Sometime this spring, according to Anthropic's September 2026 threat-intelligence report, a user in China opened Kimi and typed a question. The interface said Kimi. The answer looked like Kimi. But Anthropic says the request never touched a Kimi model. Moonshot quietly forwarded it to Claude, returned Claude's answer to the user, and gave the user no obvious way to know that another company's model had done the work.
Over one ten-day stretch, Anthropic says Moonshot relayed almost 300,000 customer requests to Anthropic, most of them to an Opus-class model. It says Moonshot saved at least some of those exchanges and built a pipeline to extract Claude's reasoning traces for training its own models.
The model name on the screen is no longer proof of which model did the thinking.
This is not a technical footnote. Anthropic says it has attributed unauthorized distillation campaigns with high confidence to seven China-based labs, including Alibaba, Moonshot, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax. The operations differed, but the pattern is coherent enough to deserve a name.
Capability laundering is Galok's term for that pattern: unauthorized or fraud-enabled access enters through proxy networks and account infrastructure; the resulting reasoning traces are cleaned, replayed, scored or converted into training data; the provenance disappears; and the capability re-emerges inside a domestic model as if it were native.
The stakes behind the extraction
The reason this matters beyond a corporate fight over terms of service is that China's AI industry has spent the past twenty months building a much larger story around technological sovereignty.
DeepSeek's arrival in early 2025 became evidence that a Chinese lab could reach frontier-grade reasoning with fewer top-end chips, far less reported spending and a smaller research organization than its American peers. The significance was never only benchmark performance. It was the idea that constraints could be engineered around.
That story later hardened into diplomacy. At WAIC 2026 in Shanghai, representatives from 29 countries signed an agreement establishing the World Artificial Intelligence Cooperation Organization, headquartered in Shanghai. Chinese policy language around open-source models, standards, access and the Global South increasingly presents China as an alternative source of AI infrastructure rather than merely another customer of an American-controlled stack.
An important part of that pitch is sovereignty: models, infrastructure and governance that countries can adopt without permanent dependence on American frontier labs. Anthropic's report does not erase Chinese research. But it complicates the cleanest version of the self-sufficiency story by showing that, during several consequential periods, American model capability may have been inside the training pipeline anyway.
Anatomy of capability laundering
Money laundering is useful here as an analytical metaphor because it separates the process into three operations: placement, layering and integration. The thing being moved is not cash. It is model capability and training signal.
Placement
Anthropic does not offer Claude directly in mainland China. It says some of the campaigns therefore relied on proxy-service networks, residential proxies, disposable email addresses, virtual-card payments and thousands of fraudulent accounts. The goal was to make industrial-scale extraction traffic resemble scattered ordinary customers.
Layering
The valuable output was often not the final answer alone. It was the reasoning trace behind it. Anthropic says Moonshot and DeepSeek used a cross-session replay technique involving Claude's encrypted "thinking signature": save the signature from one session, open another, and induce Claude to reconstruct reasoning that would otherwise remain hidden. Zhipu, Anthropic says, ran a separate cleaning pipeline that fed captured reasoning back through Claude to normalize it into training-ready data.
Integration
The cleaned material can then become supervised fine-tuning data, reinforcement-learning material, model-grading data or post-training infrastructure. Once it enters that stage, the original provenance is difficult for an outside observer to see. The finished model is branded Qwen, GLM, MiMo, Kimi or DeepSeek. The capability arrives without a visible label saying where part of the training signal came from.
The ledger
The scale is what moves the story from opportunistic copying to industrial process.
Alibaba. Anthropic calls the Qwen/Tongyi operation the largest distillation campaign it has measured: more than 151 million exchanges between May and July 2026, peaking near three million per day. It says the attacks targeted agentic tasks, software engineering, kernel development and long-horizon reasoning, and that the resulting transcripts were used in training pipelines for Qwen 3.5, 3.6 and 3.7. Anthropic separately says Alibaba also used Claude for ordinary AI R&D work, including reinforcement-learning environments and architecture research. That distinction matters: using a competitor's tool and secretly extracting its protected reasoning are not the same act.
Moonshot. Anthropic says Moonshot silently served Claude responses to some Kimi users and, in one ten-day period, relayed almost 300,000 customer requests to Anthropic. The broader May-to-July campaign exceeded 23 million exchanges. It says Moonshot also captured saved exchanges and extracted reasoning traces to train its models.
DeepSeek. Anthropic says DeepSeek used a similar cross-session replay technique and selectively rerouted some requests from users who believed they were using DeepSeek models. It attributes more than 12.1 million exchanges to DeepSeek over fourteen days in July.
Zhipu. Anthropic says Zhipu replayed Claude reasoning traces back through Claude to clean them for GLM training and used Claude elsewhere in its post-training pipeline. It attributes more than 3.4 million exchanges over seventeen days. The report also says Zhipu first targeted Anthropic's more heavily safeguarded Fable model for cyber capability, then moved to Opus and another U.S. lab's model after assessing that their safeguards were weaker.
Xiaomi. The report describes a different pattern. Anthropic says it found no indication that Xiaomi served Claude answers directly to its own users. Instead, Xiaomi allegedly saved MiMo user conversations and coding sessions, replayed them to Claude, and used Claude to generate or judge training material. Anthropic observed more than 400,000 requests across more than 1,500 accounts. It also says the timing of a MiMo-V2-Pro free trial and the surge in distillation traffic suggests the trial may have helped generate useful international developer traffic. That remains Anthropic's inference, not an admission by Xiaomi.
SenseTime and MiniMax. Anthropic says SenseTime used transcripts purchased from third-party data vendors. It says MiniMax built a proxy service through a shell company that offered Anthropic and OpenAI models but no Chinese models, including MiniMax's own. Anthropic interprets that setup as a way to harvest frontier-model exchanges for training.
The user-data problem is worse than the model-IP problem
The most disturbing detail is not that one model learned from another. Distillation, when licensed and disclosed, is a normal technique. The more serious issue is that some users may have handed sensitive data to one company while another company's model processed it without their knowledge.
Anthropic says a likely PLA-affiliated user loaded surveillance data into what they believed was Kimi. The data covered hundreds of cameras in Chengdu, including cameras near PLA facilities, institutes linked to China Electronics Technology Group Corporation and a major state-owned enterprise. Anthropic says that request was forwarded to Claude.
It says a major state-owned-enterprise engineer exposed internal code and live credentials while using Kimi, unaware that the session was being routed to Claude. In the DeepSeek cases, Anthropic says a Chinese technology company exposed specifications and strategic objectives of a flagship AI program, a Russian defense-linked operator exposed live database credentials, and engineers building a municipal Public Security Bureau system exposed work on matching citizens' movements against police records using national ID numbers.
That changes the question. The issue is no longer only, "Who trained on whose outputs?" It becomes, "Who actually received the user's data?"
What the evidence does not prove
None of this proves that Chinese frontier models are hollow shells around Claude. Alibaba, DeepSeek, Moonshot, Zhipu, Xiaomi and the rest have real research organizations doing real architecture work, data engineering, reinforcement learning, systems optimization and deployment. A distilled capability can improve a model without explaining the whole model.
Nor is adversarial distillation uniquely Chinese. Frontier labs have repeatedly accused outside actors of trying to extract model behavior. The vulnerability is structural: valuable capability is exposed through APIs, model routers and user-facing products that can be probed at scale.
What is specific in Anthropic's account is the combination of scale, concealment and customer deception. If the report is accurate, some users were shown one model name while another model did the work. Some customer data crossed company and national boundaries without meaningful notice. And some extracted reasoning was then converted into training data that helped build the systems marketed as independent capability.
That is why "everyone distills everyone" is not a sufficient answer. It collapses a licensed training method, adversarial extraction, undisclosed routing and customer-data handling into one neutral word.
The sovereignty paradox
The political irony is hard to miss. China has spent years arguing that technological sovereignty requires alternatives to American chips, models, clouds and standards. Yet Anthropic's report alleges that parts of the domestic-model pipeline still reached back into the American frontier layer, sometimes through infrastructure deliberately designed to hide the route.
This does not make China's AI rise unreal. It makes its provenance messier.
The more important lesson may apply everywhere. As models become components inside routers, agents, apps and training systems, the name printed on the interface tells us less about where intelligence came from. Capability can be licensed, distilled, relayed, scraped, scored, replayed and recombined before it reaches the user.
In the next AI race, provenance may matter almost as much as performance.
The user swiping through Kimi never sees any of that. They type into a Chinese product, in Chinese, and receive a fluent answer. Somewhere behind the interface, according to Anthropic, another model may have done the thinking. The national flag on the product page does not travel with the request.
Source note
Allegation, evidence and attribution
This essay analyzes allegations published by Anthropic on 10 September 2026. Anthropic says it attributed the campaigns described here with high confidence using internal account, traffic and model-use evidence. The underlying raw logs are not publicly available for independent inspection. "Capability laundering" is Galok's analytical framing, not a legal term. Chinese officials have rejected broader U.S. allegations of malicious distillation as unfounded, while arguing that distillation itself is a neutral and widely used technique.
Sources
Anthropic - Countering misuse of AI: September 2026
Reuters - U.S. accuses Chinese AI firms of industrial-scale copying; China rejects the allegations