Anthropic Alleges Moonshot Routed 300,000 Kimi Requests Through Claude

Anthropic’s September 2026 threat-intelligence report alleges that Moonshot AI covertly sent requests submitted to its Kimi service to Claude, returned the answers as Kimi outputs, and collected those outputs as part of a broader effort to extract frontier-model capabilities. The company describes this as illicit distillation—not routine use of a third-party AI service. The allegations have not been publicly adjudicated. 15

What Anthropic says Moonshot did

Anthropic says it identified one Moonshot-linked operation involving nearly 300,000 customer requests sent primarily to Claude Opus. It attributed the traffic to 5,380 fraudulent accounts, which it says largely appeared to be located in Singapore and Japan. In Anthropic’s account, Kimi users were not told their requests were being processed by Claude rather than Moonshot’s own model. 15

The company says the operators disproportionately targeted Claude Opus and began querying newly released, generally available Claude models within 24 hours of release. Anthropic interprets that timing as evidence that the aim was to capture new capabilities quickly. 15

Why Anthropic calls it “distillation”

Distillation is a legitimate machine-learning technique in some settings: a developer can train a smaller model from the outputs of a model it controls or has permission to use. Anthropic’s allegation is that this case was different because the activity allegedly used fraudulent accounts, proxies, and access that violated its terms and regional restrictions. 1315

Anthropic says a competing model can be improved by gathering a large, varied set of responses from a more capable model, particularly on tasks such as reasoning, coding, and tool use. Its suspicion is that Claude-generated outputs were being used to improve Kimi. That is an attribution and assessment by Anthropic, rather than an independently established finding. 15

How this fits the earlier 16 million-exchange disclosure

The September report is a more detailed case within a pattern Anthropic had disclosed in February 2026. In that earlier disclosure, Anthropic alleged that DeepSeek, Moonshot, and MiniMax generated more than 16 million Claude exchanges through about 24,000 fraudulent accounts in order to improve their own models. 13

The roughly 300,000-request Moonshot figure should therefore not be treated as a replacement for the 16 million total. It describes a specific alleged routing operation, while the February figure covered activity attributed collectively to three labs. 1315

Anthropic’s September report says it also identified and disrupted additional distillation attacks against Claude from seven China-based labs after the February disclosure. It says those efforts targeted generally available models, not models unavailable to the public. 15

Broader U.S. government allegations

Separate from Anthropic’s own reporting, U.S. agencies said in a September advisory that six China-based AI companies—DeepSeek, Moonshot, Alibaba, MiniMax, StepFun, and Z.AI—had extracted billions of tokens from U.S. frontier models through millions of requests. The advisory characterized the alleged activity as industrial-scale distillation and said it involved models from Anthropic, OpenAI, Google, and xAI. 33

That government allegation is broader than the Moonshot case and broader than Claude alone. It also remains an allegation rather than a public legal or technical adjudication. 33

Anthropic’s response—and the defenses it recommends

Anthropic says it disrupted the identified activity, banned associated accounts, and built detections around the operation’s behavioral signatures in anticipation that new accounts could be created. 15

Its recommended approach is layered rather than dependent on one account ban:

• Behavioral detection: identify unusually high-volume, repetitive, or capability-focused request patterns.
• Account and infrastructure correlation: connect signals across accounts, payment methods, IP addresses, proxies, and request metadata.
• Friction and enforcement: verify or limit suspicious access and make rapid account replacement harder.
• Launch monitoring: watch closely when newly released models become available, when extraction efforts may shift quickly.
• Information sharing: share indicators among AI providers and relevant authorities, since proxy networks can move activity between services. 1315

The central point of Anthropic’s report is not that all model distillation is improper. It is that, in the company’s view, high-volume extraction using allegedly fraudulent identities and undisclosed routing can let a competitor reproduce valuable capabilities while bypassing the provider’s access rules and safeguards. 1315