In a threat intelligence report released by Anthropic on September 10, it detailed how Moonshot AI secretly routed Kimi users’ requests to Claude and then returned Claude’s responses to users. Less than two days after the report was released, a chat screenshot circulated on Chinese social platforms claiming that 16 people from Moonshot AI had been taken away to assist with an investigation, including founder Yang Zhilin. On September 12, Moonshot AI issued an official statement saying the reports were “entirely fabricated and malicious rumors,” and that it had reported the matter to public security authorities.
The context of this incident is far more complex than a single rumor. From the White House allegations in July to Anthropic’s report in September, and then to online rumors, Moonshot AI faced a threefold wave of pressure from the U.S. government, AI labs, and online public opinion within just two months.
The distillation techniques revealed in Anthropic’s report
According to Anthropic’s report, Moonshot AI’s operating pattern differs from other Chinese labs’ “mass account farming,” and its methods are more covert. Moonshot AI secretly forwarded real requests from its own Kimi users to Claude, then returned Claude’s answers to the users, who had no idea throughout that they were using someone else’s model.
The report states that Moonshot AI relayed nearly 300,000 requests within 10 days, with cumulative exchanges exceeding 23 million between May and July 2026. More critically, Moonshot AI also used a “cross-session replay attack” to extract Claude’s reasoning traces for training its own models.
Anthropic also revealed one detail: in one case, a user asked Kimi to analyze surveillance data captured by hundreds of CCTV cameras in Chengdu, China, and Moonshot AI transmitted this data to Claude through a network of intermediaries. In another case, an engineer was developing software through Kimi, and Kimi sent the login credentials of several companies to Claude during the process.
Anthropic报告里这一段真的笑死我了
因为月之暗面把部分Kimi 用户请求直接转给Claude
导致解放军把几百个军工设施的监控视频扔给Kimi抓间谍
然后Kimi直接把这些监控视频发给Claude了 pic.twitter.com/HnrmeWNkVR— Lee1ng (@lilaoshizuikeai) September 11, 2026
From the July White House accusations to the September report: Timeline
The distillation controversy involving Moonshot AI did not begin in September. As early as July 22, White House technology adviser Michael Kratsios publicly stated that the U.S. government had information indicating that Moonshot AI distilled capabilities from Anthropic’s Claude Fable model to build Kimi K3. The U.S. Treasury Department simultaneously threatened to impose sanctions on Moonshot AI.
However, several independent AI researchers questioned the White House’s claims at the time. Braden Hancock of Snorkel AI point outClaude Fable was only released on July 1, and it’s impossible for K3 to reach that level in such a short time through distillation alone. “Using Anthropic’s Fable is not the reason K3 became so strong.”
The September 10 Anthropic report expands the scope of its allegations from a single “K3 distillation Fable” to systematic long-term operations spanning December 2025 to August 2026, covering seven Chinese labs and totaling nearly 200 million request exchanges. Moonshot AI was only one of them, but its practice of “forwarding user requests to competitor models” is the most controversial of all the cases.
The Spread and Denial of the Rumor That “16 People Were Taken Away”
After Anthropic’s report was released, Chinese-language social platforms quickly erupted. Starting September 10, a chat screenshot circulated on WeChat, Weibo, and other platforms, claiming that 16 people at Moonshot AI, including founder Yang Zhilin, had been taken away to assist with an investigation. The rumor directly linked Anthropic’s distillation allegations to the “detentions,” implying that the Chinese government took action because Moonshot AI had used U.S. models without authorization.
On September 12, Moonshot AI issued a statement on its official Weibo: “Recent online information about the company’s founder and employees is entirely fabricated and constitutes malicious rumor-mongering. Moonshot AI immediately reported the matter to the public security authorities and will hold those who spread the rumors legally accountable in accordance with the law. We ask everyone not to believe or spread rumors.”
IT之家, The Beijing News, National Business Daily, and other mainstream Chinese media all reported this statement. Lianhe Zaobao also framed it as “no reliable official information or mainstream media confirmation of this matter has yet been seen,” categorizing the claims as internet rumors whose authenticity cannot be confirmed.
The Veracity of the Distillation Allegations: Both Sides Have Problems
In this storm, both the accusing side and the accused have matters they need to answer for.
For Anthropic, the report’s data scale and density of detail make it one of the most complete public documents currently available for understanding how AI is being weaponized, but the underlying account data, prompts, network indicators, and law enforcement records are all undisclosed, so external researchers cannot reproduce its findings. Some in the Hacker News community also question whether Anthropic may have misidentified traffic from Chinese token resellers (using the same Alibaba infrastructure) as a lab’s distillation activity; common sense would suggest the Claude API is astonishingly expensive, there would be no economic value in KIMI forwarding, and its models are open-weight too—if its capabilities really were inadequate, it would have been exposed long ago (Meta’s earlier LLAMA4 was flamed to the skies after being open-sourced).
For Moonshot AI, even if the White House’s July claim about “K3 Distillation Fable” is questionable on the timeline, the operation exposed in Anthropic’s September report—“forwarding user requests to Claude”—is completely different in nature. The operation exposed in Anthropic’s report is different in nature: forwarding user data (including monitoring data and enterprise credentials) to a third-party model without users’ knowledge involves user privacy and cybersecurity issues and is a matter of user privacy and cybersecurity.
The Collective Dilemma Facing Chinese AI Companies
Moonshot AI is not the only Chinese company named. The list in Anthropic’s report covers Alibaba (the Qwen series, with over 151 million exchanges, the largest-scale distillation attack in history), DeepSeek, Zhipu (Z.ai), Xiaomi (MiMo), SenseTime, and MiniMax. Nearly every Chinese AI company you can name is mentioned in this report.
However, such allegations also face the criticism that the evidence has not been made public. Anthropic refuses to disclose the underlying data, citing security and trade secrets, making external verification difficult. Against the backdrop of increasingly fierce China-U.S. AI competition and Anthropic’s planned IPO, the timing, purpose, and political effects of such reports also deserve scrutiny.
Conclusion
The rumor that “16 people were taken away” cannot currently be verified, and Moonshot AI has denied it and called the police. But the fact that the rumor quickly gained traction after the release of Anthropic’s report itself illustrates the trust crisis facing Chinese AI companies. When distillation allegations escalate from a technical discussion into state-level diplomatic wrangling, any small sign will be magnified and overinterpreted. For users, rather than getting caught up in whether the rumor is true, the facts exposed by Anthropic’s report deserve more serious attention: at least in some cases, Kimi users’ requests were indeed forwarded to Claude for processing, and users were completely unaware of this. The nature of user data being forwarded without their knowledge is more worth pondering than the label of whether it constitutes “stealing.”
Source: KOCPC Chinese