DeepSeek and Moonshot AI are under investigation following allegations that both companies passed sensitive user queries to Anthropic’s Claude models without their customers’ knowledge. 

Anthropic previously accused several Chinese AI companies of distillation, an allegation Chinese officials have denied and framed as an attack on its AI sector. 

A September report by Anthropic named seven China-based firms that were reportedly tapping Claude through mass unauthorized access. Besides DeepSeek and Moonshot, that list included Alibaba, Zhipu (also known as Z.ai), SenseTime, MiniMax, and Xiaomi.

After the report landed, the Cyberspace Administration of China called in representatives from all seven companies for several rounds of questioning, and officials are now trying to decide if the alleged conduct broke China’s rules on moving data across its borders. 

Anthropic’s own September 2026 threat intelligence report covers activity that the company said it detected and shut down between December 2025 and August 2026.

Anthropic accused DeepSeek of relaying selected user requests to Claude while having those users believe that they were dealing with DeepSeek’s models. Some of the forwarded material was sensitive, including information tied to a Chinese technology firm’s AI program, data linked to a Russian government agency, and records from a Chinese municipal police system. 

Anthropic said DeepSeek extracted Claude’s hidden reasoning steps, known as its “thinking signature,” and then used that stolen knowledge to help train its own systems. 

Notably, during the July period that Anthropic examined, DeepSeek was found to have rerouted more than 12.1 million of its users’ queries to Claude over just 14 days.

Anthropic also revealed that Moonshot AI silently forwarded almost 300,000 customer requests to Claude across a 10-day stretch. The requests were sent through 5,380 fraudulent accounts that mostly appeared to sit in Singapore and Japan.

Anthropic added that it could not confirm whether Moonshot told customers that their requests were going to be sent to a third party. 

In an earlier account of the report, Cryptopolitan noted one Moonshot-linked user whom Anthropic judged likely affiliated with the Chinese military, using the service to review surveillance footage.

Anthropic has previously accused several AI companies of “distillation,” a routine technique in which a smaller “student” model learns from a larger “teacher” model’s outputs. 

Anthropic says it has identified and disrupted such efforts at seven Chinese labs since February 2026. Alibaba was the heaviest user of the seven, with more than 151 million exchanges between May and July 2026, a figure Cryptopolitan reported earlier this month.

Beijing has pushed back on the distillation narrative, with its officials framing Washington’s complaints as an effort to hold back China’s AI sector. 

Meanwhile, U.S. and Chinese officials recently agreed to keep talking on AI safety and emergency communication, with another meeting expected in Shenzhen within two months.