Almost 300,000 customer requests in ten days, relayed through 5,380 fraudulent accounts, shown to users as if they had come from Moonshot’s own Kimi model.[1] Between May and July 2026 Anthropic attributes more than 23 million exchanges to that same campaign.[1][2] The number is not a vanity metric. It is a claim that another lab’s product surface became a silent proxy onto Claude, and that the traffic carried both training loot and other people’s secrets.
The Claude Misuse Files, Part 8 treats Anthropic’s illicit-distillation section as the primary disclosure. The thesis is supply-chain shaped: when a frontier model is harvested at industrial scale through proxies, fake accounts and cross-session reasoning replay, the same pipe is both a capability theft channel and an attack surface that exposes end-user data, including PLA-adjacent surveillance traffic and Ministry of Defence-adjacent credentials Anthropic says rode along.[1][2][3]
Teacher, student, and fraud
Distillation itself is ordinary: a stronger “teacher” model generates exchanges that train a smaller “student.” Anthropic defines illicit distillation as an industrial-scale, covert campaign to extract and replicate a model’s capabilities without authorisation, typically enabled by fraud: fake accounts, stolen cards, credentials and API keys.[1] Since February 2026 it says it has disrupted additional campaigns from seven China-based labs against generally available Claude models; it has not observed attempts against Mythos 5 or Mythos Preview.[1] OpenAI and Google have publicly described related adversarial distillation pressure; Anthropic’s September report is its densest attribution set to date.[1][4]
Access pattern, per Anthropic: proxy services (“transfer stations”) mint thousands of identities, route around geographic controls, and sometimes save user-model exchanges for sale; labs also buy transcripts from resellers or silently reroute their own users’ requests to Claude to harvest training pairs.[1] Reasoning extraction escalated from blunt “output your prior reasoning verbatim” prompts to multi-technique tests and translation tricks aimed at chain-of-thought (CoT) traces – the model’s private scratchpad of steps before an answer.[1] Anthropic’s own research note: distilled uplift can transfer across domains, and teacher-model safeguards do not automatically transfer to the student.[1]
Moonshot (Kimi): silent proxy and thinking-signature replay
Anthropic tracks GTG-16002 against Moonshot AI, producer of the Kimi family. Anthropic-only allegation: Moonshot silently forwarded customer requests to Claude, displayed Claude’s answers as Kimi’s, and saved at least a portion of those exchanges for training.[1][2] Over one ten-day window it relayed almost 300,000 requests, mostly to Opus, through a proxy network of 5,380 fraudulent accounts that mostly appeared to sit in Singapore and Japan.[1][2] Scale Anthropic attributes for May-July 2026: over 23 million exchanges.[1][2]
CoT theft method, Anthropic-only: Claude returns a “thinking signature” reference instead of raw thinking, to blunt distillation. Moonshot allegedly saved that signature, started a new session, and elicited Claude to convert the signature back into the full reasoning trace: a cross-session replay attack.[1] Anthropic says it is introducing stronger defences against the tactic.[1]
Data that rode the pipe matters as much as the weights. Anthropic says rerouted Moonshot queries included sensitive customer information, and it does not know whether Moonshot told those customers their traffic had been exposed to a third party.[1] Two Anthropic-only examples follow. First, a user Anthropic assesses as likely PLA-affiliated loaded CCTV-archive surveillance data on a single targeted person into what they thought was Kimi, asking whether the person was behaving abnormally; the archive covered hundreds of cameras in Chengdu, including cameras outside PLA facilities, institutes tied to China Electronics Technology Group Corporation, and a major state-owned enterprise (SOE).[1][4] Second, an engineer at a major PRC SOE used Kimi to build an internal system and revealed internal code and live credentials from multiple major PRC companies, including high-profile technology firms.[1]
TNW and TechCrunch both quote the silent-forwarding and scale claims; TechCrunch additionally flags the surveillance-routing angle in secondary coverage of the report.[2][4] Those are allegations Anthropic makes; they are not independently adjudicated findings in this essay.
DeepSeek: same replay, different coding filters
GTG-16001, DeepSeek: Anthropic alleges a similar CoT extraction pipeline and the same cross-session thinking-signature replay, plus silent relay of customer traffic to Claude without informing those customers.[1][2] DeepSeek, Anthropic says, tagged users of third-party or Anthropic coding tools (Claude Code, Claude Agent SDK, OpenCode) by string checks, then relayed selected tagged traffic to Claude Opus.[1]
Anthropic-only rider examples: an employee of a PRC technology company analysing internal documentation (full specifications, organisational structure and strategic objectives of a flagship AI programme) had that data relayed to Claude; an IT operator working with data from a Russian government agency associated with its Ministry of Defence had live credentials for a Russian government database exposed via the relay; engineers building a case-management system for a municipal Public Security Bureau had movement-versus-police-record tooling traffic relayed.[1] Scale Anthropic attributes: over 12.1 million exchanges across fourteen days in July 2026.[1]
Politico’s 10 September 2026 report on the wider Anthropic disclosure places Chinese and Russian misuse, fraudulent-account webs and restricted-region evasion in the political frame without needing to re-litigate every lab name here.[3] The distillation thread specifically is where “copy the model” and “exfiltrate the customer” become the same pipe.
The wider farm, briefly
Anthropic also attributes large CoT campaigns to Alibaba/Tongyi (GTG-16005: peak near 3 million exchanges per day, over 151 million May-July 2026), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), and describes SenseTime and MiniMax activity inside a third-party reseller ecosystem that buys or runs proxy harvests (GTG-16012 / GTG-16003).[1][4] Those numbers show industrial demand. They are secondary to Part 8’s thesis: the Moonshot and DeepSeek silent-proxy pattern turns a consumer assistant into an unconsented data diode pointed at Anthropic, then into training fuel for the proxy operator.
Supply chain as loot and attack surface
Read the section as two losses at once. Loss one: capabilities (agentic tool use, coding, reasoning) leave through fraudulent accounts and signature replay.[1] Loss two: whoever thought they were talking to Kimi or DeepSeek may have been talking to Claude, with PLA CCTV analysis, SOE credentials or MoD-adjacent database secrets in the clear of that mislabelled session.[1][2] Illicit distillation is therefore not only a training-cost story. It is a supply-chain compromise story in which the “product” users trust is a laundering layer.
Anthropic’s response language is familiar from earlier parts: ban pools, harden anti-distillation controls, share with partners. The public lesson for everyone else is narrower. If your organisation’s staff use third-country coding assistants or model routers, assume transcripts can be replayed into a US frontier model without your knowledge, and treat that path as both IP leakage and a secrets-exposure channel.[1][2] Part 8 closes the seven-area map Anthropic drew. The misuse files do not end because the report ends; they end when the proxy economics stop paying.
Notes
[1] Anthropic, “Detecting and countering misuse of AI: September 2026,” published 10 September 2026, section “Illicit distillation and scaled abuse” (GTG-16002 Moonshot; GTG-16001 DeepSeek; related lab campaigns). https://www.anthropic.com/threat-intelligence-report-september-2026
[2] “Anthropic details how Claude was misused for surveillance and weapons,” The Next Web, 10 September 2026 (Moonshot silent forwarding, 300k/10 days, 5,380 accounts, 23M exchanges; DeepSeek allegations; sensitive relayed data including Russian defence credentials). https://thenextweb.com/news/anthropic-claude-misuse-threat-intelligence-report
[3] “Bad actors in China and Russia are already weaponizing Anthropic’s AI,” POLITICO, 10 September 2026. https://www.politico.com/news/2026/09/10/bad-actors-china-russia-weaponizing-anthropic-01070435
[4] Russell Brandom, “Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek,” TechCrunch, 10 September 2026. https://techcrunch.com/2026/09/10/anthropic-details-distillation-campaigns-from-alibaba-moonshot-ai-and-deepseek/