Anthropic published its September 2026 threat intelligence report on 10 September, covering misuse of Claude it identified and disrupted between December 2025 and August 2026 across seven areas, from cyber operations and influence campaigns to biological misuse and fraud. The full report runs to 154 pages, according to the South China Morning Post.

The section that drew the headlines is illicit distillation — using a stronger model's outputs, without permission, to train a competing one. Anthropic attributes nearly 200 million exchanges to five separate campaigns.

Everything that follows is Anthropic's account. None of the companies named had responded publicly in the coverage reviewed for this piece.

The fingerprint was the efficiency

The largest single number belongs to Alibaba. As reported by TechCrunch, Anthropic observed 151 million exchanges between May and July 2026, peaking at nearly three million a day, spread across about 3,500 accounts.

What tied those accounts together was a single fixed prompt used to extract the chain of thought — the model's reasoning, which is the most valuable thing to copy if you want a student model to reason rather than merely answer.

That is worth dwelling on, because it is the central problem with extraction at scale. Spreading traffic over 3,500 accounts hides volume. But the reason to run 151 million exchanges is to industrialise a technique, and industrialising a technique means using the same prompt every time. The template that makes extraction cheap is the signature that makes it attributable. An operation cannot be both maximally efficient and unrecognisable.

Moonshot's traffic was not synthetic

Moonshot AI, the maker of the Kimi chatbot, is attributed a smaller volume — nearly 300,000 requests over one ten-day window, from around 5,000 accounts, aimed at Claude Opus.

The detail is in what the requests contained. TechCrunch reports that one involved "a cache of closed-circuit surveillance footage", and that the traffic "seemed to route requests directly from the Chinese military."

Those are not the prompts of a training pipeline generating synthetic questions. They look like real users doing real work.

Kimi's users were talking to Claude

Which leads to the claim with the widest consequence. As reported by the South China Morning Post, Anthropic accused Moonshot and DeepSeek of "covertly routing customer requests to its Claude models, then showing users the responses as if they were from their own models."

More specifically: "Kimi model developer Moonshot secretly showed its users Claude model outputs and passed them off as Kimi's, then used those exchanges to improve their own models." Anthropic said the practice raised "concerns about the misuse of user data by PRC AI labs."

If that account is accurate, Kimi's users were exposed twice without being told.

Their prompts — whatever they typed or uploaded — went to a foreign AI company they had no relationship with. And the answers they received, and trusted as Kimi's, came from a different model entirely. Their data then became training material for the model they believed they were already using.

The joint US advisory on Chinese distillation described this practice from the targeted lab's side, as extraction. This is the same practice seen from the end user's side, and from there it is a privacy breach.

What the report says about its own limits

Two lines in the report bound how far its conclusions reach, and both should travel with the numbers.

On Anthropic's newest models: "None of the misuse cases involved the use of Claude Fable or Mythos-class models, with the exception of one illicit distillation case."

On what Anthropic can observe: "Our visibility into these operations ends once it's live." Anthropic sees traffic arriving at its API. It does not see what a distilled model later does, how a routed answer was presented to a user, or anything that happens off its platform. The claim that users were shown Claude's outputs as Kimi's is, necessarily, reasoned from that position.

The report's broader framing is the one GreyNoise's PaperCut research illustrated from the other end this week: "Sophisticated attacks no longer require sophisticated attackers."

What to do

  • If you use a third-party AI product for sensitive work, ask in writing which models actually process your requests, and where. "Our own model" is a claim, not a guarantee.
  • If you operate an AI API, look for uniformity rather than volume. Fixed templates across many accounts are the pattern that surfaced here.
  • If you build on opaque or distilled models, treat their provenance as unknown until the vendor documents it.

What is not established

  • Responses from Alibaba, Moonshot or DeepSeek. None in the coverage reviewed.
  • How Anthropic established that user requests were being routed, rather than generated, beyond the content of the traffic.
  • DeepSeek's volumes, which the coverage reviewed does not specify.
  • Which of the five campaigns involved the one Fable or Mythos-class exception.
  • Independent verification of any of it. This is a vendor reporting on its own platform — credible, and self-reported.