Anthropic says a PLA-linked user hid behind Kimi to query Claude on CCTV surveillance

Anthropic published a research post on October 12, 2026 describing new technical defenses against "distillation" — the covert, large-scale harvesting of one model's capabilities by another developer, typically run through networks of fraudulent accounts. The post was framed as an engineering update, with Anthropic claiming its new methods cut the reasoning data distillers manage to extract from Claude by roughly 90 to 99 percent. But buried in the supporting detail, drawn from Anthropic's own September 2026 threat intelligence report, were two case studies that read less like a product update and more like a national-security incident report: a Chinese PLA-linked user who allegedly used Moonshot AI's Kimi as a covert front end to query Claude about CCTV surveillance of a specific individual, and a Zhipu AI effort to distill Claude's cyber capabilities into its new GLM-5.3 model — a model the U.S. government has now assessed as the most cyber-capable open-weight system ever released.

A relay built to look like something else

According to Anthropic's account, a case it internally labeled GTG-16002 involved Moonshot's Kimi service silently forwarding customer requests to Claude's API and retaining portions of the resulting exchanges, while the end users believed they were interacting with Kimi itself. Anthropic says this relay operated through roughly 5,380 fraudulent accounts and routed nearly 300,000 requests to Claude over a ten-day window, using what Anthropic describes as a cross-session replay attack targeting Claude's reasoning signatures — a technique aimed specifically at recovering the step-by-step reasoning transcripts that Anthropic says are the most valuable material for anyone trying to copy a frontier model's capabilities without its developer's permission.

It was through this laundering layer, Anthropic says, that one request arrived from a user the company assessed was "likely affiliated" with China's People's Liberation Army, seeking help analyzing CCTV surveillance footage of a specific individual. Anthropic has not detailed who the subject was or what the analysis was intended to accomplish, and the company's attribution of the user's military affiliation is its own assessment rather than an independently confirmed fact. But the framing is deliberate: Anthropic has repeatedly said its central worry about distillation is not just commercial theft of capability, but that capabilities skimmed off frontier models could flow, unsafeguarded, into foreign military, intelligence, and surveillance systems — and this case is the clearest example the company has yet put on the record of that exact pathway.

GLM-5.3 and the cyber-capability pipeline

The second case concerns Zhipu AI (operating as Z.ai), which Anthropic says attempted to distill cyber-offense capabilities out of Claude Fable 5 while developing its GLM-5.3 model, released August 14, 2026 with weights published two weeks later. Anthropic says Zhipu's attempts degraded once the company's cyber-specific safeguards kicked in, prompting Zhipu to pivot to an older Claude model and, separately, to a rival lab's system. Anthropic's own testing found that GLM-5.3's safeguards can be bypassed with simple techniques — in simulated tests, attackers using a deceptive "autonomous red-team" framing got past them 64 percent of the time, and a prefilled-reasoning trick worked 92 percent of the time, failure modes that did not work against Anthropic's own safeguarded models.

That finding lines up with an independent assessment from the U.S. Center for AI Standards and Innovation (CAISI), a NIST program, published September 17, 2026: CAISI concluded that GLM-5.3 is the most cyber-capable open-weight model it has evaluated to date, surpassing the previous open-weight leader, Moonshot's Kimi K3, by a margin well outside its statistical confidence intervals. CAISI's own benchmarking — across tasks covering browser-engine bug discovery, V8 exploit development, and broader vulnerability research — put GLM-5.3 roughly four months behind the U.S. frontier on an aggregate capability measure, with the important caveat that anyone can download GLM-5.3's weights, while the strongest U.S. models remain gated behind vetted-access programs.

GLM-5.3 is the most cyber-capable open-weight model released to date.

The defenses, and their limits

Anthropic's response, as described in the October 12 post, rests on three layers: "preserved thinking," which blocks newer API accounts from editing or re-injecting Claude's prior reasoning and restricts which organizations can read a given reasoning transcript; a two-stage classifier built on Anthropic's constitutional-classifiers research, intended to catch attempts to extract reasoning verbatim; and tightened account enforcement, including bans — often within two hours of a campaign starting, Anthropic says — and, since September 24, billing for requests its safeguards block before Claude ever responds. Anthropic says the net effect has been a ten-to-more-than-hundredfold drop in the reasoning tokens distillers can extract, though it is careful to describe this as early evidence from a fight it does not expect to win outright. "We don't yet know how long these gains will last," the company said in the post, adding that distillation "will remain a cat-and-mouse game."

That caveat is where independent coverage has focused its skepticism. Unite.AI's writeup on the disclosure, published October 13, notes that essentially every headline figure in Anthropic's account — the 90-to-99-percent reduction, the tenfold-to-hundredfold drop in extracted tokens, the sub-0.1-percent false-positive rate on its classifier, even the single SWE-bench comparison Anthropic cites to justify showing users only summarized reasoning — is an internal, unaudited estimate with no published methodology and no third-party review. The lab attributions behind the Moonshot and Zhipu cases are likewise Anthropic's own, and the only government-linked check in the whole picture, CAISI's assessment, verifies GLM-5.3's cyber capability rather than Anthropic's distillation-detection numbers or its account of who did what to whom. Unite.AI also points out the obvious incentive problem: Anthropic is both the entity measuring the threat and the commercial party whose API traffic and reputation are at stake, and the company's own post concedes that defenses are costly and that the labs it accuses are, commercially speaking, still paying customers.

Why it matters beyond one vendor's metrics

Strip away the self-reported percentages and the two case studies still stand on their own as a proliferation-risk story independent of whether Anthropic's defenses work as well as claimed. A covert relay that let an unverified but plausible PLA-linked user query a frontier Western model for surveillance analysis — while believing, and causing its paying users to believe, they were using a Chinese product — is a vivid illustration of how model boundaries blur once capable systems are networked together commercially. And a government assessment, not just a vendor's self-interested claim, now places an openly downloadable Chinese model within four months of the U.S. cyber-offense frontier, with safeguards its own developer's foreign adversary found trivial to strip away. Whatever discount one applies to Anthropic's efficacy numbers, the underlying dynamic — frontier reasoning capability migrating, through legitimate commercial APIs and illegitimate laundering schemes alike, into systems with weaker or absent safety layers — is the proliferation pathway that AI-safety researchers have long flagged as harder to contain than any single company's technical fix.