Anthropic’s threat intelligence chief Jacob Klein told CNBC that Chinese AI labs, specifically naming Moonshot AI, are accessing Claude models through fraudulent accounts purchased via dark web marketplaces selling stolen credit cards and compromised AI credentials. The practice , AI distillation , lets a “student” model learn from a more capable “teacher” by harvesting its outputs. Anthropic has separately confirmed Moonshot, DeepSeek, Alibaba, and MiniMax all ran distillation campaigns against Claude. A White House advisory published days after Klein’s interview formally accused Moonshot of training Kimi K3 on stolen Claude data.
The Dark Web Credential Market Behind the Attacks
The specific mechanism Klein described is what makes this story intersect directly with the dark web economy.
To run distillation at industrial scale, you need access to an AI model at industrial scale. The obvious route , creating a company account and paying for API access , leaves a traceable business relationship. The actual route, Klein said, runs through the same underground markets that sell everything else that’s stolen.
“One way people are getting around those restrictions is by turning to the dark web,” Klein told CNBC, “where they can find marketplaces of stolen credit card information and compromised AI accounts.”
With stolen payment credentials, it’s possible to create thousands of AI accounts that can’t be easily connected to each other or to any identifiable organisation. These aren’t just individual stolen cards picked from a breach dump , it’s a scaled procurement operation buying access to Anthropic’s Claude the way an enterprise might buy software licenses, except the payment method is fraudulent and the accounts violate terms of service.
Klein said companies like Moonshot are “spinning up tens of thousands, if not hundreds of thousands of fraudulent accounts” through this mechanism.
This is directly connected to the same underground carding markets and stolen credential ecosystem that powers financial fraud and account takeovers more broadly. The same markets that sell stolen credit cards for carding operations sell them to anyone who wants anonymous purchasing power , including, apparently, AI labs that want to harvest frontier model outputs without a traceable corporate relationship.
Why the Attacks Are Hard to Detect
Travis Lanham, technology chief at cybersecurity firm Armadin and a former Google engineer, explained the detection problem plainly.
“These companies are serving billions of requests,” Lanham told CNBC. “The millions are relatively small compared to everything and it’s just sneaking in and trying to look like the rest of the crowd.”
This is a meaningful technical description of what makes the attack hard to stop. When you’re processing billions of queries, even a sustained campaign running hundreds of thousands of fraudulent accounts doesn’t necessarily look different in aggregate from legitimate high-volume usage. A company running distillation at scale wants its queries to look like curious power users , asking a lot of questions, across many topics, over extended periods.
The whack-a-mole problem Klein described compounds this. When Anthropic detects and bans a fraudulent account, another can be activated from the same pool of stolen credentials almost immediately. Each new account starts clean with no prior flag history.
This is exactly the pattern that Google’s Threat Intelligence Group separately documented in their September 2026 warning about LLM-jacking , attackers using dark web-purchased accounts to access AI systems at scale, generating unexpected compute costs and capability theft simultaneously. Klein’s interview and Google’s warning arrived within weeks of each other, describing the same fundamental market.
It’s Not Just China
Klein’s interview covers China extensively, and the Moonshot, DeepSeek, Alibaba, and MiniMax names get most of the attention. But he also said the threat extends beyond Chinese labs.
Countries where Anthropic, OpenAI, and Google have restricted their models , including Iran, Russia, and North Korea , also turn to the same underground infrastructure. Labs and state-affiliated actors in those regions “go through illicit means and fraudulent means to try to gain access to a model,” Klein said.
The national security stakes are higher in those cases. Klein specifically pointed to “a China-based entity that was conducting espionage at scale using Anthropic’s technology” and said he feared possible use of distilled models in biological weapons programmes. The concern isn’t just that American AI companies are losing competitive advantage. It’s that more capable models are reaching actors who couldn’t have built those capabilities independently, without any of the safety measures that shaped the original model.
What the White House Said
The Trump administration has been paying attention. An April 2026 memo described distillation that “undermines American research and proprietary information” as “unacceptable” and said the government would explore “a range of measures to hold foreign actors accountable.”
Then in July, when Kimi K3 landed, White House OSTP Director Michael Kratsios posted directly on X: “We have information that Moonshot AI distilled Anthropic’s Fable for the development of its K3 model.” Treasury Secretary Scott Bessent echoed the allegation.
The government advisory that followed , NSA/CISA/FBI joint advisory AA26-251A, published September 8, 2026 , formally accused Chinese AI companies of industrial-scale distillation, citing Moonshot specifically for extracting data from Claude Fable 5 to train Kimi K3. Anthropic’s own September 10 threat intelligence report, published just two days later, provided the evidentiary detail behind those allegations: 300,000 Kimi customer requests routed through 5,380 fraudulent proxy accounts to Claude Opus.
The User Privacy Problem Underneath the IP Story
There’s a dimension of the Moonshot accusation that gets less attention than the intellectual property angle: what it means for the people who were actually using Kimi.
If Anthropic’s account of the routing is accurate, Kimi users who sent requests to what they thought was Moonshot’s own model were actually receiving responses from Claude , without knowing it. Their queries went to Anthropic’s servers. Their data helped train Moonshot’s models.
Some of those requests, according to Anthropic’s report, contained sensitive information from corporations and state-affiliated actors. At least one assessed query involved reviewing CCTV surveillance footage to determine whether a tracked individual was “behaving abnormally.”
This is more than a competitive intelligence story. It’s a user privacy story about what happens when your AI provider quietly routes your questions through a competitor’s system you didn’t consent to use. The same infrastructure that makes synthetic identity fraud possible , bulk fraudulent accounts built on stolen credentials , also enabled what Anthropic describes as an inadvertent exposure of sensitive user data to a foreign company’s training pipeline.
Klein’s Line Between Legal and Illegal
Klein was careful to draw the line he’s actually objecting to. Not distillation itself , that has legitimate uses when done with permission.
“I think competition is great,” Klein told CNBC. “The concern here is if you are taking our model, distilling it through fraudulent means, creating millions of fake accounts using stolen credit cards and stolen infrastructure, to then produce a model that doesn’t have safeguards in place.”
The safeguards point is where national security concerns and commercial ones converge. A model distilled from Claude inherits Claude’s capabilities but not necessarily the training and filtering that shapes how Claude responds to dangerous requests. If the most capable American AI models are being quietly replicated by actors who have no interest in maintaining those safeguards, the harm reduction framework built into the original is simply stripped out in the copy.
For context on how the dark web intelligence market is growing specifically to detect these kinds of early-stage threats, the Anthropic case is now a primary driver of enterprise demand for monitoring that catches credential abuse before it becomes a capabilities transfer.
Frequently Asked Questions
What is AI distillation?
A process where a smaller “student” model is trained by learning from the outputs of a larger “teacher” model. It’s legal when done with permission; illegal when done through unauthorized access.
How are bad actors accessing Claude?
Through dark web marketplaces selling stolen credit card information and compromised AI accounts, which are used to create fraudulent accounts at scale to harvest Claude outputs.
Was Kimi K3 actually trained on Claude?
Anthropic alleges it was, as do US government officials including OSTP Director Michael Kratsios. Moonshot’s Huang Zhenxin denied the claim in July. The question is contested but has drawn formal US government advisory attention.
Is this just a China problem?
No. Jacob Klein told CNBC the threat also comes from Iran, Russia, and North Korea , all countries where Anthropic, OpenAI, and Google have restricted access due to sanctions.
