Chinese artificial intelligence companies secretly routed millions of user interactions through Anthropic’s Claude while trying to improve their own models, in some cases exposing sensitive Chinese military, police and corporate information to the U.S. AI company, according to a new threat intelligence report.
Anthropic said its investigation uncovered large-scale attempts by China-based AI laboratories to extract Claude’s capabilities through a technique known as model distillation. But the operation had an unexpected consequence: some Chinese users who believed they were communicating only with domestic AI systems were unknowingly sending sensitive information to Claude.
Among the data allegedly exposed were surveillance records linked to a user believed to be affiliated with China’s People’s Liberation Army, internal credentials from major Chinese companies, information from a municipal public-security bureau and sensitive material connected to a Russian government agency.
The findings were published in Anthropic’s Sept. 10 threat intelligence report, which examined malicious or unauthorized uses of Claude detected over the previous eight months.
Reuters separately reported that Anthropic accused seven China-based AI laboratories, including Alibaba, Moonshot AI, DeepSeek and Xiaomi, of attempting to extract capabilities from Claude.
For the best of our weekly content！
You are now signed up for our newsletter
Check your email to complete sign up
Chinese users allegedly sent sensitive data to Claude without knowing it
One of the most striking cases involved Moonshot AI, developer of the popular Kimi chatbot.
Anthropic said Moonshot at times “silently forwarded customer requests to Claude” instead of processing them entirely through Kimi. In one 10-day period, Anthropic said nearly 300,000 customer requests were routed through a network of more than 5,000 accounts, mostly appearing to originate in Singapore and Japan.
Anthropic said the exchanges were then used to help train Moonshot’s own models. From May through July, the company attributed more than 23 million Claude exchanges to Moonshot-related distillation activity.
Some of the information was highly sensitive.
In one instance, a user Anthropic assessed as likely affiliated with the PLA uploaded surveillance information while believing he was using Kimi. The user wanted the AI to determine whether a person under surveillance was behaving abnormally.
According to Anthropic, the material came from hundreds of cameras in Chengdu, including cameras outside PLA facilities, institutions affiliated with state-owned defense electronics giant China Electronics Technology Group Corporation, and a major state-owned enterprise.
Another engineer used Kimi while developing an internal system for a major Chinese state-owned enterprise and entered internal source code and active credentials from several major Chinese companies.
Anthropic said the engineer “had no way of knowing” that his interactions were being forwarded to Claude.
DeepSeek allegedly used similar methods. Anthropic said DeepSeek silently routed selected user requests to Claude Opus and attempted to extract Claude’s reasoning traces for training.
One Chinese technology employee unwittingly exposed documents containing the full specifications, organizational structure and strategic objectives of a major AI program, Anthropic said.
Another case involved an IT operator working with information from a Russian government agency connected to the Ministry of Defense. The requests allegedly exposed live credentials for a Russian government database.
In China, engineers building a case-management system for a municipal Public Security Bureau used DeepSeek to create a tool linking citizens’ national identification numbers to their movements and police records. Anthropic said those interactions were also routed to Claude.
Anthropic estimated that DeepSeek generated more than 12.1 million such exchanges during just 14 days in July. Reuters reported that Anthropic characterized the wider operation as part of increasingly sophisticated efforts by Chinese AI laboratories to copy capabilities from leading U.S. models.
Claude used to model attacks on Taiwan and monitor dissidents
Anthropic’s report also detailed cases in which China-linked users allegedly employed Claude directly for military and surveillance work.
One China-based actor used Claude to develop a roughly 16-module electronic-warfare system designed to analyze radar installations, surface-to-air missile batteries, command posts and communications infrastructure.
Anthropic said the software calculated radar detection areas and jamming effectiveness and “ranked targets by value and vulnerability.” It could also model the engagement ranges of systems including the U.S.-made Patriot missile system and THAAD.
Partway through development, Anthropic said the user changed the simulation to focus on “12 targets in Taiwan.”
Those targets included a command bunker, an early-warning radar installation, Patriot and Taiwan-developed Tien Kung missile batteries, major air bases and a regional combat command headquarters. Anthropic said account information and other evidence linked the actor to Chinese defense and military-industrial research institutions, including the PLA Academy of Military Sciences.
Reuters reported that Anthropic banned accounts associated with the operation. China claims Taiwan as part of its territory and has not ruled out the use of force to bring the democratically governed island under Beijing’s control. Taiwan rejects Beijing’s sovereignty claim.
Other China-linked users allegedly employed Claude to conduct political and religious surveillance.
Anthropic said one operation monitored dissidents, overseas Chinese communities, Uyghurs, Tibetans, political figures in Taiwan, labor and student activists, and foreign media. The system processed Western and Taiwanese reporting, assigned political-sensitivity scores and transformed the material into standardized government-style intelligence briefings.
Another operation collected intelligence on Catholic cardinals, Taiwanese Christian leaders, Tibetan Buddhist groups and Falun Gong practitioners and affiliated media. Anthropic said users instructed Claude to produce structured dossiers and intelligence reports using terminology associated with Chinese state-security organizations.
The wider report also described attempts around the world to use Claude in biological research that could support weapons development, as well as work involving missiles, armed drones, firearms and other weapons systems. Anthropic said it blocked accounts associated with the activities and used what it learned to strengthen its safeguards.
China’s Foreign Ministry told Reuters it was not aware of Anthropic’s report. It said Beijing believes AI should be “developed for good” and opposes “distortion of facts and smears” against China.
Original article
Comments