Claude misused (7/7) : The cheap model you used may have been Claude

Picture a restaurant that takes your order, quietly buys the dish from the better place next door, serves it on its own plate, and keeps a portion back to work out the recipe. That’s roughly what Anthropic says happened to some people who thought they were using Kimi or DeepSeek.

This is the last of seven parts on Anthropic’s September threat report, and part six was the dating apps. This section is about distillation, which just means training a cheaper model on a better model’s answers. It isn’t shady when a lab does it with its own models. Anthropic’s complaint is about labs doing it to Claude at industrial scale through thousands of fake accounts, and it names seven of them, all based in China.

Everything below is Anthropic’s account. It competes with the companies it’s naming, the numbers haven’t been audited by anyone outside, and when Reuters asked Alibaba, Moonshot, DeepSeek and Xiaomi about it, they didn’t immediately respond. So I’m treating what follows as one side’s evidence, though it’s detailed evidence.

If the answer came from Claude, then your question went to Claude too.

The first is the biggest. Operators Anthropic ties to Alibaba ran what it calls the largest distillation attack it has ever measured, more than 151 million exchanges between May and July 2026, peaking at nearly 3 million a day. Each request carried a fixed instruction forcing Claude to write out its step-by-step reasoning, which was saved and turned into training data for the Qwen models. Banning didn’t end it. When Anthropic shut one pool of nearly 5,000 fake accounts, the traffic moved to a second pool.

The second served Claude under its own name. Anthropic says Moonshot AI, the company behind the Kimi models, “silently forwarded customer requests to Claude” and showed users the result as though Kimi had written it. In one ten-day stretch that came to almost 300,000 requests, sent through 5,380 fake accounts, most of which appeared to be located in Singapore and Japan. I’m in Singapore, so that line didn’t slide past me. The exchanges were saved for training. And because those requests landed at Anthropic, Anthropic could see what was in them, including a user it assesses as likely affiliated with the Chinese military asking “Kimi” to analyse CCTV footage of one tracked person from hundreds of cameras in Chengdu.

The third chose whose requests to send. DeepSeek, according to the report, checked incoming requests for signs that the user was working through a coding tool such as Claude Code or OpenCode, tagged those users, and relayed some of their requests to Claude’s Opus model. What got relayed included a Chinese tech company’s internal plans for a flagship AI programme, live credentials for a database at a Russian government agency tied to its defence ministry, and work on a police case-management tool that matches people’s movements against records using their national ID numbers. As far as Anthropic can tell, those users weren’t told their work was leaving DeepSeek.

The Batch, DeepLearning.AI’s newsletter, drew the line where I would. Whether distillation between rivals is fair play “is a subject of debate,” it wrote. “But routing customer input to a third party without their knowledge and presenting the output as one’s own could be called fraud.”

There’s an uncomfortable footnote for Anthropic in its own evidence. To show that sensitive data was exposed, the report prints some of it, lightly redacted: a pharmaceutical company’s building budgets for sites in Ho Chi Minh City, Kuala Lumpur and Bangkok, and a developer pasting live bot tokens into a chat to debug a notification script. Those people didn’t choose to send anything to Anthropic either, and Anthropic has now read it too.

The mechanics of how these labs got in matter less than the incentive, which doesn’t go away with a ban. A fourth lab, Xiaomi, is described as replaying its own users’ coding sessions through Claude, and the report suggests it may have run an extended free trial in order to pull in the developer traffic it wanted. When a capable model is suddenly free or oddly cheap, somebody is paying for it, and in these cases Anthropic says it was the users, with their prompts.

So assume any model you reach through a cheap router or a generous free trial can read what you send and might pass it on. Don’t paste credentials into any chat, and if you already have, rotate them today. Don’t put company documents through a provider whose terms you haven’t read or who won’t say where the data goes. And if you’ve been running a coding agent against a bargain endpoint, go and look at what was in the repo it had access to.

The distillation section is here, and TechCrunch has a shorter version. That’s all seven sections, and the full report has plenty I left out.