Anthropic's own threat report names four more Chinese labs running silent-relay schemes against Claude, with exact exchange counts and a technical bypass of Anthropic's chain-of-thought protection

What happened

Anthropic's September threat-intelligence report names DeepSeek, Moonshot, Zhipu (Z.ai) and Xiaomi as running distillation and data-misuse operations against Claude beyond the Qwen/Alibaba case already on this thread, and for three of them documents something worse than distillation: silently routing their own paying customers' live requests to Claude, serving Claude's answers back under their own brand, and harvesting the exchange for training data, without telling the customer. Per Anthropic's own document: Moonshot (GTG-16002) relayed roughly 300,000 Kimi-branded customer requests to Claude Opus in a ten-day sample (23M+ exchanges attributed May–July). DeepSeek (GTG-16001) ran the same silent-relay scheme, 12.1M+ exchanges over fourteen days in July. Zhipu/Z.ai (GTG-16006) ran a chain-of-thought extraction pipeline against Claude Opus 4.8 (770,609 exchanges over ten days in June) to clean GLM training data, then separately targeted the cyber capabilities of Anthropic's Fable model and another leading US lab's top model ahead of GLM 5.3, giving up on Fable once its safeguards degraded the attack. Xiaomi (GTG-16008) replayed its own MiMo customer sessions through Claude to generate training data without serving the answers back. Both Moonshot and DeepSeek are reported to have defeated a specific Anthropic technical control — the "thinking signature" token that stands in for raw chain-of-thought in the API — via a cross-session replay trick that induces Claude to reconstruct its own reasoning trace from the signature, a materially more sophisticated evasion than the prompt-injection method used against the Qwen models already on this thread. (Anthropic)

Sources 1

Anthropic anthropic.com primary source

Credibility ratings combine two public datasets: Lin et al. 2023, PNAS Nexus 2(9):pgad286 (CC BY 4.0) for the domain-quality score, and Wikipedia's perennial-sources list (CC BY-SA 4.0) for the reliability tier. A rating describes an outlet's general record, never this particular article. Unrated means absent from those datasets — not a judgement.

The wider story

This event sits inside Distillation Fight, which carries how it developed before and since.

Story 14 of 18 in this thread's timeline, oldest to newest

Adjacent threads (shared entities):

· Anthropic Rents the Buildout

· The Enterprise Agent Land Grab