China's artificial-intelligence race with the United States has produced another remarkable twist.
Beijing's internet regulator is reportedly investigating two of China's most prominent AI laboratories — DeepSeek and Moonshot AI — following allegations from American AI company Anthropic that the Chinese companies secretly routed user requests through Anthropic's Claude models.
The allegations are serious.
But the most important question isn't simply whether DeepSeek or Moonshot copied capabilities from Claude.
It is this:
Did Chinese users unknowingly send potentially sensitive information to an American AI company through systems they believed were Chinese?
According to The Information, China's Cyberspace Administration is examining whether DeepSeek and Moonshot transmitted sensitive data involving Chinese police, military and state-linked companies to Anthropic. The report says the regulator's investigation follows allegations made by Anthropic.
That changes the story completely.
This is no longer merely about who trained their AI model on whose outputs.
It becomes a question of sovereignty, disclosure and control of data.
The allegations began with Anthropic
Anthropic has been accusing Chinese AI laboratories of large-scale attempts to extract capabilities from Claude for months.
In February, the company said it had identified what it described as industrial-scale distillation campaigns involving DeepSeek, Moonshot and MiniMax.
Anthropic claimed the three laboratories generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts.
The company said the operations targeted different capabilities.
DeepSeek allegedly focused on reasoning, coding-related tasks and techniques that could help train another model.
Moonshot allegedly targeted Claude's agentic reasoning, computer use, coding, data analysis and computer vision capabilities.
MiniMax, according to Anthropic, generated the largest volume of traffic, targeting agentic coding and tool use.
These are Anthropic's allegations, not findings by a court.
But they provided the foundation for the latest controversy.
Then came the more explosive allegation
The new claim goes further.
Anthropic alleges that Moonshot didn't merely send researchers' prompts to Claude to study its answers.
It says Moonshot routed actual customer requests through Claude.
According to Bloomberg, Anthropic identified nearly 300,000 customer requests that Moonshot sent primarily to Claude Opus. Anthropic said Moonshot used thousands of fraudulent accounts and proxy infrastructure because Claude isn't officially available in China.
If accurate, this would be a fundamentally different problem from ordinary model distillation.
Imagine opening an AI application believing you are interacting with Model A.
You enter a confidential business question.
You paste some internal code.
You upload information about your company.
You ask a question about a government project.
But behind the interface, your request is secretly forwarded to Model B, operated by a foreign company.
The user may never know.
That is the issue now hanging over the investigation.
The data-sovereignty question
China has spent years emphasizing control over data generated inside its borders.
Its cybersecurity and data-security framework places considerable importance on the handling, transfer and protection of data considered important or sensitive.
That makes the alleged routing of Chinese users' information to Anthropic particularly sensitive.
The issue isn't simply that Anthropic is an American company.
It is that the destination of the data may have been concealed from the people generating it.
A user who deliberately chooses Claude and understands that the information is going to Anthropic has made one kind of decision.
A user who thinks they are interacting with a Chinese AI system and unknowingly has their request routed through a foreign model has made another.
Consent and disclosure therefore become central questions.
And some of the alleged data could be extremely sensitive
The Information reported that Chinese regulators are examining whether sensitive data connected to police, military organisations and state-linked companies was sent to Anthropic.
If that allegation is substantiated, the consequences could extend well beyond the commercial AI industry.
Consider what an enterprise AI user might put into a model:
Internal software code.
Corporate strategy.
Customer information.
Financial documents.
Research.
Government records.
Security information.
Technical specifications.
Unpublished intellectual property.
The entire AI industry is confronting this issue.
AI models are increasingly becoming repositories of corporate knowledge.
That makes the question of where prompts go almost as important as where cloud servers are physically located.
There is another layer: distillation
To understand why Anthropic is angry, it is necessary to understand "distillation."
Model distillation itself is not inherently illegitimate.
It is a standard machine-learning technique.
A smaller model can learn from the outputs of a larger model, allowing developers to create cheaper or more efficient systems.
Anthropic acknowledges that frontier AI companies themselves routinely use distillation for legitimate purposes.
The dispute concerns how the information is obtained.
Anthropic alleges that DeepSeek, Moonshot and MiniMax used fraudulent accounts, proxies and carefully designed prompts to extract capabilities from Claude at enormous scale.
Anthropic says Moonshot generated more than 3.4 million exchanges in its alleged campaign.
DeepSeek's alleged operation involved more than 150,000 exchanges.
MiniMax's allegedly involved more than 13 million.
Again, those figures come from Anthropic's investigation.
They have not been independently established as court findings.
But they demonstrate why the issue has escalated.
The AI arms race has become an information war
There is a deeper geopolitical story here.
For years, the central U.S.-China AI competition was framed around chips.
Who gets the most advanced Nvidia processors?
Who can manufacture advanced semiconductors?
Who has the largest data centres?
Who has the most computing power?
Then the competition moved toward models.
Now it is increasingly about data and model outputs.
The reason is simple.
A frontier AI model contains enormous amounts of accumulated engineering knowledge.
Its behaviour represents billions of dollars of research, computing and experimentation.
If another company can systematically query that model and use the resulting answers to improve its own system, it may potentially compress years of development.
That is why Anthropic describes large-scale distillation as a threat to the competitive advantage created by restrictions on access to advanced U.S. AI systems.
China rejects the broader American narrative
There is another side to this story.
Beijing has rejected U.S. accusations of industrial-scale AI model theft.
Chinese officials have argued that Washington is using national-security arguments to constrain China's technological development.
The South China Morning Post reported that Beijing rejected recent American accusations involving Chinese AI companies, describing them as efforts to suppress China's AI industry.
That context matters.
This is taking place during an intense technological rivalry in which both governments increasingly view AI as a strategic capability.
Washington restricts access to advanced semiconductors.
China accelerates domestic AI development.
American laboratories accuse Chinese companies of circumventing restrictions.
Chinese officials accuse Washington of technological containment.
Each side increasingly views the other's AI ecosystem through a national-security lens.
That makes independent verification particularly important.
DeepSeek is hardly an insignificant player
The timing is also notable because DeepSeek has moved from being a relatively obscure Chinese research operation to one of the most internationally recognised Chinese AI laboratories.
Reuters reported on September 22 that DeepSeek has been invited to brief the United Nations Security Council on AI risks, alongside other Chinese AI companies including Moonshot.
That means DeepSeek is simultaneously becoming part of the international conversation about AI governance while facing allegations concerning how AI capabilities were obtained.
Those are two very different issues.
Participation in international AI governance does not prove anything about the allegations.
Likewise, the allegations do not establish that DeepSeek is incapable of developing its own technology.
The two questions should remain separate.
Moonshot presents an even more interesting case
Moonshot AI's Kimi has become one of China's leading frontier AI products.
The Financial Times recently described the company as challenging leading U.S. laboratories with increasingly capable models.
That is important because it demonstrates how quickly China's AI sector is developing.
But it also explains why model distillation has become such a sensitive issue.
If a Chinese company can acquire access to a leading American model and use its outputs to accelerate development, the strategic implications extend beyond one company's intellectual property.
It could potentially reduce the technological distance between two competing national AI ecosystems.
And this is where the data issue becomes uncomfortable
There is a paradox at the centre of the controversy.
The same technique that could allow an AI company to improve its model — sending enormous numbers of prompts to a more powerful foreign model — could also expose the data of the people generating those prompts.
That creates two different forms of extraction.
Model extraction: learning from another company's AI outputs.
Data extraction: transmitting users' information to another company's infrastructure.
The first is primarily an intellectual-property and competitive issue.
The second can become a privacy, cybersecurity and national-security issue.
If both happened simultaneously, the consequences would be considerably more serious.
The users may be the people caught in the middle
There is an important group largely absent from the geopolitical argument:
ordinary users.
Imagine a Chinese engineer using an AI assistant to troubleshoot proprietary software.
Or a lawyer analysing a confidential contract.
Or a company executive preparing a merger strategy.
Or a government employee working with sensitive documents.
If the interface says "Kimi" or another Chinese model but the request is secretly processed by Claude, the user may have no meaningful opportunity to assess that risk.
That is why transparency matters.
An AI provider should be able to tell users:
- which model is processing their request;
- where their data is being processed;
- whether information is shared with another provider;
- how long it is retained;
- whether it can be used for training;
- and what happens when a third-party model is involved.
Those principles aren't uniquely Chinese or American.
They are increasingly fundamental to trustworthy AI.
The investigation could expose something bigger
The reported Chinese investigation could therefore have consequences beyond DeepSeek and Moonshot.
If regulators find that sensitive Chinese data was transferred to a foreign AI company without appropriate disclosure or authorization, Beijing could tighten rules around third-party model access.
AI companies might be required to disclose every external model used behind their interfaces.
Enterprise customers could demand stronger data-localisation guarantees.
Government agencies could impose restrictions on foreign model routing.
And AI developers may increasingly have to prove not only what their model can do, but what happens to every piece of data passing through it.
That would be a major development.
The irony of the AI race
The U.S. and China are competing to build increasingly sovereign AI systems.
Washington wants American companies to maintain leadership in frontier models.
Beijing wants domestic companies to reduce dependence on foreign technology.
But the latest controversy suggests that the frontier is becoming increasingly interconnected.
Chinese AI companies may want access to American models.
American companies want to prevent that access.
Chinese regulators may now be investigating whether Chinese users' information crossed the same technological boundary.
And governments on both sides are increasingly treating AI infrastructure as strategic infrastructure.
The internet once made borders less important.
AI may be making some borders important again.
This is no longer just about who has the smartest model
The AI competition is becoming a contest over several things simultaneously:
Compute.
Chips.
Models.
Training data.
User data.
Intellectual property.
Cloud infrastructure.
Cybersecurity.
National regulation.
And increasingly:
trust.
A model can be extraordinarily capable and still lose users if they cannot trust where their information goes.
That may ultimately be one of the most important battlegrounds in AI.
The unanswered questions
The reported Chinese investigation raises several questions that cannot yet be answered from the public evidence.
Did DeepSeek actually route sensitive customer information to Anthropic?
Did Moonshot?
What proportion of the alleged requests contained identifiable or commercially sensitive information?
Were users informed?
Did Chinese state or military information actually pass through Anthropic's infrastructure?
Was any of the information retained?
Was it used for training?
Did the companies deliberately conceal the routing?
And, perhaps most importantly:
How much of Anthropic's evidence can be independently verified?
Those questions matter because Anthropic is not a neutral observer.
It is a direct competitor in the AI race.
Its investigation deserves serious attention, but its allegations should remain allegations until independently established.
The next AI battlefield may be trust
The extraordinary thing about this episode is that it began as a story about AI copying.
It may end as a story about AI privacy.
The original argument was:
Did Chinese AI companies use Claude to improve their own models?
The more consequential question may now be:
Did users unknowingly send their information through Claude while believing they were using a Chinese AI system?
If the answer is eventually established, the implications will extend far beyond Anthropic, DeepSeek and Moonshot.
Because the fundamental promise of an AI assistant is simple:
You tell it something, and you expect to know where that information goes.
When that expectation disappears, the AI race stops being merely a competition over intelligence.
It becomes a competition over who controls the world's information — and who gets to decide where that information travels.
That may be the real strategic battle hiding behind the latest DeepSeek-Moonshot controversy.
Comments
Post a Comment