Key Points:
- The Cyberspace Administration of China opened an investigation into AI startups DeepSeek and Moonshot AI over cross-border data routing.
- Regulators are probing whether the startups forwarded live Chinese user queries to US servers to train their own foundation models.
- The inquiry follows reports revealing Chinese AI labs harvested over 151 million prompt exchanges from Western AI models.
- Unauthorized data transfers violate China’s Data Security Law and Personal Information Protection Law, risking severe fines and app bans.
China’s premier internet and data security watchdog opened a formal regulatory investigation into high-profile domestic artificial intelligence startups DeepSeek and Moonshot AI over allegations that the companies secretly routed domestic user data through United States servers. The Cyberspace Administration of China launched the inquiry to examine whether the two AI developers violated national data sovereignty laws by forwarding live user queries to American application programming interfaces to train their own foundation models. The probe marks a major regulatory headache for China’s most celebrated generative AI startups.
The regulatory investigation follows recent international threat intelligence disclosures revealing widespread model distillation campaigns conducted by Chinese technology labs. A comprehensive report from American AI developer Anthropic detailed how several Chinese firms—including Moonshot, DeepSeek, Alibaba, and Xiaomi—used automated networks to query Western models at massive scale. The report revealed that operators harvested reasoning outputs to train domestic models, generating more than 151 million prompt interactions through thousands of fraudulent accounts.
Chinese regulators are focusing specifically on allegations that Moonshot AI and DeepSeek forwarded unvetted consumer chat sessions directly to American servers in real time. According to the technical findings, the startups allegedly routed incoming user prompts—which frequently contained private correspondence, proprietary business documents, and sensitive corporate spreadsheets—into foreign AI APIs to generate high-quality training responses. Chinese data authorities view transferring unencrypted domestic citizen data to foreign servers as a severe violation of national cybersecurity rules.
The unauthorized data transfers directly challenge China’s strict data governance legal framework, anchored by the Personal Information Protection Law and the Data Security Law. Under Chinese statutory rules, commercial enterprises must undergo rigorous security reviews and obtain explicit regulatory clearance before transmitting personal information or critical industrial data across national borders. Transferring domestic consumer queries to American technology platforms without official approval exposes the startups to heavy administrative fines, app store bans, and suspension of operational algorithm licenses.
The investigation targets two of the most prominent success stories in China’s rapidly growing artificial intelligence ecosystem. Moonshot AI, founded in 2023 by Tsinghua University alumnus Yang Zhilin, achieved a private market valuation exceeding $3 billion after raising hundreds of millions of dollars from prominent venture funds, including Alibaba and HongShan. The startup gained nationwide fame through its Kimi conversational assistant, which pioneered long-context document processing capable of analyzing millions of Chinese characters in a single prompt.
DeepSeek achieved international acclaim within the global developer community by releasing open-weight foundation models that rivaled Western closed-source platforms at a fraction of the computational cost. Backed by quantitative investment firm High-Flyer Capital Management, DeepSeek built its brand around computational efficiency and algorithmic innovation, claiming that its engineering teams optimized model architectures to run high-level reasoning on limited graphics processing unit clusters. The regulatory inquiry threatens to damage that reputation by raising questions about how much of its reasoning capability originated from distilled Western models.
In machine learning development, model distillation functions as a common but legally contentious technique where engineers use a powerful, expensive foundation model to generate synthetic training data for smaller, cheaper models. While developers widely utilize distillation to compress neural networks for efficient deployment, querying proprietary commercial models to train direct market competitors violates standard enterprise terms of service. For Chinese regulators, however, the primary concern remains national security and the unauthorized export of domestic user telemetry.
The regulatory probe arrives as Beijing intensifies state oversight over the domestic artificial intelligence sector. While Chinese policymakers have poured billions of dollars into supporting domestic chipmakers and encouraging open-source model development, authorities maintain a zero-tolerance approach to data sovereignty breaches. Regulators worry that exposing domestic industrial data and public queries to foreign servers creates digital intelligence vulnerabilities that foreign security agencies could exploit.
Both DeepSeek and Moonshot AI face significant operational risks as the Cyberspace Administration of China conducts forensic audits of their data routing architecture, server logs, and API request gateways. If regulators uncover evidence of willful compliance violations, the startups could face mandatory restructuring of their data pipelines, public reprimands, and executive penalties. Regulatory authorities could also require the companies to retrain specific model checkpoints if investigators determine that proprietary models rely on illegally harvested datasets.
As government investigators review server records in Beijing and Hangzhou, the inquiry into DeepSeek and Moonshot AI establishes a clear warning for the global artificial intelligence sector. In the race to build cutting-edge generative software, AI developers cannot cut corners on user privacy, copyright protections, or cross-border data transfer laws. By enforcing strict data sovereignty rules on its own startup champions, China is demonstrating that technological self-reliance must adhere to uncompromising regulatory and national security standards.
