Anthropic says 5,380 fake accounts let Moonshot pass Claude off as Kimi

A Kimi user types a question and reads the reply as Kimi's. Anthropic's September report says Moonshot AI was secretly forwarding those requests to Claude ^[3]. If all 300,000 requests in the ten-day window ran through the 5,380 accounts, each account carried about 56 ^[4][15]. That is five or six a day ^[16].

For an API team, that spread matters more than the headline totals. We think most teams selling model access still build their controls on the idea that one account is one customer, and attach the rate limit and the bill to it. The operator Anthropic describes is one customer split across thousands of accounts. Each one sends what a per-account limit would log as light use ^[4][16].

CISA has called the activity a "systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership" ^[2]. Anthropic's own wording is narrower. It calls distillation a "legitimate training method" ^[7] and defines the illicit kind as "an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization" ^[8]. In the Moonshot case, the industrial scale only appears when the accounts are added together ^[15].

The excerpts published do not show how Anthropic tied the accounts to Moonshot. Wang Zebin, an investment manager at Shenzhen-based JG Investment, told the South China Morning Post that the report "does not provide enough concrete examples to independently verify how those companies obtained or used the model outputs" ^[11]. Moonshot and DeepSeek did not respond to the paper's requests for comment ^[13].

Even with that caveat, we think account-level abuse detection belongs in the core product for any team selling model access. It also has to look at accounts in groups, because the alleged pattern only shows up there ^[15]. Honest customers pay for this. Linking accounts by region or payment route will also flag real businesses that happen to resemble a proxy network, and each false positive is a suspended key that someone in support has to explain.

A 2x2 sorts the traffic. One axis is whether an account's own volume is normal. The other is whether it acts in coordination with other accounts. A heavy account acting alone is a big customer or a single scraper, and the rate limit and the invoice already deal with it. Heavy accounts acting together are a crude farm that any usage chart shows. Normal volume on its own is the ordinary customer. The fourth cell, normal volume acting as a group, takes cross-account review to see. It is where the Moonshot traffic sits as Anthropic tells it ^[3][16].

A test of this needs one day of traffic and one scenario: an operator sending five or six requests a day from each of several thousand accounts ^[16]. That operator sits in the fourth cell, and the check is whether any screen the team already has would show it.