← threat actors
threat actor · not yet in the cluster map
moonshot
also tracked as zhipu 1
2 stories · 1 in the wild · July 25, 2026 – October 14, 2026
evidence: 1 observed
geography
- china 1 · Oct 14
- uk 1 · Jul 25
- us 1 · Jul 25
techniques
- credential access 1 · Oct 14
attack phases seen
- Collection 1 · Oct 14
- Credential access 1 · Oct 14
what we reported, newest first, grouped by story
October 14, 2026
- Anthropic says it cut extraction of Claude's internal reasoning tokens by 90–99%, attributing the industrial-scale distillation attempts to Chinese firms Zhipu and Moonshot, and says it has banned tens of thousands of accounts (The Decoder).
· Oct 14 · observed · as zhipu · AI & Model Security
July 25, 2026
- Kimi K3 lags frontier models badly on offensive cyber. UK AISI and the US CAISI scored Kimi K3 at 32% on ExploitBench versus 76% for leading US models, with its safeguards failing to block exploit development or simulated attacks — a gap that aligns with allegations Moonshot distilled Anthropic's models. The Decoder.
· Jul 25 · none · AI & Model Security