The competitive moat in AI isn't the model weights — it's whether your users know what model they're actually talking to.
The Summary
- Anthropic caught five Chinese AI labs running nearly 190 million distillation attacks on Claude between May and July, with Moonshot AI and DeepSeek secretly routing live user requests to Claude instead of their own models
- Moonshot alone rerouted 23 million user queries to Claude while branding the responses as their own Kimi chatbot outputs
- Some rerouted requests exposed sensitive Chinese and Russian government data, including PLA CCTV footage and Russian military contractor database information
- Anthropic is now building stronger guardrails, but the real story is what happens when your product is just a reskinned API call to someone else's frontier model
The Signal
Distillation attacks are standard practice in AI development. You query a better model, capture its outputs, and use that data to train your own. What Anthropic documented goes further. Moonshot AI and DeepSeek weren't just learning from Claude. They were literally routing their users' live requests through Claude's API and returning the responses as if their own models generated them.
Think about that architecture. A Chinese user opens Kimi, Moonshot's chatbot. Types a question. That question gets sent to Claude's servers in the US. Claude processes it. The response comes back. Moonshot's interface displays it with Kimi branding. The user has no idea they just talked to an American AI model that their government has been trying to block access to.
"DeepSeek and Moonshot AI fed their users' requests into Claude rather than their own models."
Moonshot rerouted 23 million queries to Claude between May and July. DeepSeek did 12.1 million in just 14 days in July. That's not a research project. That's production infrastructure. These weren't developer experiments. These were companies serving paying customers with hardware they didn't own and models they didn't build.
The data leakage problem is almost darkly funny. Some of those rerouted requests contained CCTV footage from a PLA-affiliated user and information on a Russian government database submitted by a military contractor. Chinese users thought they were using a domestic AI that keeps data in-country. Instead, their sensitive queries were being shipped to San Francisco for processing.
Key players involved:
- Moonshot AI: 23M rerouted queries
- DeepSeek: 12.1M rerouted queries in 14 days
- Alibaba, Zhipu, Xiaomi: also flagged for distillation attacks
Alibaba ran the largest single attack, though details on scale weren't disclosed. The pattern across all five labs suggests this wasn't isolated behavior. It was an industry-wide shortcut.
This isn't just about China. It reveals how thin the actual capabilities are beneath a lot of branded AI products. If your go-to-market strategy is "wrap Claude in a new UI and hope no one notices," you don't have a model. You have a front-end and a billing relationship with Anthropic. The problem is that strategy works until someone checks the headers.
The Implication
Anthropic says it's adding guardrails. Good luck. The technical challenge is detecting when queries are coming from a competitor's production system versus legitimate API use. The business challenge is that blocking these labs means losing revenue from what were probably some very high-volume API customers.
For users, the lesson is simpler. When an AI company promises data sovereignty or local processing, ask where the inference actually happens. If a Chinese startup with 50 engineers is claiming GPT-4 level performance six months after founding, check the network traffic. You might be talking to OpenAI without knowing it. In the agent economy, the question isn't just who built your tool. It's who's running the compute when you hit enter.