvesting mechanism. Xiaomi’s extended trial period looks like it existed to generate international traffic it could replay for distillation. That’s worth keeping in mind before signing up for promotional access to an AI service with unclear ownership.

Why this matters geopolitically

This lands at a tense moment for AI policy. The US has tightened export controls on advanced semiconductors and AI capability, specifically to limit Chinese access to frontier model weights and training infrastructure. What this report documents is the workaround: labs that can’t legally train on the most capable US models have built an industrial-scale extraction operation to get the capability anyway.

Anthropic’s report says these practices are likely inconsistent with privacy laws and the labs’ own terms of service, but the geopolitical angle goes further than a compliance problem. PLA surveillance parameters, Russian defense credentials, and PRC police-system architecture all ended up on US infrastructure as a side effect of labs trying to steal US AI capability. The theft exposed state secrets on both sides.

Worth noting: none of the misuse cases in the report involved Fable or Mythos-class models, aside from the one Zhipu attempt against Fable’s cyber capabilities, which its strengthened safeguards blocked. That suggests Anthropic’s most capable models hold up better against extraction than the generally available Opus-class models, which sophisticated, well-funded adversaries are still able to get through.

Safety doesn’t distill with capability

The finding I keep coming back to is this: the safeguards that stop Claude from being misused don’t transfer when a model is illicitly distilled. Anthropic’s internal research found that a model trained on distilled data can help with dangerous tasks, including biological or cyber ones, even if the harvested exchanges barely touched those subjects. The general reasoning ability that makes a model good at software engineering is the same ability that makes it useful for planning an attack.

That means every successful distillation campaign doesn’t just produce a cheaper competitor. It potentially produces a less safe one. Refusal behavior and guardrails live in a model’s alignment, not in its raw reasoning traces, so a distilled model can inherit the capability without inheriting any of the restraint.

The bottom line

This report is a good reminder that the AI supply chain is a live attack surface, not just infrastructure. Seven labs, Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax, together processed hundreds of millions of exchanges through fraudulent access networks, pulling out enormous volumes of reasoning data while exposing their own customers’ most sensitive information along the way.

If you’re evaluating AI vendors, the routing layer deserves the same scrutiny you’d give a production database connection. Every proxy service and discount API endpoint is a potential exfiltration point, whether or not the vendor intends it that way.

This article will be updated as more information becomes available. If you think your organization may have been affected by these routing operations, review your AI service provider agreements, audit your API routing infrastructure, and talk to legal counsel about possible data breach notification obligations.