AI · ANALYSIS

What Is Claude Accusing Alibaba and Kimi Of?

Who said AI companies cannot have a thriller soap opera!

The latest episode stars Anthropic, the company behind Claude, and two formidable rivals: Alibaba and Moonshot AI, the maker of Kimi. Anthropic’s September 2026 report accuses both of unauthorized extraction of Claude’s capabilities. Cue the accusations, the questions about covert access, and a fight over who gets to learn from whom.^[1]

But the plot twist worth watching concerns the customer. You send sensitive information to one AI provider. Could another provider be processing it behind the scenes? That possibility takes this beyond a squabble over cheaper training data.

Covert access and deception deserve scrutiny. So does the leap from “this model learned from ours” to “this is theft.” Anthropic deserves a hearing, and customers deserve clear answers about where their data goes. The drama is irresistible. The verdict still needs evidence.

1. What Alibaba and Kimi are accused of

Anthropic’s September 10 report describes two distinct allegations. The reported volumes below cover May through July 2026 and remain the company’s claims, not independently audited totals.^[1]

These are allegations about access and outputs, not a claim that someone physically removed a server or copied an entire model’s weights. Treating them as interchangeable forms of “AI theft” obscures what must actually be proved.

There are three separate questions. Was access authorized? Were responses used in ways that breached agreed restrictions? Were customers told which organizations would receive their information? A company could answer one question satisfactorily and still fail another. Paying an intermediary, for example, would not establish permission from the underlying provider.

That is why the customer question deserves equal billing with the competitive one. A dispute about training can be argued through contracts and technical evidence. A hidden change in who receives a customer’s information directly challenges the reliability of the service being sold.

2. Distillation is useful engineering, not automatically cheating

Distillation transfers useful behavior from a teacher model into a student model. Hinton, Vinyals and Dean’s foundational paper explained how knowledge from a cumbersome system could help train a model that was easier to deploy. The technique predates this dispute and has legitimate efficiency benefits.^[2]

The teacher supplies examples rather than handing over its complete internal machinery. The student is trained to reproduce useful responses. Think of worked examination answers: they can teach an approach without revealing everything the teacher knows. The resulting student need not become an exact clone.

Reasoning explanations can make those examples more valuable. Research published as “Distilling Step-by-Step!” used language-model rationales as additional supervision for smaller, task-specific models. This helps explain why a lab might seek worked solutions rather than final answers alone. A generated explanation is not, however, guaranteed to be a faithful transcript of every internal computation.^[3]

For a coding task, the difference is intuitive. A corrected function shows what worked. An explanation of the broken assumption, the rejected fix and the successful test may provide a richer teaching example. That is an illustration of the incentive, not proof that a particular company obtained a particular capability.

Nor does imitation guarantee equivalence. A 2023 study, “The False Promise of Imitating Proprietary LLMs,” found that imitation could reproduce a strong model’s style without reliably closing underlying capability gaps. Those older experiments do not settle what is possible in 2026. They do show why fluent resemblance is a poor substitute for controlled evaluation.^[4]

There is also an economic asymmetry worth confronting. A teacher can embody expensive experimentation, while a useful output may be inexpensive to request. For a rival, repeatedly buying the best worked examples could look more attractive than reproducing the experiments behind them. That creates a plausible commercial injury when reuse is prohibited. It does not establish the size of that injury. A serious damages argument would still need to distinguish the value of the disputed examples from the rival’s own architecture, data, compute and engineering.

The correct dividing line is therefore permission and conduct. Licensed teacher outputs, a company’s own models and openly permitted training material belong on one side. Misrepresented access and prohibited commercial reuse belong on the other. Calling both “distillation” does not make them ethically equivalent.

3. Why the Kimi routing allegation matters more to customers

Anthropic describes almost 300,000 customer requests relayed to Claude over ten days. Crucially, it also says it does not know whether Moonshot notified customers. Undisclosed routing must therefore be treated as an allegation, not an established fact about every affected customer.^[1]

That qualification limits the conclusion, but it should sharpen the investigation. The decisive evidence would include the relevant customer agreements, notices, actual routing records and the promises made for the affected service tier. A general privacy page is not necessarily an answer to a specific contractual promise.

Imagine a manufacturer choosing a hosted assistant after approving its processing locations and suppliers. If the assistant forwards a confidential engineering question to an unapproved company, the answer’s quality does not cure the failure. The customer bought a service under particular conditions, not merely a convincing paragraph.

Outsourcing itself is not the problem. A transparently disclosed service can legitimately combine providers. The problem would be selling one set of assurances while operating another arrangement behind the interface. Calling that arrangement a technical optimization would not resolve the mismatch.

Serving a request and retaining it for training also require separate scrutiny. A customer might accept temporary processing by an identified supplier while rejecting reuse of confidential material to improve another product. Permission to answer a question should not be casually stretched into permission to build a training collection.

Consent must also survive the chain of intermediaries. Suppose an application developer accurately tells customers that it uses Kimi, but its supplier adds another model without informing the developer. The developer’s disclosure may then become incomplete without any deliberate deception on its part. Investigators should establish where the assurance broke. Customers need a reliable account of the whole chain, rather than several providers each insisting that responsibility belongs somewhere else.

The remedy should follow the facts. Where disclosure and authorization were adequate, the service should be judged on those actual terms. Where they were not, customers deserve a clear incident account, meaningful choices and appropriate remediation. Treating them as collateral participants in a model rivalry would be the wrong priority.

4. Serious evidence is not the same as a complete public case

The chronology matters. Anthropic’s February 23 disclosure named DeepSeek, Moonshot and MiniMax, reporting more than 16 million exchanges across approximately 24,000 fraudulent accounts. It described attribution using several signals, including infrastructure and account metadata, with some industry corroboration.^[5]

In June, Reuters reported an Anthropic letter alleging an Alibaba campaign involving more than 28.8 million exchanges between April 22 and June 5. Those dates overlap the later reporting window. Adding the June and September figures would risk counting activity twice.^[6]

On September 8, the NSA, CISA and FBI issued a joint advisory accusing several China-based AI companies, including Alibaba and Moonshot, of industrial-scale distillation campaigns. That makes the issue more consequential. An institutional allegation is still not the same thing as an independently reproduced technical result or a judicial finding.^[7]

A rigorous assessment separates four propositions that headlines tend to collapse. Evidence of unusual account activity does not, by itself, prove who controlled it. Attribution does not automatically prove which production model consumed the resulting material. Training use does not quantify the performance improvement.

For access, investigators need records showing what happened and why it was unauthorized. For attribution, they need links stronger than a shared geography or a common reseller. For training use, relevant records might include reproducible data lineage and training configurations. For benefit, controlled comparisons should isolate the disputed material’s contribution.

The reported scale is a reason to investigate, not a substitute for that work. A request count cannot be converted directly into dollars of stolen research, a percentage of model intelligence or a number of months of development saved. Each claim would need its own methodology.

Independent review should test alternative explanations, too. Could a reseller have combined traffic from unrelated buyers? Do records distinguish a pilot experiment from a production training run? Were the relevant disclosures in force when the requests occurred? These questions are not excuses for the accused. They are the checks that make an adverse finding durable, and prevent an enforcement programme from punishing innocent customers who happened to share infrastructure.

Anthropic should not have to publish customer secrets or every detection method to deserve attention. Confidential independent review is a practical middle ground. The accused companies should likewise answer the conduct alleged with records, not simply point to impressive benchmarks. A persuasive rebuttal would address account control, training provenance and customer routing separately.

5. The hypocrisy argument matters, but it is not a defence

There is an obvious consistency test for the AI industry. A company that defends broad freedom to learn from other people’s work should expect hard questions when it demands strict control over learning from its own outputs. The ethical discomfort is real. It does not make covert access acceptable.

Copyright and contractual access are different questions. The U.S. Copyright Office’s May 2025 pre-publication report treats generative-AI training as a fact-dependent fair-use inquiry, not a blanket exemption or universal violation. That framework does not establish that every model output is protected, or that every act of distillation infringes copyright.^[9]

Anthropic’s published commercial terms separately restrict using its services to train competing models or build competing services without approval. They also permit customer-facing applications subject to the agreement. The existence of authorized applications makes the distinction clear: using another provider is not automatically misconduct, but agreed limits still matter.^[8]

Actual liability would depend on the applicable agreement, the parties, jurisdiction and proven conduct. A breach-of-contract allegation should not be casually rewritten as a criminal conviction. Equally, arguing that an output belongs to the customer does not automatically erase restrictions on how the service was accessed or used.

The standard should travel both ways. If an American lab bypasses another provider’s controls or misuses restricted material, its nationality should offer no exemption. If a Chinese lab learns from openly licensed material, its nationality should create no presumption of wrongdoing.

The industry needs workable permissions for synthetic training data, clearer licensing and enforceable limits on deceptive collection. It does not need a rule under which every successful teacher model can prohibit competitors from learning similar skills by legitimate means. Protect the agreement and the access boundary, not an unlimited claim over knowledge.

6. Chinese innovation is not on trial

China’s commerce ministry rejected the broader U.S. allegations as groundless and defended distillation as a common technical practice, according to Associated Press reporting on September 9. That response addressed the government advisory. It should not be presented as a detailed company rebuttal to Anthropic’s subsequent September 10 report.^[10]

The technical point is correct but incomplete. A legitimate method can be used through illegitimate access. Describing distillation as ordinary says little about whether the specific accounts, contracts or customer disclosures were proper.

At the same time, treating the allegations as proof that Chinese laboratories cannot innovate is intellectually lazy. Moonshot’s Kimi K2 technical report describes a mixture-of-experts architecture, an optimizer, large-scale pretraining and reinforcement-learning work. It also describes publicly available model weights. That is a substantive engineering account, although not an independent audit of all training provenance.^[11]

Two things can therefore be true at once: a team can do substantial original engineering and face legitimate questions about part of its training material. Neither achievement nor allegation cancels the other.

The distinction between a hosted service and a downloadable model matters as well. The routing accusation concerns how requests were served. It does not establish that every independently operated copy of a Kimi model contacts Claude. Buyers should examine their actual deployment rather than generalize from a product family’s name.

There is a constructive commercial alternative: negotiated licenses for teacher-generated material, with defined uses and safeguards. Such agreements would not solve every dispute, and no provider should be forced to offer unrestricted access. But a market for authorized reuse would make the boundary clearer. Competitors could pay for specified rights, and providers could enforce those rights without presenting all cross-model learning as an attack.

Competition is worth defending because customers benefit when capable alternatives have a fair chance. That defence becomes weaker, not stronger, when supporters excuse deceptive conduct. The best argument for competitive AI is that rivals can win under transparent rules, not that challengers should be allowed to break rules because incumbents are powerful.

7. Safety cannot become a blank cheque

Anthropic’s February disclosure argued that unauthorized distillation can remove safeguards and used the issue to support export controls. That is both a safety argument and a policy position serving the company’s competitive interests. Readers should evaluate those elements separately.^[5]

There is a genuine technical concern. Research by Qi and colleagues found that fine-tuning can weaken safety alignment, even without an explicitly harmful training objective. It supports testing how safeguards survive subsequent training. It does not establish that the particular Alibaba or Kimi models in this dispute are unsafe.^[12]

The appropriate response is evidence about the deployed model: what it refuses, what it enables, under which conditions and with what monitoring. A supplier’s nationality is not a substitute for those tests. Neither is the reputation of the teacher from which some training examples may have originated.

Policy should also be proportionate to the misconduct it can actually address. Blocking fraudulent accounts and improving contractual enforcement directly target unauthorized access. A sweeping restriction on legitimate research or lawful model exchange needs a separate justification. It should not slip through simply because the word “safety” makes a commercial complaint sound more urgent.

The principle is simple: investigate concrete abuse, assess real capability risks and demand the same discipline from the complainant. Safety loses credibility when it becomes a convenient label for protecting every existing commercial advantage.

8. What AI buyers should demand now

The immediate lesson for a buyer is not to ban a nationality. It is to stop treating a model name as a complete description of the service. Procurement should identify who processes requests, what can change and how those changes become visible.

NIST’s Generative AI Profile recommends managing third-party relationships, identifying entities with access to data, and addressing supplier evaluation and incident responsibilities. That provides a more useful procurement starting point than a league table of model scores.^[13]

The practical requirement is a documented processing chain. Contracts should name the relevant service providers, describe any fallback routing and specify whether customer material may be retained for training. A promise that data will not train the front-end vendor’s model should not leave unanswered what downstream providers can do.

Buyers should request evidence proportionate to sensitivity. For ordinary drafting, a clear disclosure may be sufficient. For confidential engineering, employee information or sensitive negotiations, require stronger contractual controls, configuration checks and auditable records. The objective is verifiable operation, not collecting another vague assurance.

Anthropic’s own data-processing addendum recognizes subprocessor authorization, notice and objection mechanisms. That document does not govern Moonshot’s customers, but it illustrates the point: additional processors are a subject for explicit contractual treatment, not merely an implementation detail.^[14]

The same scrutiny should apply to American providers, model routers and application developers. Ask who must notify whom after an unexpected transfer, what records will be preserved and which party can explain the event. Where an unauthorized transfer is confirmed, assess the information involved and take proportionate steps, including replacing exposed credentials where necessary.

Buyers should also distinguish a promised model from a promised outcome. An agreement that explicitly permits a pool of approved models leaves room for operational flexibility. An agreement that guarantees a particular model creates a different obligation. Both can be legitimate products. Trouble begins when marketing sells the certainty of the second while the infrastructure quietly operates like the first.

The strongest purchasing position is not permanent suspicion. It is retaining the ability to verify important promises and change suppliers when those promises fail. Excellent model performance cannot compensate for an operating arrangement that the customer never approved.

9. The verdict: defend consent, not a monopoly on learning

Anthropic is right to challenge covert, unauthorized extraction. If the alleged access abuse and prohibited reuse are established, the responsible parties should face proportionate contractual and legal consequences. Competitive pressure is not a defence for deception.

But the broader claim must remain bounded. Distillation is a useful training method, not a synonym for theft. Large query totals are not a measure of stolen intelligence. Chinese engineering does not become fictional because a company faces a serious accusation.

The customer should be at the centre of the outcome. Establish who received the information, what permission existed and whether service promises were honoured. Preserve legitimate research and competition while enforcing those boundaries consistently. That standard is demanding, but achievable. It protects innovation without asking customers to surrender control of their information to supplier convenience.

The burden is now practical: Anthropic should make its strongest evidence available for credible scrutiny, and Alibaba and Moonshot should answer the specific access, training and routing questions. A competition worth protecting is one where neither size nor outsider status buys an exemption from accountable conduct.

A good answer is not enough. An AI company must also be honest about how it obtained the capability, whose systems produced the response and where the customer’s information went. That is the side worth taking.