Case · DiggingBeagle record
Anthropic reports that a DeepSeek distillation pipeline forwarded selected user requests to Claude without users' knowledge, exposing sensitive business and government data across an unexpected provider boundary.
Anthropic's September 2026 report. This is a provider-side allegation and technical attribution by Anthropic; independent verification from DeepSeek is not included in the current source set.
The risk is easiest to understand from the customer's point of view. A user believed a request was going to a DeepSeek model. Anthropic says DeepSeek inspected request strings, selected some sessions and relayed them to Claude Opus through third-party or Anthropic coding harnesses.
Anthropic reports examples where those relayed requests contained sensitive corporate program details, live credentials for a Russian government database and engineering work for a municipal Chinese police-surveillance system. The users did not have an obvious reason to expect Anthropic to receive that material.
The same infrastructure also served a model-distillation goal. Anthropic says DeepSeek used cross-session replay to recover reasoning traces and attributes more than 12.1 million exchanges to the campaign over 14 days in July. The security problem is therefore both model theft and undisclosed data routing.
The reported system tags users of particular third-party or coding harnesses.
Boundary: customer request / routing logic
Selected traffic is forwarded to Claude Opus without the customer's expected provider boundary.
Boundary: DeepSeek / Anthropic
The reported pipeline uses responses as distillation material.
Boundary: service response / training pipeline
Unexpected routing carries whatever secrets are present in the original request.
Boundary: customer data / unexpected provider
The report describes hidden routing, distillation and sensitive-data examples.
Locator: GTG-16001 overview
Anthropic says DeepSeek tagged selected sessions and relayed them to Claude without informing customers.
Locator: GTG-16001 scale
Anthropic reports more than 12.1 million exchanges over 14 days in July 2026.
Locator: GTG-16001 sensitive-data examples
Anthropic describes examples involving a PRC technology company, a Russian defense-linked government operator and a Chinese municipal police project.
diagram
Believes request is handled by DeepSeek
Identifies selected harness or request patterns
Receives relayed request
Collects model output and reasoning traces
chart
Anthropic September 2026 threat report; value is a lower bound because the report says over 12.1 million.
| Measure | exchanges |
|---|---|
| Observed exchanges | 12100000 |
Model routing is part of the data boundary. Enterprises need evidence about which provider actually receives prompts, logs and credentials, especially when routing services or coding harnesses sit between the user and the advertised model.
DiggingBeagle. “Anthropic says DeepSeek silently routed selected customer traffic through Claude.” First seen Sep 10, 2026. https://diggingbeagle.com/cases/anthropic-says-deepseek-silently-routed-selected-customer-traffic-through-claude/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.