[Thought They Were Using Kimi, But the Actual Responses Came from Claude]

A secret pipeline built by China to catch up with cutting-edge U.S. artificial intelligence has backfired, turning into a channel that leaks sensitive Chinese data directly into American hands. In an effort to transplant the reasoning capabilities of Anthropic’s Claude into their own flagship models, several Chinese AI firms secretly rerouted customer prompts to Claude. Unbeknownst to these companies, the forwarded traffic contained surveillance logs linked to the People’s Liberation Army (PLA), internal code from state-owned enterprises (SOEs), and operational data from Chinese public security systems. What was intended to harvest the "brains" of American AI has triggered a catastrophic reverse flow of China's own national security data into U.S. AI infrastructure. Given the profound shock this discovery would cause President Xi Jinping, all eyes are now on how Beijing will handle the fallout.

The threat intelligence report published by Anthropic on September 10 is staggering. According to the report, Moonshot AI quietly forwarded a subset of user prompts submitted to its Kimi chatbot over to Claude without user consent, then returned Claude’s answers back to Kimi users. While end-users believed they were interacting with a domestic Chinese model, their queries were actually being processed by U.S. AI engines.

To pull this off, Moonshot deployed a proxy network featuring 5,380 fraudulent accounts, mostly disguised as traffic originating from Singapore and Japan. In a single 10-day period captured by Anthropic, nearly 300,000 user requests were funneled into Claude—predominantly routed to the top-tier Opus model. Between May and July, Claude exchanges linked to Moonshot exceeded a staggering 23 million.

Anthropic further assessed that Moonshot built a dedicated pipeline to store these conversations and extract Claude’s chain-of-thought (CoT) reasoning traces to train its own models. While "distillation" itself is a standard AI training method using powerful models to teach smaller ones, systematically bypassing a competitor's access controls via thousands of fake accounts to harvest core capabilities changes the nature of the act entirely.

[Surveillance Data Linked to the PLA Found Inside the Pipeline]

What elevated this issue from an intellectual property dispute into a critical national security incident was a specific discovery. Anthropic disclosed a case where a user—assumed with high confidence to be linked to the PLA—entered real-time surveillance data collected from hundreds of CCTV cameras in Chengdu, operating under the assumption that they were using Kimi. The prompt asked the model to analyze the movements and actions of targeted individuals to flag "anomalous behavior."

The feeds in question covered CCTV cameras surrounding PLA facilities, research institutions tied to China Electronics Technology Group Corporation (CETC), and major state-owned enterprises. Yet, this exact data was funneled directly into Claude through Moonshot’s rerouting system. Anthropic noted that the user likely had no idea their request was being processed by a model owned by a U.S. AI firm.

Framing this strictly as "PLA military secrets transferred to America" might be an exaggeration. What Anthropic verified was that sensitive surveillance data entered by a high-probability PLA-linked user was transmitted to Claude. However, from Beijing’s perspective, failing to control the data processing route despite relying on a domestic AI service represents a severe security flaw.

[Escalating Leaks: From SOEs and Public Security to Russian Defense Entities]

The issue did not end with the single PLA-related case. An engineer at a major Chinese state-owned enterprise, using Kimi to develop internal systems, submitted internal source code and live authentication credentials belonging to key Chinese enterprises; this request was also sent to Claude. Anthropic revealed that DeepSeek’s operations similarly routed internal AI documentation from domestic tech firms and queries related to local public security case management systems over to Claude.

Even more strikingly, Anthropic claimed to have identified an instance where an IT operator managing databases for a government entity linked to the Russian Ministry of Defense entered live access credentials into DeepSeek—which were subsequently routed straight into Claude. DeepSeek’s Claude interactions topped 12.1 million in a span of just 14 days in July.

[151 Million Exchanges: The Industrialization of China’s ‘Distillation Offensive’]

The sheer scale of these operations is breathtaking. The largest single campaign involved Alibaba. Anthropic disclosed that an entity affiliated with Alibaba operated over 3,500 deceptive accounts between May and July, generating more than 151 million exchanges with Claude—peaking at nearly 3 million requests per day. This dwarfed Moonshot’s 23 million and DeepSeek’s 12.1 million exchanges.

Earlier in February, Anthropic had reported that Chinese AI labs—including DeepSeek, Moonshot, and MiniMax—mobilized around 24,000 fraudulent accounts to run over 16 million exchanges with Claude. While that initial wave raised alarms, the latest campaign expanded drastically in both scope and participating entities. The target was no longer basic text responses, but cutting-edge frontier capabilities: agentic behavior, tool execution, complex coding, data analytics, and long-horizon reasoning.

On September 8, the U.S. National Security Agency (NSA), FBI, and Cybersecurity and Infrastructure Security Agency (CISA) issued a joint advisory publicly warning that Chinese AI firms are conducting "aggressive, industrial-scale distillation attacks" against American frontier models. This signals that Washington no longer views this as a corporate trade secret dispute, but as a critical element of U.S.-China AI hegemony and national security.

[The True Fatal Blow to Chinese AI: A Breakdown of Trust]

This revelation poses uncomfortable questions for the Chinese AI sector. Generative models like DeepSeek, Kimi, and Alibaba’s Qwen (Tongyi Qianwen) were hailed as symbols of China’s AI rise, ostensibly narrowing the gap with U.S. tech giants despite severe GPU export restrictions. However, if the allegations made by Washington and Anthropic hold true, debate will intensify over how much of that rapid catch-up relied on exfiltrating outputs and reasoning traces from U.S. frontier models.

Yet, far more lethal than doubts over technical self-reliance is the collapse of data trust. A primary reason Chinese enterprises and government bodies adopt domestic AI tools is the guarantee that sensitive data remains within sovereign systems. If queries typed into Chinese AI can be silently redirected to U.S. servers, the military, public security agencies, and state enterprises will have to audit every single model they use to verify where data is actually processed.

[A Dilemma for the PLA: Can the AI Supply Chain Be Trusted?]

For the People's Liberation Army, the situation is acute. The PLA views future warfare as "intelligentized warfare," expanding AI deployment across imagery intelligence analysis, target identification, sensor fusion, cyber warfare, and autonomous systems. If domestic AI platforms secretly invoke foreign frontier APIs to boost performance, military planners can no longer guarantee the physical residency or confidentiality of operational data.

Consequently, this incident will likely trigger a top-to-bottom audit by Beijing of third-party routing, external API calls, and data execution paths for AI deployed across the military, police, and key state enterprises. However, taking that step creates a fresh bottleneck: thoroughly severing connections to foreign frontier models shuts down the very shortcut Chinese AI labs used to bridge the technological divide.

[Washington’s Justification for Export Controls on AI Models]

For Washington, the implications are the exact opposite. Until now, the core of U.S. AI containment against China focused on restricting advanced GPUs and semiconductor manufacturing equipment. But if China can absorb advanced reasoning capabilities from U.S. models at scale without native access to state-of-the-art chips, hardware embargoes alone become insufficient.

The battleground of the U.S.-China AI war is set to expand from “what chips can be sold to China” to “how to prevent China from harvesting the intelligence of American AI models directly.” As U.S. AI developers tighten access controls through enhanced identity verification, proxy blocking, and automated anomaly detection, the cost for Chinese AI firms to maintain their rapid pursuit will rise sharply.

[Why Times Insight]

The core takeaway of this incident goes beyond the narrative that "China copied Claude." The critical reality is that a clandestine pipeline constructed to import American AI intelligence into China ended up acting as a reverse pipeline, funneling China's most sensitive data back into the United States.

Beijing is left with two equally unpalatable options. Rigorously sealing off external AI pathways for security reasons means relinquishing the fastest shortcut available to close the capability gap with the U.S. Conversely, keeping stealthy proxies open to win the performance race means accepting that sensitive data from the PLA, public security apparatus, and state enterprise sector could leak anywhere.

Ultimately, China’s AI ambition is caught in a stark tradeoff between performance and security. Chasing performance compromises national security; prioritizing security means bridging the technology gap entirely on home-grown strength.

This leads to the single most painful question facing President Xi’s "AI self-reliance" agenda: If the very pipelines engineered to overtake American AI expose China's own military and security data to American models, to what extent can China's AI rise truly be called "independent"?