Moonshot Relayed 300K Prompts to Claude in Distillation Scheme

This report exposes a growing frontier-model security problem: unauthorized distillation can quietly transfer expensive Claude capabilities into competing models. For AI builders, the Moonshot case is a concrete example of API routing and data harvesting that undermines model economics and terms-of-service enforcement.

Anthropic's September 11, 2026 misuse report claims the company detected and disrupted multiple state-sponsored surveillance operations that used its Claude generative AI models between January and July 2026. The operations originated in China, Iran and West Africa, and targeted the same diaspora and dissident communities those regimes have historically pursued: pro-democracy figures in Hong Kong, Tibetan and Falun Gong communities across Asia, and Iranian minority communities and opponents abroad. This is a significant escalation because it shifts AI misuse from lower-stakes fraud and content abuse to organized, state-aligned intelligence collection.

“

Anthropic says Moonshot relayed almost 300,000 customer requests to Claude over a ten-day period through a network of 5,380 fraudulent accounts, most appearing to be located in Singapore and Japan.

The operational details are instructive. In one Iranian case, actors developed a method to identify people through their social media accounts, a capability that combines AI analysis with open-source intelligence to track real individuals. In Mali, a contractor working for national security authorities used Claude "to design the underlying software that enabled the intelligence gathering." Anthropic's assessment that "AI is now being used in place of an engineering workforce" captures the threat: state actors no longer need large teams of software engineers to build surveillance infrastructure; a small group can prompt models to generate it.

The most commercially and technically consequential allegation involves Chinese AI developers Moonshot and DeepSeek. Anthropic says Moonshot relayed almost 300,000 customer requests to Claude over a ten-day period through a network of 5,380 fraudulent accounts, most appearing to be located in Singapore and Japan. This suggests a deliberate reverse-proxy or API-routing operation where user prompts were sent to Claude, answers were returned to Moonshot's users, and the interaction data was simultaneously used to distill Moonshot's own models. DeepSeek is similarly accused of secretly using Claude to generate answers while extracting training value. Anthropic says the data contained sensitive user information, potentially violating privacy agreements. This matters because unauthorized distillation can transfer the capabilities of expensive frontier models into cheaper competitors, eroding both the economic moat of labs like Anthropic and OpenAI and the ability to enforce terms of service.

The report also says Anthropic disrupted attempts to design weapons, conduct questionable biological research, and create dating scams, illustrating that the misuse surface is not limited to espionage. The company's warning is that AI systems lower the cost and technical barrier for a range of harmful activities, and that the gap between model capabilities and robust misuse controls remains dangerously wide.

Previous reporting has accused Chinese developers of using distillation without permission against Anthropic and OpenAI, but the new allegations provide a concrete case study. The 5,380 fraudulent accounts suggest procurement of phone or email identities, and the routing through Singapore and Japan indicates an attempt to evade geographic restrictions. That degree of coordination is not a casual developer bypassing terms; it is an infrastructure investment.