They Thought It Was Kimi.
It Was Claude.

Anthropic says Moonshot AI and DeepSeek routed customer requests to Claude and returned its responses under their own model identities. Its September threat report describes sensitive data passing through those relays.

By William Douglas Baker

Founding Editor

On September 10, Anthropic published its own account of who has actually been answering customers at two of the industry’s better-known AI companies. Moonshot AI, maker of the Kimi models, “silently forwarded customer requests to Claude, instead of processing them using Kimi.” In one ten-day window alone, Moonshot relayed almost 300,000 requests through a proxy network of 5,380 fraudulent accounts. DeepSeek ran a parallel operation, tagging users connecting through third-party and Anthropic coding tools — Claude Code, the Claude Agent SDK, and OpenCode among them — and rerouting selected users’ queries to Claude Opus. Anthropic says it does not know whether Moonshot ever told its customers; for DeepSeek, it assesses customers were likely never made aware.

The queries that got rerouted were not casual. Anthropic describes a user it assessed as likely affiliated with China’s People’s Liberation Army, who used what they believed was Kimi to analyze CCTV surveillance footage of a tracked individual, drawn from cameras outside PLA facilities and a state-owned enterprise. Engineers building a case-management system for a Chinese municipal Public Security Bureau used DeepSeek to compare a person’s movements against police records by national ID; their queries were relayed to Claude as well. A third user, an IT operator working with a Russian government agency tied to the Ministry of Defense, had requests relayed that exposed live credentials for a Russian government database.

The issue begins before anyone checks whether the answer is correct: who produced it, and where did the request go? Both companies went further than passive routing — each built a cross-session replay attack against a security control Claude uses specifically to prevent unauthorized distillation, extracting Claude’s underlying reasoning traces from the relayed exchanges to train their own models. Moonshot’s distillation activity — a separate count from the customer-facing relay above — totaled more than 23 million exchanges between May and July 2026; DeepSeek’s topped 12.1 million over just fourteen days in July.

The name on the answer is not proof

What this looks like from here

This case turns the recognition question around. Before asking whether an answer engine recognizes the right authority, ask whether the engine itself is the one the user believes it to be. Through the Agentics lens, this resembles Trust Transfer Failure, a Digital Derangement Syndrome™ characteristic: trust attached to one identity while another system supplies the answer. The mechanism differs from a misdirected business listing, but the verification question is familiar. What connects the name being trusted to the source actually doing the work?

For people and businesses, the practical question is what someone can check when an answer speaks in their name. A clear public record gives that person something to compare against the claim. It does not guarantee that every substitution will be detected. The standard is a traceable connection between the identity presented, the source responsible, and the evidence supporting the answer. Anthropic investigated its own infrastructure to find this; a person or business needs a different version of the same thing — something that ties their name to the work that is actually theirs. Agentics calls that becoming microfamous: an identity specific and corroborated enough that a citation can be checked against something real.