The loudest claim in the Anthropic Moonshot report is that Kimi K3 was sometimes Claude answering behind a Chinese label. The weaker claim is the one the report can actually show: a set of accounts, a pattern of traffic and an absence of any identifier tying that traffic to the accused company.
What the Anthropic Moonshot report actually claims
The Anthropic Moonshot report is a September 2026 enforcement disclosure in which Anthropic accuses Moonshot, the Chinese company behind the Kimi open-weight models, of using thousands of fake accounts to reach Claude harvest its outputs for distillation. Anthropic frames the activity as unauthorized access rather than a technical vulnerability, and says most diverted traffic went to Opus, the company's largest model, instead of a cheaper option.
The specifics matter more than the framing. Anthropic says it traced 23 million exchanges between May and June 2026 to accounts it attributes to Moonshot, up from 3.4 million exchanges in a February 2026 accusation against the same company. The transcript of the 5 October 2026 video by mano deyvin also cites a working average of roughly 300,000 requests across ten days, a figure that describes the pace of the alleged activity rather than its total.
Anthropic own framing puts the accused traffic through accounts registered mostly in Singapore and Japan, which fits the fact that Anthropic does not offer Claude inside mainland China. A customer in China who wants Claude to reach it from outside, and that geographic gap is the opening the report describes.
The report's most consequential allegations are not about model quality. Anthropic says diverted prompts carried whatever the customer pasted: in one cited case, footage from a surveillance camera that a user asked the model to assess, and in another, source code and credentials belonging to several large Chinese technology companies. Those details turn a commercial complaint into a data-handling story.
How the alleged Claude fallback worked
The alleged mechanism was a relay: a customer sent a request to Kimi, Moonshot's system forwarded a share of those requests to Claude Moonshot returned Claude answer as if Kimi had produced it. Anthropic describes the setup as a network of roughly 5,380 accounts built to look like ordinary users outside China, and the report says the relay was selective rather than universal, which is why Kimi kept serving most traffic itself.
The distinction between serving and training is the part Anthropic leans on. Anthropic says Moonshot was not only proxying answers but retaining the conversations to train its own models, a practice known as distillation. Distillation itself is ordinary: labs routinely train smaller models on the outputs of larger ones, and Anthropic complaint is about the method, not the technique. The accusation is unauthorized collection through misrepresented accounts, not the existence of distillation in the industry.
Anthropic adds a detail about reasoning traces. Claude does not hand over its internal reasoning in raw form, so the report describes a workaround in which an account would OpenAI fresh session and ask Claude to restore or restate the hidden material. That claim is the hardest to check from outside, because it depends on internal logs nobody else can read.
The timeline matters for anyone who tested Kimi. The report describes activity concentrated between May and July 2026, while Kimi K3 itself was released on 16 July 2026 as an open-weight model with a very large parameter count, a one-million-token context window and pricing close to Claude. A user testing the model in August, as the video's author did, has no way to know which responses, if any, came from a relay.
Why Kimi K3 made this dispute plausible
Kimi K3 arrived with strong credentials, and that is what gave the accusation room to spread. Moonshot released the model on 16 July 2026 as an open-weight release, and it debuted at the top of a front-end coding benchmark ahead of the then-leading Claude Code, a result that drove a wave of commentary about Chinese labs catching up.
Commercial signals followed the benchmark. A report attributed to Bloomberg, based on an unnamed source and repeated in the video, put Moonshot's annualized revenue at roughly $300 million in June 2026 and above $1 billion by August 2026. The transcript treats that figure as background rather than proof of anything, and it should be read that way: revenue reported from an anonymous source shows investor interest, not model provenance.
Cheap, strong models create the exact conditions for suspicion. When a model performs near the frontier while charging far less, buyers ask how, and "how" has only a few plausible answers: efficient training, efficient serving, or outputs obtained somewhere else. Kimi's open weights give researchers something to inspect, but an open release does not explain how a hosted endpoint behaved during a specific window.
The "I am Claude" tests and what they do not prove
Before any formal report, researchers at MATS, an AI safety research program, reported that Kimi identified itself as Claude in about four of ten identity prompts. The observation circulated widely in late July 2026, and the same researchers noted that the behavior stopped after roughly 20 July 2026, around the time the story spread and someone may have adjusted the model's responses.
Those researchers were careful about interpretation, and readers should be too. A model that claims to be Claude be repeating text it absorbed during training, a well-documented behavior in language models trained on web data full of Claude transcripts. Identity answers are weak evidence: they are consistent with distillation, with contaminated training data, and with a deliberate system prompt, and they cannot separate those explanations.
The timing cuts both ways. A change on 20 July could reflect a patch added after public attention, or it could reflect an upstream change unrelated to the accusation. The tests are a reason to look at the report, not a substitute for its evidence.
The 208 indicators problem: what outsiders can verify
Anthropic published 208 public indicators alongside the report, and the file does not name Moonshot in any of them. That is the central evidentiary weakness. A reader who opens the supporting data finds patterns of account and traffic behavior, but no identifier that ties those accounts to the accused company, which means the most explosive claims rest on internal logs only Anthropic see.
This is not a new complaint. In November 2025, security researcher Kevin Beaumont publicly pressed Anthropic for proof that an outside party could check after a similar enforcement disclosure, and the 208-indicator file reads as a partial answer to that pressure. A file with no direct attribution does not satisfy the demand it responds to.
The gap does not prove Moonshot innocent. Account networks are hard to attribute, and a company operating through proxies would not leave its name in the traffic. The honest position is that Anthropic described an observable pattern and drawn an attribution from it, and the public has been given the pattern without the attribution evidence.
What Moonshot has and has not said
Moonshot has not issued a substantive public rebuttal to the September 2026 report. Silence is often read as guilt in these disputes, and that reading is unreliable: a company facing an accusation built on another firm's internal logs has limited ability to disprove it, and legal counsel may prefer a short denial to a detailed argument conducted in public.
The consequence is that the dispute remains one-sided in the public record. Anthropic publishes; Moonshot stays quiet; commentators fill the space. Anyone citing the report should say which side of that asymmetry they are repeating, because a one-sided record is a description of the record, not a verdict.
It is also worth naming the incentive. Anthropic competes directly with Moonshot for coding and agent workloads, and enforcement disclosures against a cheaper rival carry a commercial benefit regardless of whether the underlying findings hold. That does not make the findings false. It does mean the report should be read as a company's account of its own logs, not as an independent audit.
The part that applies to every developer
Whatever the outcome, one lesson holds for anyone using a hosted model: every prompt leaves your machine, and the route it takes is not something you can audit. The report's cited cases involve surveillance footage and proprietary source code pasted into a chat window, and the customers in those cases believed they were talking to one vendor.
You can reduce exposure without waiting for a verdict. The following steps help regardless of which provider is accused next.
- Treat any hosted endpoint as a third party that may log, retain or forward your input, and keep credentials and production data out of prompts.
- Review your agent's local history, since coding agents such as Claude Code keep conversation logs on disk that may contain pasted secrets.
- Run a secret scanner over those logs. TruffleHog is one open-source tool that searches for exposed credentials in files and repositories.
- Prefer providers whose data-handling terms you have actually read, and prefer open-weight models you can host when the input is sensitive.
The report also illustrates a limit of any provider's promise. Anthropic not offer Claude in mainland China, yet the allegation is that Claude answered requests originating there. A geographic restriction describes a policy, not a technical boundary, and customers should not treat either as a guarantee about where their data goes.
FAQ
- What is the Anthropic Moonshot report? It is a September 2026 disclosure in which Anthropic accused Moonshot of using thousands of fake accounts to reach Claude train Kimi on its outputs. The report describes roughly 23 million exchanges between May and June 2026 and frames the activity as unauthorized distillation.
- Did Kimi K3 actually run on Claude? Anthropic alleges that a portion of Kimi traffic was relayed to Claude, mostly Opus, and returned to customers as Kimi output. The report does not claim that all Kimi traffic was relayed, and no public evidence lets an outside party confirm which requests, if any, were affected.
- What do the 208 public indicators show? The file published with the report describes account and traffic patterns, and none of its entries names Moonshot directly. That means the attribution to Moonshot rests on Anthropic internal logs rather than on data an independent researcher can check.
- Does Kimi saying it is Claude prove distillation? No. A model can identify itself as Claude because it absorbed Claude transcripts during training or because of a system prompt. The MATS researchers who ran the identity tests treated the result as suggestive, not conclusive.
- Is distillation illegal? Training a smaller model on a larger model's outputs is a common industry practice and is not illegal by itself. Anthropic accusation concerns how the data was obtained, specifically through accounts it says misrepresented their users and violated its terms.
- Has Moonshot responded to the accusations? Moonshot had not issued a substantive public rebuttal as of the video's publication on 5 October 2026. Silence does not establish that the allegations are true, and it leaves the public record one-sided.
- Should developers stop using Kimi because of this? The decision depends on your data, not on the dispute. Prompts sent to any hosted model leave your control, so the practical step is to keep secrets out of prompts and review your agent's local history.
- Why does this matter for coding agents? Coding agents handle source code, credentials and internal architecture, which is exactly the material the report says was exposed. A relay that forwards requests to another vendor moves that material across a boundary the customer never agreed to.
- What should I watch for next? Independent verification, a detailed response from Moonshot, or regulatory attention would each change the picture. Until one of those arrives, treat the report as a serious allegation from a competitor with its own interests.
Turning a recorded argument into a written record
A dispute like this one produces hours of video commentary, and the useful parts, the sequence of dates, the numbers and the caveats, are hard to find inside a fifteen-minute conversation. Written coverage gives readers something they can check line by line, which is exactly what a report built on unattributed traffic needs.
If you already explain technical stories on YouTube, that same material can become an article people can cite rather than a video they have to rewatch. Skalablog turns a YouTube link into a transcription and then into a structured draft, so an argument you recorded once can be edited into something durable.
Skala Blog keeps the source video and the written version connected, which matters when a claim needs to be traced back to the moment it was made. The reader gets a page to search and quote; you get a second format without recording again.