Some Kimi and DeepSeek Users Were Served Claude Instead, Anthropic Says: Inside Anthropic's accounts of distillation, gray-market transfer stations, straw accounts, and user fraud

Anthropic accused seven Chinese AI developers, including Moonshot AI, Alibaba, and DeepSeek, of misusing its Claude models to mislead their customers and improve their own models.

What’s new: In a lengthy report, Anthropic alleged that the China-based companies presented Claude’s responses to their customers’ queries as their own models’ responses, and distilled Claude’s responses into their models. The report details several ways in which these companies violated Claude’s terms of services between February and August 2026. The violations included gaining access to Claude through gray markets outside China and using it in scams, espionage, and designing biological or autonomous weapons. 

How it works: Anthropic’s allegations focus on distillation, a technique in which a teacher model generates responses to queries that are used to train a student model. Anthropic acknowledges that distillation is a legitimate training method, but the company objects to large-scale efforts to extract Claude’s reasoning capabilities – which it says the companies are doing via fraudulent methods – and recreating it in another model at a fraction of the cost and computation power. Anthropic calls this “illicit” distillation.

• Claude is blocked in mainland China. Anthropic said the companies used transfer stations to bypass geographic restrictions. Several used false identities to create accounts, entered fake or stolen credit-card numbers, and used stolen API keys, according to Anthropic.
• Alibaba, DeepSeek, Moonshot AI, Xiaomi, and Ziphu (also known as Z.ai) ran distillation campaigns that aimed to extract Claude’s reasoning transcripts via hundreds or thousands of fraudulent accounts, According to Anthropic.
• Between May and June 2026, Alibaba ran the largest distillation effort Anthropic had identified to date, involving 151 million exchanges. Alibaba accessed Claude through 5,000 fraudulent accounts, Anthropic said.
• Zhipu created cybersecurity challenges and used leading U.S. AI models to solve and evaluate them, with the goal of incorporating those capabilities into its own models, Anthropic alleged. Zhipu initially targeted Anthropic’s Fable model, but abandoned the effort after Fable’s stronger cyber safeguards limited the usefulness of the responses, according to the report. Zhipu then switched to Opus 4.6 and another U.S. frontier model specifically because their safeguards appeared to be weaker.
• DeepSeek, Moonshot AI, and others allegedly diverted their own customers’ queries to Claude and presented its output as that of the other models. Anthropic documented several instances in which sensitive information was submitted to Claude in this way. Among the users, Anthropic said, it identified a member of the People’s Liberation Army, an employee of a Chinese state-owned enterprise, and an agent of a Russian defense agency.

Behind the news: Distillation has come under scrutiny by leading U.S. AI developers and policymakers, many of whom wish to protect proprietary American technology.

• Anthropic accused DeepSeek, Moonshot, and MiniMax of “industrial-scale” distillation efforts earlier this year.
• In April, Michael Kratsios of the White House Office of Science and Technology issued a memo that acknowledged wide-scale distillation as an adversarial threat and said the U.S. would build defensive strategies.
• In July, Kratsios posted on the X social network that Moonshot AI had distilled Anthropic’s Claude Fable in developing its own Kimi K3. He called such large-scale distillation efforts “unacceptable attempts to steal U.S. technology.” 

Why it matters: The legitimacy of distillation as a way to build models that are intended to compete with the very models being distilled is a subject of debate. But routing customer input to a third party without their knowledge and presenting the output as one’s own could be called fraud. Such practices erode public confidence in AI companies’ commitment to information privacy and security, and they undermine trust in the AI industry as a whole.

We’re thinking: You can’t distill your way to a frontier model. While distillation can be helpful for training models, the labs that Anthropic is accusing have achieved significant technical breakthroughs, many of them published openly, that were critical to their competitive models. The claims that these companies are distilling U.S. models has created a mistaken impression that their competitive strength stems solely from distillation, when their technical innovations have been a more important factor.