The INTEL  

The AI tool your employee chose may not be the AI that answers them. Anthropic’s September 2026 threat report alleges that China-based AI labs silently forwarded their own customers’ requests to Claude and kept the exchanges to train their models; at least two, Moonshot AI and DeepSeek, served Claude’s answers back as their own. In one case, Moonshot AI relayed almost 300,000 customer requests in ten days. In one example, the report says a user “had no way of knowing” their requests were being forwarded to Claude.

The data in those prompts was sensitive. Anthropic reports that many of the relayed exchanges came from users of third-party model routing services “commonly used by users in the United States and Europe,” and that the sessions contained names, email addresses, company data and other sensitive information from hundreds of end users in at least a dozen languages. Its redacted examples include a pharmaceutical company’s internal capital expenditure forecasts and a developer’s live access credentials. Anthropic says these practices are “likely inconsistent with privacy laws.”

A caution on independence: Anthropic competes with the labs it names, and these are its allegations, based on its own platform data. Anthropic also says it has no indication US persons’ data was exposed, though the routing platforms involved are commonly used in the US and Europe. The compliance lesson holds either way.

Why It Matters  

This is a data-protection problem, not just a security one. When an employee pastes customer data or a financial model into an AI tool, your organization is responsible for where it goes. If the tool quietly passes it to an undisclosed third party, you may have an unreported sub-processor, a cross-border transfer you never approved, and possibly a notifiable disclosure.

Model routers and low-cost coding assistants are attractive precisely because they’re cheap and flexible. That’s also why they rarely go through procurement, and why their data path is often invisible.

What To Do — One Key Action  

Inventory the AI tools your employees actually use, including model routers, browser extensions and coding assistants, and approve only those whose data path you can see in writing: who processes the prompt, where, under what terms, and whether it’s retained or used for training. Block the rest, and add AI sub-processors to your privacy and vendor-risk reviews.

Anthropic’s report makes the same point from the other side: buy AI access only through authorized channels, because a discount that routes your traffic through an unknown intermediary “introduces tremendous risk to user data and systems.”

MITRE ATT&CK  

  • T1557 — Adversary-in-the-Middle (closest analog): The relays sat between users and the model they thought they were using, seeing and keeping every exchange. It isn’t a classic network attack, but the risk to your data is the same: a middle party you never approved.

Learn More  

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.