The most revealing item in Anthropic’s September 10 threat report is a piece of surveillance footage from Chengdu.
According to Anthropic, hundreds of cameras had recorded a person moving around the city. Some faced entrances to facilities associated with the People’s Liberation Army, institutes affiliated with China Electronics Technology Group Corporation and a major state-owned enterprise. The user chose Moonshot AI’s Kimi to analyse the footage. Anthropic says Moonshot sent the request to Claude.
If that account is correct, a Chinese user deliberately chose a Chinese AI service and still sent sensitive Chinese data into an American model without knowing it.
Washington can frame the conduct as illicit distillation, with Chinese companies allegedly extracting the capabilities of American frontier models. Beijing faces a different problem. Some of the same mechanisms used to import American AI capability may also have exported Chinese secrets.
That exposes a weakness in the way governments think about AI sovereignty. They count chips, data centres, model weights and national champions. Yet a system can look domestic at every visible layer while handing its hardest prompts to a foreign model behind the scenes.
Security depends on the routing path as much as the model’s owner.
The shortcut changed the risk
Distillation is a standard machine-learning technique. A stronger model generates examples, and a weaker model learns from them. Anthropic’s allegation is narrower: industrial-scale extraction carried out through fake accounts, access circumvention and proxy networks.
The numbers suggest organised operations rather than casual experimentation. Anthropic attributes more than 151 million exchanges between May and July 2026 to an Alibaba-linked campaign targeting Claude’s reasoning capabilities, with traffic peaking at almost three million exchanges a day. Earlier in 2026, Anthropic said DeepSeek, Moonshot AI and MiniMax had generated more than 16 million Claude exchanges through roughly 24,000 fraudulent accounts. On September 8, the NSA, FBI and CISA separately alleged that several Chinese AI companies had extracted billions of tokens from American frontier models since at least late 2024.
Frontier models embody huge spending on compute, engineering and experimentation. A competitor that can make a teacher model generate useful training data can try to absorb some of that capability without reproducing the full cost of discovering it.
The security problem becomes much worse when the student stops inventing questions for the teacher and starts using its own customers.
Anthropic says Moonshot relayed almost 300,000 customer requests to Claude during one ten-day period through 5,380 fraudulent accounts. It says DeepSeek selected some customer requests and forwarded them to Claude Opus. Xiaomi, according to the report, stored conversations between MiMo and its users and later replayed those sessions through Claude to generate supervised fine-tuning and reinforcement-learning data.
Real customer traffic is unusually valuable training material. Synthetic prompts reflect what a developer imagines users will ask. Actual traffic contains the messy material that benchmarks struggle to reproduce: unfinished code, proprietary documents, strange edge cases, follow-up questions and the context people reveal while trying to get real work done.
That makes customer traffic a better curriculum. It also makes it far more sensitive.
Anthropic says the forwarded material included live corporate credentials, internal specifications and strategic goals for a Chinese technology company’s flagship AI project, and work on a municipal Public Security Bureau system that compared citizens’ movements with police records using national ID numbers. The Chengdu surveillance footage sat at the far end of the same problem.
The better the training data became, the worse the potential security exposure became.
The security boundary sits behind the interface
A domestic label tells a security team very little if the service can call foreign models upstream.
Procurement teams usually ask who built a model, where the company is headquartered and where the service is hosted. Those questions made more sense when one product largely mapped to one computational system. Modern AI services can sit on top of routers, fallback models, agent frameworks, API aggregators and several upstream providers.
Security teams need to know every model a sensitive prompt can touch.
China’s regulations for public generative-AI services require providers to protect users’ input information and usage records and prohibit unlawfully providing those records to others. Those rules do not establish that the routing alleged by Anthropic was unlawful in any particular case. They do show why undisclosed routing to an overseas model can create legal as well as security concerns.
Sensitive AI systems need an audit trail comparable to a software bill of materials. An organisation should be able to establish which model processed a request, which intermediary routed it, where processing occurred, who could retain the data, whether the request could be reused for training and whether a fallback model was invoked.
The AI equivalent would be an inference bill of materials: a record of every model and intermediary that can touch a request.
For high-security systems, a privacy policy is not enough. The routing record needs to be verifiable. A service with a domestic brand but unauditable foreign dependencies gives the customer no reliable way to know where sensitive data has travelled.
Restrictions created a grey market for inference
American model companies restrict access from China, but demand for their models did not disappear. According to the joint NSA-CISA-FBI advisory, Chinese actors have used API proxies known as “transfer stations”, alongside cloud providers, aggregators and obfuscated accounts. OpenAI told Congress in February that it had observed accounts associated with DeepSeek employees circumventing restrictions through obscured third-party routing. It also described a move from simple chain-of-thought extraction towards multi-stage distillation pipelines.
The result is a grey market for frontier-model access. Account farms, routing layers, shell companies, resellers and traffic-mixing services can sit between the user and the model provider.
This changes the enforcement problem. Banning one API account does little if the same organisation can move traffic across thousands of disposable identities and several intermediaries. Providers have to identify the network behind the accounts.
US authorities are already pushing in that direction. The September advisory recommends stronger identity verification, behavioural detection and information sharing among model companies, cloud platforms and API aggregators. OpenAI has made a similar point: a determined distiller can migrate towards whichever part of the supply chain has the weakest controls.
The same routing problem appears on the customer side. Approving a chatbot vendor does not secure the full inference path. Security teams need to know what sits behind the interface and what happens when the vendor decides another model can answer a request better.
Beijing has its own reason to care
Anthropic is an interested party. It is defending valuable intellectual property and publishing its own attribution of activity observed on its infrastructure. The Chinese government rejected the separate September 8 US-government allegations, describing them as an effort to suppress China’s AI industry. Anthropic’s claims should therefore be read as allegations, not as findings established by a court or independent audit.
Those caveats limit how far the allegations can be treated as established fact. They do not erase the security failure mode the report describes.
OpenAI has independently described obfuscated routing and distillation activity associated with DeepSeek. A government does not need to accept every attribution in Anthropic’s report to recognise the underlying risk: a domestic AI service can become a gateway to a foreign model without the user seeing the switch.
Washington can frame the alleged conduct as unauthorised acquisition of American AI capability. Beijing has to confront a less comfortable question if Anthropic’s account holds up: why did users working with state-owned-enterprise credentials, police systems, sensitive internal AI documents and military-adjacent surveillance believe they were using domestic services while their data allegedly travelled into an American model?
For Beijing, that is a counter-intelligence and procurement problem as much as a technology problem.
China has spent years reducing dependence on foreign technology because foreign dependence can become strategic exposure. The race to accelerate domestic AI capability may have recreated that dependency inside the least visible part of the stack.
The user sees Kimi, DeepSeek or MiMo. The difficult request may travel somewhere else.
The risk grows as AI moves from chatbots into operating workflows. Engineers paste source code and credentials into models. Companies ask them to analyse unreleased products and internal documents. Government users will put case files, operational data and institutional knowledge into the same systems. Agents will add more context because they need more context to do useful work.
A provider on that inference path can receive a stream of information about what organisations are building, debugging, investigating and trying to decide. Supplying the computation also creates access to the work passing through it.
The AI sovereignty debate has focused on semiconductor supply, training clusters and model ownership. It now has to follow the data after a user presses Enter.
Governments, enterprises and security services need to know which model answered a sensitive prompt, where that model ran and what happened to the data on the way there.
Until they can answer those questions, domestic branding offers less protection than it appears to.
In AI, the operative border is the path the data takes.