Anthropic says Moonshot’s Kimi K3 was distilled from Claude

Companies like Moonshot AI are spinning up “tens of thousands, if not hundreds of thousands of fraudulent accounts” to collect Claude’s answers and train cheaper rival models on them, Anthropic’s head of threat intelligence Jacob Klein told CNBC in a report published September 3. He said Moonshot’s Kimi K3, which took off in July, was illegally trained off the newest version of Claude, carrying the distillation charge Anthropic made against Moonshot earlier this year onto a model widely adopted in Silicon Valley, partly for its lower price.

That earlier charge also named DeepSeek and MiniMax, and Anthropic has accused Alibaba, maker of the Qwen family, of a massive “distillation attack” to capture Claude’s capabilities. In its account of the three labs’ campaigns, Anthropic said they generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, over 3.4 million of the exchanges from Moonshot. Moonshot employed hundreds of fraudulent accounts, it said, targeting agentic reasoning and tool use, coding and data analysis, computer-use agent development and computer vision.

Those roughly 24,000 accounts, counted for three labs together, already fall inside the “tens of thousands” Klein now gives for companies like Moonshot; the top of his range is several times that count.

Stolen cards and hydra clusters

Klein described “an entire illicit ecosystem to try to gain access to Claude and other models,” one that “goes through any means necessary to evade our controls, so they can spin up accounts at extreme scale.” Cybersecurity experts told CNBC the threat also comes from countries like Iran, Russia and North Korea, where the companies restrict Claude, Google’s Gemini and OpenAI’s ChatGPT because of sanctions. One way around such restrictions is the dark web, whose marketplaces sell stolen credit card information and compromised AI accounts.

Anthropic does not offer commercial access to Claude in China or to subsidiaries of Chinese companies outside the country, and it says labs get around that through commercial proxy services that resell access via “hydra cluster” networks of fraudulent accounts spread across its API and third-party cloud platforms, where a new account takes the place of each banned one. One proxy network managed more than 20,000 such accounts at once, it said, mixing distillation traffic with unrelated customer requests. Travis Lanham, technology chief at cybersecurity firm Armadin and a former Google engineer, said bad actors often go undetected because AI companies are under pressure to keep their platforms as accessible as possible while they race competitors. “These companies are serving billions of requests,” he said. “The millions are relatively small compared to everything and it’s just sneaking in and trying to look like the rest of the crowd.”

Once inside Anthropic’s systems, the labs ask the models questions and collect the responses to train their own model, often called the student, Klein said. A clear sign of distillation, in his description, is a user asking thousands of questions rather than dozens, potentially with thousands of accounts doing the same, which leaves model makers playing whack-a-mole.

Surveillance fears and an April memo

Klein says competition is to be expected and distillation can be legal, which generally means gaining permissions and following the law on intellectual property and export controls; what is coming out of the Chinese market, he says, is much closer to theft. “I think competition is great,” he said. His concern is Claude distilled “through fraudulent means,” on fake accounts made with “stolen credit cards and stolen infrastructure,” to “produce a model that doesn’t have safeguards in place.” Foreign companies, he added, can use the technology with few guardrails; he pointed to fears of surveillance and possible use in a biological weapons program, and to what he described as a China-based entity’s campaign of espionage at scale using Anthropic’s technology.

The fight comes as Anthropic, valued close to $1 trillion in private markets, is expected to go public as soon as October, CNBC has reported. An April memo from the Trump administration called distillation that undermines American research and proprietary information “unacceptable” and said it would explore “a range of measures to hold foreign actors accountable.” OpenAI and Google have both published reports on distillation and say they are fighting the same problem.

“It’s very hard to fully stop this as a problem, but I think slowing it down is good and worthwhile,” Klein said.