Moonshot AI

Anthropic publicly accused Moonshot of running an industrial-scale unauthorized data-extraction ('distillation') campaign against Claude using hundreds of fraudulent accounts, later escalating to targeted extraction of reasoning traces.

Ultimate ownership and operational control sits with a China-based founding team and Chinese corporate/VC backers (Alibaba, Tencent), routed through Hong Kong/Cayman Islands holding entities — exposing customer data and model governance to PRC jurisdiction and national-security-related data laws even though no direct CLOUD Act nexus was found.

Moonshot's hosted API terms permit broad use of customer content to 'develop and improve' services, with no clearly stated retention period and community reports that data use cannot be easily opted out of even for paying API customers.

No EU AI Act compliance statement, GPAI Code of Practice signature, or systemic-risk self-classification was found, despite Kimi K2 being a trillion-parameter model trained at a scale plausibly triggering systemic-risk GPAI obligations.

No published SOC 2, ISO 27001, penetration-testing programme, or bug bounty was identified for Moonshot AI, limiting independent verification of its security posture.