Who Gets to Train on Whom?

In its September 2026 threat intelligence report, Anthropic accused Moonshot of forwarding some Kimi customer requests to Claude and retaining some interactions to extract reasoning traces and train models. The report leaves a striking gap: Anthropic also says it does not know whether those users were told where their requests went.

“Did Kimi steal from Claude?” is an attention-grabbing question. I think another belongs in front of it: what authorizes a question submitted to Kimi to enter another model provider's service chain? Model companies have advocates for their assets. The people submitting code, documents, and personal questions are much easier to lose from the discussion.

Were users told about 300,000 forwarded requests?

The report counts two different activities: about 300,000 forwarded customer requests in a ten-day window, and more than 23 million distillation interactions attributed to Moonshot from May through July 2026. One measures customer-request forwarding; the other measures distillation interactions. Explaining those calls requires accounts, purposes, and data flows to be put on the record.

Anthropic has made an attribution and an accusation. Moonshot needs to answer with the actual calling and data-handling process: which user requests reached Claude, what was retained, and what went into training. The companies can continue arguing; these questions should have records that can be checked.

Reasoning traces are worth more than answers

Knowledge distillation is not mysterious: one model learns from answers, explanations, or other signals produced by another. Companies use it internally, and partners use it with permission. The method is ordinary. The harder questions are where the examples came from and what the recipient was allowed to do with them.

Reasoning traces turn decomposition, verification, and revision into training signals. Richer material for a student model gives the source provider more reason to scrutinize how it is collected at scale. Collection and permitted use sit at the center of this dispute; calling it ordinary learning leaves those questions unanswered.

“If Claude can learn from the internet, why can't Kimi learn from Claude?” I would ask both sides the same questions: how was the material obtained, who could authorize its use, and what was it used for? Calling one's own training learning and a competitor's training theft is a convenient double standard. Put both provenance and permission on the table.

The customer owns the output; the contract sets another wall

Anthropic's commercial terms give customers output ownership to the extent permitted by law while restricting use of the service to develop or train competing models. Ownership and contractual use operate as separate layers. After delivering an answer, the provider still seeks contractual control over part of its subsequent use.

Copyright is a third layer. The US Copyright Office's account of AI outputs distinguishes human authorship from purely machine-generated material. Human expression, existing works, and generated components require separate analysis; contract enforceability also depends on parties, versions, and applicable rules. Providers seeking to restrict reuse should specify the right they are asserting.

Instead of debating in the abstract who owns an answer, ask which version of the contract was accepted, which account and channel produced the output, whether the restriction actually became binding, and whether the conduct can be attributed to a specific party.

A user submits a question. Who receives it next?

Even if a source-model provider expressly permits distillation, real user tasks may still move through another chain:

User content → AI product → third-party model → retention and curation → student model

Prompts can contain personal information, internal code, and third-party works. Users submit them to get a task done. Forwarding them to another provider, retaining them, and preparing them for training are additional handling decisions that the product owes users an explanation for. A text box is a poor basis for assuming unlimited permission.

The product should clearly state recipients, purposes, retention, and ways to restrict or delete data. The Personal Information Protection Law's requirements concerning processing purposes, notice, and individual rights also have to reach the service chain. A deal between model companies leaves users with their own interests in knowing and choosing how their data is handled.

Follow the calls to find responsibility

To investigate the dispute, follow the concrete actions along the call chain:

• Where the calls came from. Public observation, licensed calls, impersonation, and bypasses leave different account and access records.
• Where the outputs went. Display, retention, evaluation, and competitor training each need their permitted purpose identified.
• What did the reuse change? Research, compression, interoperability, and direct commercial substitution do not have the same effect on the market or the original provider.
• How user data was handled. Who decided to forward and retain it, who informed the user, and who handles deletion requests?

Implementation should leave records along that chain. Give users and enterprise administrators clear provider choices for third-party calls; explain subsequent training purposes and handling separately; log recipients, purposes, and authorization states for routing. The FTC's reminder about AI privacy and confidentiality promises has a practical point: make the actual data path honor what the product promised.

Do Not Write Users Out of the Story

I support model learning and market competition, and I dislike incumbents treating every subsequent learner as out of bounds. But disputes over training rights need a separate ledger for user data: who supplied it, for what purpose, and who later changed that purpose. Someone has to answer those questions.

What matters most to me is who made the decision on the user's behalf. Model companies can continue arguing over training rights. The person submitting a question deserves a clear view of whose services handled it and whose training pipeline received it. Hiding that path behind the product is what deserves scrutiny.