Anthropic released its latest threat intelligence report, revealing that Chinese AI companies are suspected of conducting unauthorized model "distillation" on a large scale. Among them, Anthropic accused China's "Dark Side of the Moon" of not only using Claude's output to strengthen its own model, but also secretly forwarding some customer requests that were originally handled by its own AI to Claude without the user's knowledge, and then presenting the answers generated by Claude to the user.
In other words, some Chinese users thought they were using a large Chinese AI model, but in fact the problem was transferred to a large American AI model for processing.
Anthropic pointed out that the scale of this operation is quite impressive. In a 10-day period alone, nearly 300,000 customer requests were forwarded, involving 5,380 fraudulent accounts, most of which appeared to be located in Singapore and Japan. Between May and July 2026, Anthropic observed distillation activity attributed to Dark Side of the Moon, accumulating more than 23 million interactions.
Anthropic also alleged that Dark Side of the Moon preserved at least some of the forwarded conversations in an attempt to obtain the model's inference trajectory for use in training its own model.
However, this operation of "stealing" a large American AI model unexpectedly caused China's own data security risks. Anthropic found that a user it judged might be related to the People's Liberation Army of China thought he was using a Chinese AI and submitted CCTV surveillance data of a specific person to the system for analysis, asking to determine whether the monitored subject exhibited abnormal behavior. As the relevant request was forwarded, this batch of data entered the Anthropic system.
More sensitively, Anthropic pointed out that the relevant information involves hundreds of monitors in Chengdu, including cameras located near People's Liberation Army facilities, research institutions affiliated with China Electronics Technology Group, and a large Chinese state-owned enterprise. Surveillance information that was originally thought to be handed over to China AI for processing was instead transferred to Anthropic in the United States because Chinese AI companies were suspected of using Claude without authorization.
Users suspected to be related to the People's Liberation Army are not the only ones affected. Anthropic stated that when an engineer from a large Chinese state-owned enterprise used Chinese AI to help build internal systems, he also exposed the internal program codes and still valid access credentials of many large Chinese enterprises, including well-known Chinese technology companies. Anthropic specifically pointed out that the engineer had no obvious way to know that the content he submitted to China AI would be forwarded to Claude.
Anthropic stated that it is currently unclear whether The Dark Side of the Moon has ever been disclosed to customers, and their requests may have been redirected to Anthropic and exposed to third parties. Originally, Chinese AI companies were accused of using large American AI models without authorization, but now they have turned into their own security risks. Even surveillance data suspected to be related to the People's Liberation Army and internal information of large Chinese companies have entered the Anthropic system due to the transfer mechanism.
Dark Side of the Moon is not the only Chinese AI player to be named. Anthropic also accused DeepSeek of conducting similar operations. The transferred sensitive content included AI projects of Chinese technology companies, Chinese public security surveillance systems, and even valid access credentials for government agency databases related to the Russian Ministry of Defense.
The whole incident has a very ironic outcome. Chinese AI companies were accused of using large American AI models without authorization in the hope of improving their own model capabilities. However, by secretly forwarding customer requests, their own sensitive data entered the American AI company's system. It originally wanted to obtain technology from American AI, but in the end it paid the price for its own data security first.
