Who Controls the Model?

A customer asks one company's AI a question. According to Anthropic, the request sometimes travels somewhere the customer did not expect: to Claude. The answer returns through the first company's service, while the underlying exchange becomes visible to a second provider. That is the most revealing allegation in Anthropic's September threat report. Access is not simply borrowed intelligence. It is a relationship with an operator that can observe activity, identify patterns, and withdraw service. The same connection that supplies capability can expose the customer using it. [1]

Anthropic alleges that Moonshot and DeepSeek relayed live customer requests to Claude and presented responses through their own products. It reports nearly 300,000 Moonshot customer requests in one ten-day period. This is an allegation grounded in the provider's account of its telemetry, not an independently audited reconstruction of either company's infrastructure. The distinction matters: a reader can examine what Anthropic says it observed without treating the provider's explanation of every intermediary, account, and customer relationship as settled fact. [1]

The alleged exposure creates two separate questions. First, did a product obtain answers from a service its users had not knowingly chosen? Second, did those requests contain material that users expected to remain within a different organizational or national boundary? Anthropic describes sensitive material among relayed requests. That description raises a privacy and governance question; it does not establish a legal violation in every jurisdiction. Resolving that would require the applicable notices, contracts, processing arrangements, and law, not simply the nationality of the firms involved. [1]

For Mainland Dispatch, the chokepoint is therefore narrower and more interesting than a claim that one country possesses intelligence and another does not. A chokepoint exists where an actor depends on a connection that someone else can condition or sever. Here the connection may carry prompts, answers, account signals, and enforcement decisions. Dependence could be temporary, selective, or replaceable. The report does not measure how readily an affected actor could substitute another model. Without that counterfactual, access leverage is a hypothesis about the relationship, not a demonstrated monopoly. [1]

The September 15 China Insider episode brought this story into our research queue. Its verified description identifies Chinese actors in Anthropic's report as a topic. We have not audited the audio, so no spoken argument or quotation is attributed to its hosts here. Our anchor is the September report itself, distinct from Anthropic's narrower November 2025 cyber-espionage disclosure. The question for this notebook is not whether a podcast's warning was dramatic enough. It is what the available records allow us to infer about who supplies capability, who sees its use, and who can interrupt it. [1][8]

Distillation is not inherently an illicit activity. It can describe training one model using another model's outputs, with or without authorization. Anthropic's allegation concerns unauthorized extraction and deceptive access, not the proposition that all learning from another system is prohibited. That distinction is also important when reading the September 8 joint NSA, CISA, and FBI advisory. A technical method, a contractual restriction, and a national-security claim occupy different categories. They may overlap in a particular case, but none automatically establishes the others. [1][2]

The figures in the supplied research brief cannot responsibly be compressed into one comparable total. Anthropic gives Alibaba more than 151 million exchanges and Moonshot more than 23 million during May through July 2026. It gives DeepSeek more than 12.1 million over fourteen days in July, Zhipu more than 3.4 million over seventeen days in June and July, and Xiaomi more than 400,000 over twenty days in March and April. These are different windows, not a common measurement period for all seven laboratories discussed. This inquiry therefore omits the proposed aggregate and growth multiplier. [1]

Even a reconciled count would answer a limited question. Exchanges are not unique users, tokens, training examples, or successful transfers of capability. A relayed customer request may produce an immediate answer and might also become training material; those are different uses of the same interaction. Summing categories without knowing their overlap risks counting one flow twice. A peak daily rate also cannot be substituted for a sustained average. These distinctions do not make large-scale extraction unimportant. They determine what its scale actually describes. [1]

The government advisory describes a different population: campaigns involving six named China-based companies against US AI providers, extending back to at least late 2024. It discusses tokens and exchanges across that broader setting. It is an original government assessment, not a second public audit of each case in Anthropic's September report. Its list, time span, and evidentiary access differ. Counting the two publications as independent confirmation of every numerical claim would manufacture corroboration from proximity. The right comparison preserves their boundaries before asking where their findings genuinely converge. [1][2]

For the access argument, the decisive measurement would be what those exchanges enabled. Did they reduce training cost, improve performance on independently chosen tests, substitute for unavailable expertise, or sustain a commercial service that could not otherwise meet demand? The reviewed material does not supply an independent answer for each laboratory. Volume is evidence of the provider's assessed activity, not a direct measure of strategic advantage. A strong follow-up would publish consistent windows, explain account clustering and duplicate treatment, and connect inputs to evaluated outputs. Until then, large numbers should orient inquiry rather than close it. [1][2]

The military cases require an evidentiary ladder. A requested document is not a finished system. Software that runs is not necessarily validated against hardware. A simulation is not an operational plan, and an operational plan is not deployment. Anthropic's report describes activity at several of these levels, but the supplied briefs sometimes collapse them. That compression produces a more alarming story and a less defensible one. The proper analytical question is where assistance entered an existing workflow and what outcome the record actually demonstrates. [1]

In GTG-17001, Anthropic assesses a connection to a Chinese defense-industry manufacturer seeking a PLA Navy contract. It describes assistance with an anti-torpedo proposal running beyond 200 pages. The company says it could not attribute the activity to a specific entity or actor. That supports an attributed account of proposal development, not a finding that the Navy procured, accepted, or deployed the proposed system. The institutional ambition of a customer and the institutional adoption of its product are not interchangeable. [1]

GTG-17002 concerns electronic-warfare and air-defense-suppression software. Anthropic describes roughly sixteen modules, repeated revisions, and a simulation incorporating twelve Taiwan targets. Its assessment connects account metadata and content to PRC research institutions, including the PLA Academy of Military Sciences. Those are meaningful attribution claims, but the reviewed record does not independently establish who commissioned the work or whether it became usable military capability. This notebook does not reproduce a target list or operational particulars. A named geography in a simulation does not demonstrate preparations for an invasion. [1]

A further China-linked case concerns research into directed-energy weapons and briefings intended for senior officials. The distinction between open-source collection and classified information is essential: producing a restricted-looking briefing does not establish access to classified weapons knowledge. Anthropic also says the weapons actors already possessed relevant expertise in the hardware they were discussing. Its companion capability evaluation addresses controlled tasks, not observed deployment by those actors. Together these records justify investigating acceleration, while leaving the size and operational significance of that acceleration unresolved. [1][7]

Surveillance has a different harm pathway. A useful dossier or monitoring workflow may matter without becoming a weapon or satisfying a military performance test. Yet attribution still needs discipline. The Uyghur-Syria case carries a low-confidence assessment concerning a contractor for PRC security rather than a directly identified state organ. Separately, the report's statement about identifying activity at a pilot stage, with no evidence of later stages against real targets before a ban, belongs to the S2T surveillance chain. It must not be transferred to the Uyghur case. Nor should the Hunan cyber cluster become a state operation merely because its operators were described by Anthropic as Chinese-speaking and likely located in China. [1]

Anthropic has an unusually useful vantage point: the interactions passing through its service. It also has commercial, policy, and reputational interests in how those interactions are interpreted. Both facts belong in the analysis. An interested source can hold important evidence; important evidence does not eliminate the need to test an interested source's claims. Dismissing the report as marketing would evade the records. Treating it as an adjudicated finding would evade the source's limits. The task is to identify which conclusions its observation can support and which require evidence from elsewhere. [1]

Account metadata, language, network patterns, and requested content can support an assessment, but each has alternative explanations. A relationship to a research institution does not automatically identify a military command chain. A customer may misrepresent an affiliation or work for a contractor serving several clients. These possibilities are not findings that Anthropic is wrong. They explain why confidence language must remain attached to the specific inference it qualifies. The reader should not have to reconstruct that distinction from a caveat several pages after a declarative headline. [1]

The public Chinese government response is narrower than the detailed rebuttal an investigator would want. At the September 11 foreign-ministry briefing, Mao Ning said she was unfamiliar with the specifics, reiterated support for beneficial AI, and rejected smears and distortion. The question addressed surveillance allegations in the report. This is a verified official response, available in the ministry's English version; it neither concedes the conduct nor supplies a case-by-case technical rebuttal. No detailed company response has been established in this inquiry’s reviewed source set. That is a research limitation, not proof that no response exists. [3]

Historical criticism needs a date label. The November 2025 BleepingComputer article remains a source lead for scrutiny of the earlier GTG-1002 disclosure, but its text could not be retrieved in the November 8 publication review. This inquiry therefore does not rely on it for specific criticisms. Anthropic’s September report and its earlier disclosure are separate records; neither establishes independent validation of the other. Provider attribution and estimates of model contribution still require external testing. [4][5][1]

The most productive independent review would separate occurrence, identity, and contribution. Did the described interaction take place? Who was responsible for it? How much did the model change the result compared with available alternatives? These questions need different evidence, from redacted artifacts to attribution analysis to comparative testing. Anthropic reports banning accounts and disrupting activity. That is an attributed account of enforcement, not independent proof that the underlying project stopped or could not resume elsewhere. A ban closes a provider relationship. It does not necessarily close an operation. [1]

Hardware controls and model-access controls act at different points. Restrictions on advanced chips concern resources used to train and run systems. Access restrictions concern who can use a service, which capabilities they can request, and under what conditions. Extracting answers through an interface does not move a physical chip across a border, but it still relies on computation. The supplied assertion that chip controls do nothing is therefore too categorical. The relevant policy question is how the mechanisms interact, not which one renders the other meaningless. [1][2]

A service boundary can offer a faster intervention point than a hardware supply chain: an operator may identify an account and restrict it. But effectiveness depends on detection, attribution, substitute services, and the cost imposed on legitimate users. The government advisory recommends provider-side detection and response measures. It does not establish that those measures eliminate unauthorized extraction. An enforcement tool can be consequential while imperfect. Calling it a chokepoint should invite measurement of the dependency it exploits, rather than imply that a switch controls all relevant capability. [2][1]

There is already a provider account of a broader access intervention. Anthropic's June 30 announcement says the US government applied export controls to Fable 5 and Mythos 5 on June 12, followed by a lifting of controls on June 30; the page carries a July 1 restoration update. The company describes an initial service suspension because it could not reliably verify nationality in real time. This is useful evidence of Anthropic's reported experience, not a substitute for the underlying government directive. This inquiry does not claim to have reviewed that directive or adjudicated its legal scope. [6]

That episode illustrates a policy tradeoff more concrete than a general call for tighter restrictions. If access decisions depend on attributes a service cannot reliably determine, a targeted restriction may become a broad interruption. If screening is weak, prohibited activity may continue. If screening is expansive, legitimate activity may be affected. Those are analytical possibilities, not measured error rates in this report. The necessary evidence would include how many users were affected, why, how errors were corrected, and whether the intervention changed the activity it was intended to constrain. [6][2]

Nor is private enforcement equivalent to public export law. A provider can act under its service rules; a government must rely on its own legal authority and process. Congressional statements and proposed rules would add policy context only after their original records are checked. This inquiry therefore leaves the supplied testimony and quotation claims out. The durable insight does not require them: the intermediary relationship can concentrate information and enforcement capacity in a provider, while public authorities may seek to govern that capacity. Whether this produces security, dependency, overreach, or all three remains an empirical question. [6][2]

First, independent corroboration could strengthen or narrow particular attributions. A credible review would explain what evidence connects an account cluster to an institution, what alternative explanations were considered, and which claims remain low confidence. It need not publish personal data or operationally sensitive material to be useful. A carefully bounded examination by qualified reviewers could test more than a press summary can. Conversely, a documented account compromise, mistaken organizational link, or misclassified request would require a visible correction to the relevant case, not a silent adjustment to the story. [1]

Second, outcome evidence could move a case up or down the ladder. A proposal accepted into procurement would establish something different from a proposal merely generated. Independent software validation would establish something different from plausible-looking code. Evidence of deployment would matter more than simulation geography. Negative findings matter too: abandoned work, unusable outputs, or extensive human repair could reduce an asserted contribution. The report's warnings should not be converted into irreversible capability gains before those intermediate steps are examined. A model's fluency is not the same measurement as a system's performance. [1][7]

Third, a consistent distillation audit could clarify the economic stakes. The useful comparison would hold the measurement window and population steady, explain the overlap between relaying and extraction, and connect collected material to model performance or service delivery. It would also identify what cannot be inferred. An actor might seek outputs unsuccessfully, use them immediately without training, or combine them with other inputs. Those pathways have different implications for dependence. The amount of traffic alone cannot tell us whether access was a temporary convenience or an essential productive input. [1][2]

Fourth, enforceable public records would sharpen the policy analysis. An original directive, a documented enforcement action, or a fully specified legislative proposal could establish authority, scope, dates, exceptions, and obligations. A provider's policy position cannot do that work by itself. We would also look for substantiated responses from the named companies and institutions, not only broad diplomatic language. This inquiry includes the available ministry response and keeps the remaining response search open. Later developments must enter as dated updates rather than being retroactively treated as evidence available on September 15. [3][6][2]

For now, the strongest conclusion is conditional but substantive. Anthropic describes actors seeking capability through a service whose operator could observe their requests and report taking action against them. That relationship joins access to exposure. It gives the chokepoint argument a concrete mechanism without proving that access controls are sufficient, that every institutional attribution is correct, or that AI assistance became deployed military power. Who controls the model is only the opening question. Who controls the route to it, what the route reveals, and what happens when access is withdrawn are the questions this evidence now makes worth pursuing. [1]