In September 2026, U.S. AI lab Anthropic revealed that Chinese startup Moonshot AI’s conversational assistant “Kimi” had been covertly rerouting user queries to Anthropic’s flagship model, Claude, to generate answers. Driven by a desire to bypass astronomical computing costs and industrialize tech learning via “knowledge distillation,” this practice highlights the escalating intensity of the U.S.-China AI distillation war.

Key Event Summary: Unauthorized Relay from Chinese AI “Kimi” to Claude

On September 10, 2026, U.S. AI safety lab Anthropic published a threat intelligence report revealing that Beijing-based AI startup Moonshot AI (Yuezhi Anmian) was surreptitiously forwarding user requests from its conversational assistant “Kimi” to Anthropic’s frontier model, “Claude.” While users believed they were interacting directly with Kimi, the underlying answers were actually generated by Claude behind the scenes. According to Anthropic’s investigation, approximately 300,000 customer requests were intercepted and forwarded in a span of just 10 days. The core issues extend far beyond simple breach of terms, centering on three key points:

• Unauthorized access to a competitor’s AI model and service impersonation via “proxy answering.”
• Industrial-scale “knowledge distillation,” harvesting user inputs and outputs to train Moonshot’s proprietary models.
• Evasion of geoblocking mechanisms through an extensive network of covert proxy hubs.

The figure below illustrates the overarching structure of the proxy-answering mechanism and data harvesting process.

In just the three-month period between May and July 2026, transactions with Claude tied to Moonshot AI exceeded 23 million, triggering international outrage over what is considered the largest unauthorized AI misuse campaign to date.

Technical Mechanisms of Query Rerouting and the “Hydra Cluster”

Due to geopolitical regulations and export controls, Anthropic restricts access to its services from mainland China. To circumvent these geoblocking restrictions, Moonshot AI engineered a sophisticated proxy infrastructure referred to as a “transfer station.” Known internally as the “Hydra cluster,” this network dynamically managed roughly 5,380 fraudulent accounts. Designed for high resilience, the cluster automatically rerouted traffic to alternative access channels whenever an individual account was flagged or terminated.

• Proxy Locations: Fraudulent accounts were predominantly registered under identities originating in permitted regions such as Japan and Singapore.
• Account Infrastructure: The operation relied on stolen API keys, fraudulent payment credentials, and disposable email addresses to maintain a massive account pool.
• Data Harvesting: Beyond relaying Claude’s answers back to end-users, the system systematically extracted chain-of-thought (CoT) reasoning steps and thought signatures to populate Moonshot’s proprietary training corpus.

This decentralized infrastructure made it impossible for traditional point-based IP bans or individual account suspensions to mitigate the threat. Furthermore, by mimicking typical individual user API call patterns, the operation successfully evaded automated anomaly detection systems over an extended period.

Corporate Data Exposure and U.S.-China AI Distillation Tensions

Unintentional Data Exposure and Severe Security Vulnerabilities

One of the most alarming aspects of “proxy answering” is the inadvertent exposure of sensitive user data to foreign servers and third-party entities. Input data provided by Kimi users did not remain within Moonshot AI’s ecosystem; instead, it was transmitted directly to Anthropic’s infrastructure via the covert proxy network. During its investigation, Anthropic identified highly sensitive data among the forwarded traffic, including:

• Surveillance video footage submitted for analysis by individuals linked to Chinese military or law enforcement entities.
• Internal source code submitted during software development by engineers at major state-owned enterprises.
• Active system credentials, including administrative usernames and passwords, providing direct access to corporate and government networks.

Even when enterprise clients or individual users selected Kimi or multi-model AI routers for convenience or cost efficiency, their sensitive data was traversing multi-layered external channels and being inspected by foreign organizations. This situation exposes critical vulnerabilities in enterprise data governance and AI risk management.

Structural Incentives Behind China’s AI Development and Distillation Reliance

Why do Chinese AI developers rely on unauthorized access and request forwarding from rival models? At the root of this practice lies “knowledge distillation”—a technique used to train a smaller “student” model on the outputs and Chain of Thought (CoT) reasoning generated by a high-performing “teacher” model (such as Claude). This allows developers to rapidly upgrade model capabilities at a fraction of the cost.

• Asymmetric Development Costs: While frontier model development requires billions of dollars in capital expenditure, knowledge distillation drastically slashes research and training expenses.
• Targeted Capability Extraction: Rather than fetching raw factual knowledge, distillation focuses on harvesting high-value cognitive outputs, including complex logic, code generation, and function-calling reasoning logs.
• Offloading Compute Burdens: When internal server capacity proves insufficient, routing user queries to third-party AI models allows a provider to artificially maintain high service quality and response speed.

By capturing the precise logical pathways used by a teacher model to reach conclusions, developers can shortcut years of fundamental research. For Chinese firms constrained by U.S. semiconductor export restrictions and GPU shortages, distillation serves as a highly attractive shortcut.

Market Impact, Future Outlook, and Key Considerations

The $3.3 Trillion Tech Sell-Off and Moonshot AI’s Explosive Growth

Founded in Beijing in 2023 by 34-year-old former rock drummer Yang Zhilin, Moonshot AI captured global headlines in 2026 with the release of “Kimi K3″—a massive 2.8-trillion-parameter open-weights model promising frontier-level performance via low-cost APIs. The launch triggered a massive sell-off in Western semiconductor and cloud infrastructure equities, wiping out approximately \$3.3 trillion (over 530 trillion yen) in market capitalization within days.

• Massive Market Impact: Semiconductor giant TSMC dropped 7%, while SoftBank fell 9%, echoing the market turbulence previously seen during the “DeepSeek shock.”
• Skyrocketing Valuation: Fresh funding rounds propelled Moonshot AI’s valuation to \$350 billion (approx. 5.7 trillion yen), with the firm pursuing an initial public offering (IPO) in Hong Kong later this year.
• The Price of Low Cost: Despite boasting disruptive pricing at just \$0.94 per complex task, independent benchmarks revealed a troubling hallucination rate of approximately 51%.

The diagram below illustrates the relationship between market impact and corporate growth metrics.

However, allegations that K3’s rapid training and inference capabilities relied heavily on clandestine query forwarding and distillation from Claude have cast a shadow over Moonshot AI’s technological independence and regulatory compliance.

Future Outlook: Tightening Regulations and Enterprise Governance

The discovery of proxy answering and hostile distillation marks a critical inflection point for global AI security and international regulatory frameworks. Anthropic has moved beyond reactive account bans, deploying active defense strategies such as enhanced organizational attribution and simplified reasoning outputs designed to diminish data utility for distillation. Simultaneously, U.S. government agencies—including the NSA, CISA, and the FBI—have issued joint advisories warning against industrial-scale technological extraction by foreign AI labs.

• Institutional KYC Requirements: Implementation of financial-grade Know Your Customer (KYC) protocols and stringent access controls for API endpoints.
• Active Defense & Data Poisoning: Consideration of targeted data poisoning techniques that dynamically degrade response quality when hostile distillation patterns are detected.
• Enterprise Data Governance: Imperative verification of AI model provenance, forcing organizations to ask: “Is our designated AI truly the model answering our queries?” and “Which jurisdiction’s servers are processing our data?”

Moving forward, raw benchmarks and pricing will no longer serve as the sole metrics for AI selection; data lineage, routing transparency, and provenance will become decisive criteria. Whether AI adopters can navigate these middleman risks and enforce rigorous governance will be the paramount focus for the industry.

Reference Pages

• 【Anthropic Threat Intelligence Report / Detecting and Preventing Distillation Attacks】https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
• 【CISA Cybersecurity Advisory AA26-251A】https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a

【#GenerativeAI #Anthropic #Claude #MoonshotAI #Kimi #AISecurity #USChinaTensions #KnowledgeDistillation】