Anthropic says Moonshot and DeepSeek relayed live customer prompts to Claude — the distillation is the headline, the undisclosed subprocessor is your problem

The theft is the story everyone wrote. It is not the story you can act on.

Two hundred million exchanges is an arresting number, and it did what arresting numbers do: it took the whole news cycle. Anthropic accusing Alibaba, DeepSeek and Moonshot of industrial-scale extraction of Claude’s reasoning is a geopolitical story, a trade-policy story and an intellectual-property story. It is not, for almost anyone reading this, a purchasing story. Whether Qwen 3.8 Max learned to reason partly from Claude transcripts changes nothing about what Qwen costs you on Tuesday.

Buried in the same section is a finding of an entirely different kind. Anthropic says that Moonshot routed some Kimi user requests to Claude without informing those customers, and displayed Claude’s responses as if they were Kimi’s own. It says DeepSeek did something structurally similar — silently relaying exchanges to Claude without notifying its customers. Press accounts of the Moonshot relay describe roughly 300,000 customer requests over a ten-day window, spread across about 5,000 accounts, aimed primarily at Claude Opus.

Read that as a buyer rather than as a spectator. A company paid a vendor for a hosted model. The vendor, on this account, forwarded some of that company’s prompts to a different vendor in a different jurisdiction, kept the responses as training material, and returned them under its own brand. Nobody told the customer. Nobody could have, because the customer would have said no.

Why an undisclosed relay is a compliance event and distillation is not

Distillation is a dispute between Anthropic and the labs. You are not a party to it.

Relaying is a fact about your data path, and European and UK data protection law is unambiguous about who carries it. When you use a hosted model API for business data, you are typically the controller and the vendor is the processor. A processor may not engage another processor without your authorisation, and the subprocessors have to be named. Anthropic’s own characterisation is that the conduct is likely inconsistent with privacy laws and the labs’ own terms of service — which, if it holds, means the vendor breached its contract with you.

That does not transfer the regulatory exposure to the vendor. Under GDPR Article 28 and Article 30, the obligation to know where your data goes, to record it, and to have authorised it, is the controller’s. The supervisory authority writes to the controller. This desk made the same point when Article 50 of the EU AI Act became applicable in August: the obligations land on deployers, and “the vendor did not tell us” is an explanation, not a defence.

There is a second, sharper edge on the Moonshot allegation. Anthropic states that one relayed request it assessed as coming from a user affiliated with the People’s Liberation Army asked Claude to analyse CCTV surveillance footage from hundreds of cameras in Chengdu. Set aside the geopolitics. The mechanism is what matters: if the relay was indiscriminate, then the set of things forwarded to a third party was decided by whoever was typing, not by any policy either vendor had published.

What the report says, with the numbers attached

Anthropic’s response was to ban the associated accounts, strengthen classifiers and safeguards, and share indicators with industry partners and authorities. Worth noting for anyone tracking model tiers: the report says the misuse it observed ran on Haiku, Sonnet and Opus, with no Fable- or Mythos-class misuse except a single distillation case.

The rest of the report is not filler, and one finding belongs in your security review even if the distillation section does not. Anthropic describes an actor that compromised an AI vendor’s evaluation sandbox, extracted production credentials, and then used the same pattern against roughly thirty AI companies in about four days. Its framing is that stolen model API keys now serve three purposes at once — resale value, free compute to run the next attack, and attribution cover, because the traffic looks like yours. That is the same failure surface this desk flagged when an agent swarm reached data it should not have: the credential is the perimeter, and agent integrations hand it out casually.

The line that is now a procurement line item

The useful distinction coming out of this report is one the coverage keeps blurring: weights you run versus endpoints you call.

Open weights are untouched by the relay finding. If you pull Kimi K3 or a DeepSeek release and serve it on your own hardware, or through an inference provider whose subprocessor list you have read, there is no vendor in the request path with the opportunity to forward anything. That distinction is doing real work this week: Cognition launched SWE-2, post-trained on Kimi K3, on the same day this report named Moonshot — and because Cognition serves those weights itself, Devin’s data path is not implicated by anything here. What the buyer inherits there is a provenance and indemnity question, not a privacy one. The economics that made the open-weight price floor real are unchanged by a threat report. The residual question on self-hosted weights is provenance and indemnity — if a model’s reasoning was distilled in breach of another vendor’s terms, the commercial user inherits a dispute and an indemnity gap. That is worth a clause in your next renewal, not a migration.

Hosted first-party endpoints are where the exposure is, and the exposure is specifically that the request path may not match the documentation. This is the same structural hazard, in a new costume, that the site has now covered from several directions in a fortnight. DeepSeek’s own routing changes made capability downgrade a function of time of day. CISA’s distillation advisory described degraded models served with enough variation that evaluation cannot detect the substitution. Sakana’s Fugu orchestrator states outright that its routing is undisclosed by design. In every case the buyer’s evaluation harness cannot see the thing that changed. A silent relay to a competitor’s model is the most extreme version of that: your benchmark suite would have scored Claude and written down Kimi.

What this does not establish

The report is vendor-authored, and the limits are real rather than rhetorical.

Anthropic has telemetry on its own API, which is genuine evidence. It has not published account data, prompts, network indicators or enforcement records, so nobody outside the company can reproduce the attribution from a cluster of fraudulent accounts to a named corporate parent. Anthropic competes commercially with every lab it names. Alibaba, DeepSeek, Moonshot and MiniMax did not respond to requests for comment, and China’s Foreign Ministry said it was unaware of the report and opposes what it called distortion of facts and smears against the country. No substantive denial of the specific relay claim has been offered.

That combination — credible mechanism, serious allegation, no independent verification, no denial — does not support a ban. It supports a question. The question is cheap to ask and the answer is worth having in writing regardless of what this report turns out to be.

What to do with this

1. Send the routing question, in writing, to every hosted model vendor you use. Does any request ever leave your infrastructure for a third-party model? Which subprocessors are named in our contract? A clear written answer converts a rumour into a document you can rely on; a vague one is itself informative.
2. If you used first-party Kimi or DeepSeek hosted products for confidential work between roughly May and August 2026, record it as a potential undisclosed-subprocessor event in your Article 30 records now. Reconstructing that timeline under a regulator’s deadline is far more expensive than logging it today.
3. Rotate and scope your model API keys, and set expiries. The report’s clearest operational finding is that AI credentials are now a primary target with three separate resale values. Short-lived, narrowly scoped keys reduce all three.
4. Split hosted-endpoint risk from self-hosted-weight risk in your register. They are different exposures. Merging them leads either to banning cheap capacity you could safely run yourself, or to waving through a live data path because “we already approved that model”.
5. Price the controls into the comparison. If a hosted Chinese endpoint won on price alone, the gap narrows by whatever the monitoring, contractual and record-keeping overhead now costs. If it won on capability per dollar, self-hosting the weights preserves the win without the request-path question.
6. Do not treat vendor threat reports as neutral, or as noise. Read them the way you read a competitor’s security whitepaper: the mechanism is usually real, the attribution is usually a judgement, and the recommendations are usually sound for reasons unrelated to who is accused.

For the broader picture, the DeepSeek review and Qwen review track the hosted products named here, the Claude review covers the models on the receiving end, and best AI chatbots is where these vendors compete on the consumer side that the relay allegation most directly touches.

Questions or corrections? Email Pick Right. Want the full list? See all news.