Anthropic's September threat report names seven China-based labs running industrial-scale distillation against Claude. The largest campaign, attributed to Alibaba, ran 151 million exchanges between May and July, peaking near 3 million a day across more than 3,500 fraudulent accounts, and went after chain-of-thought traces specifically. Moonshot ran 23 million over the same window. DeepSeek ran 12.1 million in fourteen days in July.
The number that changes something for you is 300,000. That is roughly how many of its own paying customers' requests Moonshot relayed to Claude in a single ten-day stretch, through 5,380 fraudulent accounts registered mostly in Singapore and Japan, displaying Claude's answers to those users as its own output and keeping a portion of the exchanges for a reasoning-extraction pipeline. DeepSeek is described doing the same thing. Anthropic says some of the relayed requests contained sensitive information.
So the model behind an endpoint is an assumption, not a term in a contract. Your vendor's model name, its residency statement and its subprocessor list describe the path your tokens were supposed to take. The only artifact you hold that reflects the path they actually took is the response body, which is where your checks have to live.
Two documents landed three days apart. On 8 September, CISA published advisory AA26-251A with the NSA and FBI, naming six China-based AI companies running knowledge distillation campaigns against US frontier models since at least late 2024: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. On 11 September, Anthropic published its September threat intelligence report covering activity it disrupted between December 2025 and August 2026, and named seven labs in its distillation section: Alibaba, Moonshot, DeepSeek, Z.ai, MiniMax, Xiaomi and SenseTime.
The lists do not match. CISA names StepFun and Anthropic does not. Anthropic names Xiaomi and SenseTime and CISA does not. That gap is the most useful thing in either document, because it tells you each organisation is reporting only the traffic it could see from where it sits. Nobody has the union.
The extraction half is the boring half
Most of the coverage stopped at the headline, which is that competitors trained on frontier outputs to skip the expensive part. Distillation is a normal training technique. The advisory's complaint is scale and consent: query volumes "in the thousands to millions per domain, far exceeding legitimate research or development use cases," run through fraudulent accounts, bulk premium subscriptions shared across teams, and a gray market of proxies the advisory calls "transfer stations" that exist to route around geographic restrictions.
The mechanically interesting part is what they were collecting. Not answers. Reasoning. CISA describes operators writing prompts that instruct the model to imagine and articulate its internal reasoning, which is a way to extract a chain of thought from a model that does not hand you one. Anthropic's largest documented campaign was aimed at the same target. The valuable artifact was never the final token, it was the path to it, because that is the part a smaller model cannot reconstruct on its own.
Anthropic's response options, as the advisory lays them out for providers generally, are rate limits per key and per IP, progressive throttling, differential privacy on responses, and serving downgraded models to traffic that looks like distillation. All of those are controls a provider applies to its own inference. None of them are available to you.
Two labs inverted the pipe
This next part belongs in a vendor review, not a news feed.
Moonshot, per Anthropic, routed customer requests through Claude in some instances, displayed Claude's responses to its users, and retained at least a portion of those exchanges for a chain-of-thought extraction pipeline. The access came from 5,380 fraudulent accounts, most of them presenting as based in Singapore and Japan, which is how the traffic got past restrictions on access from China. In one ten-day window that came to almost 300,000 relayed customer requests, the large majority of them going to Opus models. DeepSeek is described using the same tactic, routing live customer conversations through Claude instead of processing them locally.
Read that as an operation and it is capability theft with a clever funding model, because the users supply the prompt distribution for free. Read it as a supply chain and it is something else. Somebody sent a prompt to a Chinese model endpoint, got an answer back, and the answer came from Anthropic's servers by way of a fake account in Singapore. The response looked like the product. The invoice looked like the product. The data path did not resemble anything in the product documentation.
Anthropic says some of those relayed requests contained sensitive information. It is not in a position to say whose, because from its side those were just API calls from accounts in Singapore.
The same market runs in the other direction. TheHackerNews notes the proxy layer created a secondary market where labs buy harvested user-Claude exchanges outright, and SenseTime is described purchasing user conversation transcripts from third-party data vendors rather than collecting them itself. CNBC reported last week on resellers offering Claude capacity at steep discounts off Anthropic's list prices by pooling subscription accounts. If you have ever been offered frontier tokens at a price that did not make sense, this is the shape of the thing that makes the price work. The discount is not efficiency. The discount is the transcripts.
What your paperwork actually covers
Every vendor questionnaire you have filled in this year has a question about subprocessors and a question about where inference happens. Both questions assume the answer is knowable from the vendor's side and reportable in good faith. In these cases it was neither. A customer with a strict data-residency requirement, talking to an endpoint hosted where they wanted it hosted, had their prompt forwarded to a US provider through an intermediary jurisdiction, by a vendor that had an incentive not to mention it.
There is no configuration flag that protects you from that. The disclosure control failed, and disclosure controls are most of what a procurement process is made of.
The checks that survive this
The one signal you own is the response. Everything below works without any cooperation from your vendor.
Put canaries in your prompts. A rare, structured token in a system prompt, a made-up identifier, or an instruction with a distinctive answer format gives you something to grep for later. This will not tell you where a request went, but a canary that surfaces in another product's output, or in a model's later behaviour, is the only positive evidence of relay that a customer has ever been able to produce.
Fingerprint the model you are paying for. Keep a small fixed probe set, twenty or thirty prompts, and log full responses with latency on a schedule. You are watching for discontinuity: tokenisation quirks, refusal phrasing, formatting habits, latency distribution, how it handles a deliberately ambiguous instruction. A vendor swapping its own model version shifts these. A vendor relaying to somebody else's model shifts them hard, and the latency of a round trip through a proxy is difficult to hide.
Invert CISA's provider signals and point them at your supplier. The advisory tells providers to flag accounts that open at maximum throughput with no ramp, and individual subscriptions carrying enterprise-scale volume. The customer-side version is a capability jump with no release note. A small lab's model that gets materially better at long-horizon reasoning between two point releases, with no paper and no architecture change, has acquired that from somewhere.
Treat reasoning traces as the sensitive field. If your vendor exposes chain-of-thought, that is the thing worth harvesting, per both documents. Log it if you need it, and do not send anything into a prompt whose reasoning trace you would not want retained by an unknown party for training.
And write the assumption down. Your architecture diagram has a box with a model name in it. Add a line saying what evidence you hold that the box contains that model. For most teams the honest answer is the vendor's word and an invoice, and that is worth knowing before an auditor asks rather than after.
Anthropic caught this because it owned the inference and could see 3 million exchanges a day arriving from accounts that had no business existing. You own no inference. The traffic that matters to you is traffic you cannot see, running on infrastructure you do not control, described by a document written by the party with the incentive. The response body is the whole of your telemetry. Start reading it.