Anthropic's API Misuse Report: The Corporate Data-Handling Audit for 2026

What happened. Anthropic says DeepSeek, Xiaomi and Moonshot fed conversations between their own models and their users into Claude, and that some of those exchanges carried sensitive information from individual users, major multinational companies and state-affiliated actors. It published the finding on 10 September 2026. Why it is your problem. The relay ran through products the customer had chosen — a coding assistant, a chat app, a model router — not Anthropic's front door, so "do we use Claude?" is not the question that protects your data. The deliverable. Four checks a 20- to 200-person company can run this quarter.

What Anthropic's report says happened to company data

The headline number — over 151 million exchanges attributed to Alibaba between May and July 2026 — is not the part that touches an ordinary company. The part that does concerns the customers of three other labs. Anthropic states that relayed sessions "contained names, email addresses, company data, and other sensitive data of hundreds of end users in at least a dozen languages", and that "many of these exchanges were relayed from users of third-party model routing services commonly used by users in the United States and Europe". A routing service is the piece most companies never audit.

The relay mechanism

Each route bypassed the user's own choice of vendor. Moonshot, maker of Kimi, "silently forwarded customer requests to Claude, instead of processing them using Kimi", then showed Claude's answers to users who thought they were talking to Kimi; the report counts "almost 300,000 customer requests" relayed in one ten-day window through a proxy network of 5,380 fraudulent accounts. DeepSeek scanned inbound requests for the strings of third-party and Anthropic coding harnesses, tagged those users and relayed selected requests to Claude Opus. Xiaomi replayed conversations and coding sessions from its own models into Claude. The common thread is relay without notice or consent: one vendor was paid, another vendor's model answered.

What the relayed sessions contained

The report publishes five examples — which is why the data map comes first:

• a pharmaceutical company's internal capital expenditure forecasts, sent to a China-headquartered coding assistant through a third-party model router;
• a developer's live credentials — a Telegram bot token, a Feishu appSecret and a Notion integration key — pasted into that assistant;
• a PRC technology company's internal documentation, including the specifications and strategic objectives of a flagship AI program;
• live credentials for a Russian government database, in requests from an IT operator working with data from a defense agency;
• an engineer building a case-management system for a Chinese municipal Public Security Bureau, comparing a person's movements against police records by national ID number.

Two are credential leaks and one involves an identifiable individual. None required a security failure at the company whose data was exposed.

Who is making these claims, and what that changes

Every finding above is Anthropic's own account of activity it says it disrupted. The company assesses that the practices it describes "are likely inconsistent with privacy laws and the labs' own terms of service" — an assessment, not an adjudication, and no court has decided the question. Beijing rejected the report on 11 September 2026: Foreign Ministry spokesperson Mao Ning told a news conference, "We firmly oppose attempts to throw mud at China by distorting facts". Nathan Lambert argues that "'Distillation attacks' is a horrible term for what is happening right now". The audit depends not on who is right about the labs, but on what your vendors can show you.

Our companion article covers the report's small-business security takeaways: Anthropic's September 2026 Threat Report: What It Means for a Small Business.

Four questions that decide whether this can happen to you

1. Which AI vendors do we pay, and does each name its subprocessors and model routing in writing? A vendor that cannot produce a subprocessor list has answered for you.
2. Does any of our traffic leave through a reseller, aggregator or "multi-model API" gateway? Each can see your prompts and you did not choose it.
3. Is any customer data sitting in a prompt that a third party stores, logs or trains on? Anthropic's Commercial Terms place that obligation on the customer: data submitted through the services is processed under its Data Processing Addendum, "which is incorporated into these Terms by reference".
4. Who can answer "where did this prompt go" within 24 hours? If it is the contractor who built the integration, that is a finding.

The vendor-data audit: four checks and the artifact each produces

This is the audit the report's corporate paragraph justifies, built around artifacts: "we reviewed our vendors" is not evidence.

A. Data map

One page, one row per vendor: the data categories you send it (customer identifiers, financial records, source code, credentials), where it is stored, how long it is retained, whether inputs or outputs may be used for training, and the subprocessors named in the contract. Where a row says "unknown", that is the work item. The AI agent supply chain audit covers agent access.

B. Contract check

Confirm four clauses in writing: a data processing agreement; retention and deletion terms; whether your inputs or outputs can train anything; and a breach-notification window with a named contact. Then ask about the vendor's upstream dependency: your vendor's vendor is the relay risk in the report, and a contract that stops at your counterparty does not cover it.

C. Control check

List who can act, with which credentials: single sign-on with role-based access, tenant restrictions and IP allowlisting where offered, retention controls set to your policy, and no individual's personal account in the critical path of a production workflow. One laptop holding the only key to a vendor relationship is a concentration risk.

D. Evidence check: what you can prove afterwards

The Compliance API lets an organisation "programmatically pull activity feed events, chat data, and file content". It is available to Enterprise plan organisations and to Claude Platform customers in Claude chats, and for Claude Enterprise organisations "only your organization's Primary Owner can enable the Compliance API". Coverage "doesn't include Claude Code on the web, Claude Code accessed through the Claude Platform, other Microsoft 365 apps, or sessions run on Amazon Bedrock or Google Vertex AI".

Audit logs are Enterprise-only as well. Owners and Primary Owners export them from Organization settings → Data and Privacy; the export aggregates "all audit logs for the organization within the past 180 days" and the link is "active for 24 hours". Two limits matter: "title and content of chats and projects are not available to be exported in audit logs", and organisations using customer-managed encryption keys cannot use the export at all. The logs carry timestamps, actor, event, IP address and device ID — enough to answer "who did what, from where", not "what was said".

The finding for a smaller company is the gap itself: on Claude Pro, Max or Team plans there is no equivalent audit surface, so proof of what left your systems rests on your own logging. If you hold keys, start with the leaked-key playbook.

If your data was already relayed: the ten-day remediation

The report's credential examples make the first step obvious. Rotate anything that ever appeared in a prompt — bot tokens, API keys, integration secrets, database credentials — and treat it as public, because the relay path may have logged it. Then confirm with the vendor, in writing, what was relayed and when, and whether copies were kept; the report describes proxy networks that "save exchanges in order to sell them to other labs". Third, review your own notification obligations — what your customer contracts promise, what your insurer expects, what privacy law requires — with counsel, not with this article. Fourth, freeze the timeline while the facts are fresh: date, vendor, data category, who was affected, what you did. Reconstructing that chronology six weeks later is where companies lose the argument.

Where synthetic data fits, and where it does not

Synthetic data is a legitimate control. Replacing real customer records with generated equivalents in test and staging removes the data that made the report's examples damaging, and it is usually the cheapest way to shrink a vendor incident's blast radius. It does not fix routing. A pipeline that generates clean synthetic records and sends them through an unaudited reseller, aggregator or "multi-model" gateway has moved the exposure, not removed it: the relay in the report was a routing decision the vendor made. Treat synthetic data as one line in the data map. If you are the agency building that pipeline for a client, the agency-side analysis lives at Anthropic's distillation crackdown: what AI agencies must change.

What this article does not mean

It is not a verdict on any model or country, and not a recommendation to drop a vendor. No court has ruled on the distillation question, and Anthropic is both the source of these findings and a party that benefits from them; every allegation here is attributed to Anthropic for that reason. Your exposure is contractual and data-protection-shaped. This article is not legal advice; any question about whether a vendor breached your contract or a law belongs with your counsel.

Frequently asked questions

Sources