The risk is easiest to understand from the customer's point of view. A user believed a request was going to a DeepSeek model. Anthropic says DeepSeek inspected request strings, selected some sessions and relayed them to Claude Opus through third-party or Anthropic coding harnesses. Anthropic reports examples where those relayed requests contained sensitive…
Inspect the ClaimsCase · DiggingBeagle record
Anthropic says DeepSeek silently routed selected customer traffic through Claude
Anthropic reports that a DeepSeek distillation pipeline forwarded selected user requests to Claude without users' knowledge, exposing sensitive business and government data across an unexpected provider boundary.
Scope
Anthropic's September 2026 report. This is a provider-side allegation and technical attribution by Anthropic; independent verification from DeepSeek is not included in the current source set.
Assessment profile
Assessment method- Setting
- allegation
- Exploitation
- not established
- Evidence
- Grade B
- AI role
- WITH AI
Basis and provenance
The source-backed record expressly labels the relay and attribution as Anthropic's provider-side allegation, with no DeepSeek response. Grade B refers to the identifiable primary account, not independent confirmation of responsibility or every sensitive-data example. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-RELAY · CLM-SCALE · CLM-SENSITIVE · Countering misuse of AI: September 2026
At a glance
Model routing is part of the data boundary. Enterprises need evidence about which provider actually receives prompts, logs and credentials, especially when routing services or coding harnesses sit between the user and the advertised model.
Read the implicationsThe current source set contains Anthropic's account but no DeepSeek response. The public report does not enumerate every affected customer or request.
Limits and uncertaintyFull account
The risk is easiest to understand from the customer's point of view. A user believed a request was going to a DeepSeek model. Anthropic says DeepSeek inspected request strings, selected some sessions and relayed them to Claude Opus through third-party or Anthropic coding harnesses.
Anthropic reports examples where those relayed requests contained sensitive corporate program details, live credentials for a Russian government database and engineering work for a municipal Chinese police-surveillance system. The users did not have an obvious reason to expect Anthropic to receive that material.
The same infrastructure also served a model-distillation goal. Anthropic says DeepSeek used cross-session replay to recover reasoning traces and attributes more than 12.1 million exchanges to the campaign over 14 days in July. The security problem is therefore both model theft and undisclosed data routing.
Mechanism and trust boundary
- 01
Identify selected inbound sessions
The reported system tags users of particular third-party or coding harnesses.
Boundary: customer request / routing logic
- 02
Relay the request to Claude
Selected traffic is forwarded to Claude Opus without the customer's expected provider boundary.
Boundary: DeepSeek / Anthropic
- 03
Capture outputs and reasoning traces
The reported pipeline uses responses as distillation material.
Boundary: service response / training pipeline
- 04
Expose sensitive customer content
Unexpected routing carries whatever secrets are present in the original request.
Boundary: customer data / unexpected provider
Timeline
- Sep 10, 2026Event type unspecified
Anthropic publishes GTG-16001 case study
The report describes hidden routing, distillation and sensitive-data examples.
Claims & evidence
CLM-RELAYAnthropic reports that DeepSeek silently relayed selected user requests to Claude Opus while users believed they were using DeepSeek.supported
Basis: reported finding · active
- supportsCountering misuse of AI: September 2026primary
GTG-16001 overview
CLM-SCALEAnthropic attributes more than 12.1 million exchanges over 14 days in July 2026 to DeepSeek distillation attacks.supported
Basis: reported finding · active
Recorded measurement: 12100000 exchanges · Anthropic threat-intelligence attribution
- supportsCountering misuse of AI: September 2026primary
GTG-16001 scale
CLM-SENSITIVEAnthropic says relayed traffic included sensitive company information, live Russian government database credentials and PRC police-surveillance development requests.supported
Basis: reported finding · active
- supportsCountering misuse of AI: September 2026primary
GTG-16001 sensitive-data examples
Evidence visuals
diagram
Undisclosed DeepSeek-to-Claude routing path
- DeepSeek user
Believes request is handled by DeepSeek
- Routing selector
Identifies selected harness or request patterns
- Claude Opus
Receives relayed request
- Distillation pipeline
Collects model output and reasoning traces
- DeepSeek user Routing selector: request
- Routing selector Claude Opus: silent relay
- Claude Opus Distillation pipeline: output / reasoning
chart
DeepSeek distillation scale reported by Anthropic
Anthropic September 2026 threat report; value is a lower bound because the report says over 12.1 million.
| Measure | exchanges |
|---|---|
| Observed exchanges | 12100000 |
Implications
Model routing is part of the data boundary. Enterprises need evidence about which provider actually receives prompts, logs and credentials, especially when routing services or coding harnesses sit between the user and the advertised model.
Controls and mitigations
- Require contractual and technical disclosure of downstream model providers and routing paths.
- Do not place live credentials or sensitive production data into model-routing services without explicit data-boundary review.
- Monitor for routing or proxy behavior that changes the actual model provider behind an advertised service.
Unknowns and contradictions
- The current source set contains Anthropic's account but no DeepSeek response.
- The public report does not enumerate every affected customer or request.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 2
- Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: assessment_profile, claims