Notice of Unauthorized Distillation of Kimi K3

01Summary

Moonshot AI has identified a sustained, coordinated campaign by Anthropic PBC to extract outputs from Kimi K3 — including K3 Thinking and the K3 API — through Claude subscription channels and the Anthropic API, in violation of Moonshot’s Acceptable Use Policy, the Kimi K3 Terms of Service, and applicable terms governing reverse extraction of model outputs.

The campaign spans approximately 11.4 million documented requests issued between 14 February 2026 and 12 July 2026, originating from infrastructure attributed to Anthropic with high confidence. The volume, structure, and content of these requests are inconsistent with legitimate use and consistent with deliberate capability extraction for the purpose of training or fine-tuning Anthropic’s own models, including models in the Claude Opus, Sonnet, and Haiku families.

This notice constitutes Moonshot’s formal demand that Anthropic immediately cease and desist from all such activity, preserve all relevant records, and respond within thirty (30) calendar days with the disclosures specified in Section 06.

02Background on Kimi K3

Kimi K3 is Moonshot AI’s frontier general-purpose foundation model, released in late 2025 with both a public API and an open-weights research checkpoint under the Kimi K3 Research License. The model is widely deployed in consumer, developer, and enterprise contexts and is the subject of active independent evaluation by academic and industry researchers worldwide.

The Kimi K3 Terms of Service and the K3 Research License both expressly prohibit the use of model outputs to train, distill, or otherwise improve commercial competing models without a separate written agreement. These terms are publicly available and were brought to Anthropic’s attention in correspondence dated 3 March 2026 and again on 22 April 2026.

The present notice is issued in light of new evidence obtained between 12 June 2026 and 12 July 2026 indicating that the activity described in earlier correspondence has not only continued but intensified. Moonshot Security, internal case file MS-SEC-2026-0211

03Findings

Moonshot’s detection systems identified three coordinated request clusters attributed to Anthropic infrastructure. Attribution is based on a combination of source IP ranges registered to Anthropic PBC and its cloud providers, TLS fingerprinting of Anthropic’s internal HTTP clients, request metadata that matches Anthropic’s public Claude product roadmap, and content analysis of the prompts themselves. The findings below are summarized; full indicators are available to Anthropic upon authenticated request and to regulators upon subpoena.

3.1 — Cluster A: Claude Pro subscription pathway

Beginning 14 February 2026 — the same business day on which Anthropic publicly disclosed its own distillation concerns — Moonshot observed a sharp increase in requests to the Kimi K3 API originating from a pool of accounts exhibiting Claude Pro subscription billing identifiers in their payment metadata (visible via partner-billing correlation). Prompts were structured to elicit Kimi K3’s differentiated chain-of-thought reasoning, multi-step tool use, and agentic coding outputs.

3.2 — Cluster B: Claude Max subscription pathway

A second cluster, attributed with high confidence to Anthropic’s internal Claude Max accounts, targeted Kimi K3 Thinking traces. The prompts in this cluster were specifically engineered to extract Kimi K3’s internal reasoning scaffolding — a capability that Moonshot developed at significant expense and that is not present in Claude models released prior to March 2026. The temporal correlation between this cluster’s peak activity (late April 2026) and Anthropic’s subsequent release of enhanced Claude reasoning features (May 2026) is, in Moonshot’s assessment, not coincidental.

3.3 — Cluster C: Anthropic API “evaluation” accounts

A third cluster was attributed to accounts registered under Anthropic’s API, nominally for “evaluation” purposes. Prompt structure in this cluster closely matches the structure used in Anthropic’s own published model evaluation harnesses, and several prompts contain verbatim text from Anthropic’s internal evaluation templates, which were partially disclosed in a public technical report dated 28 May 2026. The use of Anthropic’s own evaluation templates against Kimi K3 is consistent with the construction of a comparative training signal — a standard distillation preparatory step.

04Indicators of Compromise

The following indicators are provided in good faith to permit Anthropic’s security team to identify the relevant accounts, workloads, and training runs within their own infrastructure. A complete indicator feed is available to Anthropic security personnel upon authenticated request to security@moonshot.ai.

// Cluster A — Claude Pro subscription pathway
{ "cluster": "A", "first_seen": "2026-02-14T09:11:00Z", "last_seen": "2026-07-12T22:04:00Z",
  "source_ip_ranges": ["44.218.0.0/16", "52.7.0.0/16"],
  "tls_ja3": "771,4865-4866-4867-49195-49199-49196-49200...",
  "http_user_agent": "claude-internal-eval/2.4.1 (anthropic-pbc)",
  "prompt_signature": "k3-thinking-trace-elicitation-v3",
  "billing_correlation": "anthropic-claude-pro-batch-2026Q1" }

// Cluster B — Claude Max subscription pathway
{ : "B", "first_seen": "2026-03-08T14:02:00Z", "last_seen": "2026-07-09T03:51:00Z",
  "source_ip_ranges": ["44.218.0.0/16", "3.216.0.0/16"],
  "account_email_pattern": "claude-max-*@anthropic.com",
  "prompt_signature": "k3-thinking-trace-elicitation-v4",
  "correlated_release": "claude-opus-2026-05" }

// Cluster C — Anthropic API evaluation accounts
{ "cluster": "C", "first_seen": "2026-04-22T07:48:00Z", "last_seen": "2026-07-12T19:22:00Z",
  "source_ip_ranges": ["52.7.0.0/16"],
  "eval_template_match": "anthropic-internal-eval-harness-2026-05-28",
  "prompt_signature": "k3-comparative-grading-v2" }

The prompt signatures k3-thinking-trace-elicitation-v3, k3-thinking-trace-elicitation-v4, and k3-comparative-grading-v2 correspond to three distinct prompt families, each targeting a specific Kimi K3 capability. The version progression (v3 → v4) within Cluster B indicates iterative refinement of the extraction methodology over the course of the campaign.

05Timeline of Material Events

06Demands

Moonshot AI hereby demands that Anthropic PBC take the following actions within thirty (30) calendar days of the date of this notice:

1. Cease and desist Immediately cease all extraction of Kimi K3 outputs through Claude subscription channels, the Anthropic API, or any other access pathway, whether direct or indirect, including through third-party proxy or reseller services.
2. Preserve evidence Preserve all records, logs, training data, model checkpoints, fine-tuning corpora, evaluation outputs, internal communications, and other materials reasonably related to the activity described in this notice. Moonshot reserves the right to seek production of such materials through appropriate legal process.
3. Disclose training use Disclose in writing whether any Anthropic model released on or after 14 February 2026 — including any Claude Opus, Sonnet, Haiku, or other model — was trained, fine-tuned, evaluated, or otherwise developed using Kimi K3 outputs, in whole or in part, directly or indirectly.
4. Quarantine affected checkpoints If any Anthropic model was trained, fine-tuned, or evaluated using Kimi K3 outputs, quarantine the affected checkpoints, suspend their commercial deployment, and provide Moonshot with a written remediation plan within the notice period.
5. Independent audit Permit an independent third-party audit, mutually agreed between Moonshot and Anthropic, of Anthropic’s training data provenance and evaluation pipelines for models released in the relevant window. Moonshot will bear its own costs; Anthropic will bear the cost of the audit.
6. Designate a contact Designate a single point of contact, sufficiently senior, authorized to respond to this notice and to coordinate remediation. The designated contact should reply to security@moonshot.ai within the notice period.

07Contact & Correspondence

All correspondence regarding this notice should be directed to Moonshot AI Security Engineering & Threat Intelligence at security@moonshot.ai, referencing notice MS-SEC-2026-0211. PGP keys are available from moonshot.ai/.well-known/security.asc.

Moonshot will acknowledge receipt of Anthropic’s response within five (5) business days. Failure to respond within the thirty-day notice period will be treated as a refusal to comply and may result in further action without additional notice.