China probes DeepSeek, Moonshot over data leaks to Claude

Chinese cybersecurity and market supervision authorities have opened investigations into Beijing startup DeepSeek and AI firm Moonshot over allegations that they transferred user and proprietary data to Anthropic’s Claude. The probes focus on possible unlawful cross-border transfers and compliance with China’s data protection and security rules.

Regulators began inquiries after allegations that datasets or query logs from Chinese users were transmitted to Claude via commercial APIs or other technical channels. Officials have asked the companies to produce records showing what data was collected, how it was stored and whether any material was sent outside China without required approvals.

Investigators have requested API call logs, export controls on datasets and internal compliance reports. Authorities are examining technical safeguards, data-governance procedures, contractual terms with foreign service providers, use of third-party cloud services and any automated data flows that could route material to overseas models.

Corporate filings indicate DeepSeek built search and data-aggregation tools for enterprise clients and Moonshot provided model-training and inference services. Regulators are probing whether those services involved sending client or internal data to Anthropic’s systems. Public notices do not name Anthropic as a subject of the probe.

Legal frameworks cited by officials include the Personal Information Protection Law and recent rules that require security reviews for certain AI services and for cross-border data transfers that could affect national security. Under those laws, some transfers need risk assessments or regulatory approval and companies must take measures to protect regulated and sensitive information.

Chinese authorities have not released detailed evidence. The firms involved have issued limited public statements. The scope of any data exposure, the timeline of the alleged transfers and potential penalties remain unclear. Possible outcomes under the relevant rules include remediation orders, fines or suspension of services if violations are found.

The investigations are part of broader regulatory checks on technology firms that provide or route AI services across borders. Chinese regulators in recent months have increased oversight of generative AI providers and the data ecosystems used to train and operate models, citing risks tied to cross-border data flows and the handling of personal and sensitive information.