Treat every prompt as a personal data item and map, per workflow, which services and underlying models see the prompt, how long it is kept, whether it is used for training and what consent applies. The trigger is Anthropic's report that DeepSeek and Moonshot forwarded customer questions to Claude without notice.
On 11 September 2026 Anthropic reported, as covered by CNBC among others, that the Chinese labs Moonshot and DeepSeek secretly forwarded customer questions to the Claude models in order to use the answers for training their own models. According to that reporting, Moonshot routed nearly 300,000 customer requests to Claude in ten days and DeepSeek carried out more than 12 million distillation exchanges in fourteen days, without informing their own users. For professionals this means the question "where does my prompt go?" can no longer be answered with the name of the visible chatbot alone.
What exactly happened when prompts were forwarded to Claude?
According to the accusation by Anthropic described by CNBC, the labs involved used intermediary accounts to forward their customers' questions to Claude and returned the answers under their own brand name. The users of those services received no notice that their questions ended up on the servers of a third-party model.
In our assessment, the core of this incident is not the competition between labs, but the invisibility of the route. A prompt a user puts to service A is answered by model B, without the user knowing this or having consented to it. That turns the prompt itself into a hidden data flow rather than a private exchange with "your" chatbot.
Why does silent forwarding clash with Claude's own privacy rules?
In its privacy policy for consumer services, Anthropic describes that personal data is processed with consent and that users can choose to have their data used for model training. The explanation of the updated terms of use states that conversations and feedback are kept for up to five years when a user opts in to training, and roughly 30 days on refusal.
That regime assumes that the user knows they are talking to Claude and makes a genuine choice about retention period and training. It is precisely that assumption that falls away when another service quietly forwards prompts: the original users never see Claude's terms and do not consent to long-running training use. The promise of one service and the reality behind the scenes then diverge.
Why do prompts count as personal data under the GDPR?
A privacy and compliance guide from Regolo.ai dated May 2026 explains that prompts, conversation history and outputs generally count as personal data once they are linked to an account. The guide states that regulators increasingly expect explicit, opt-in consent for using such data for training, and warns against vague or bundled consent. The guide also notes that the EDPB explicitly identifies prompts, context windows and feedback as LLM-specific risk factors that belong in a DPIA.
The practical consequence: if you process confidential information via AI, then processing prompts is itself a processing operation that you must be able to account for. You will find more background on this in our overview of the GDPR responsibilities per phase of your generative-AI workflow and in the topic hub on AI privacy and the GDPR.
How do I map, per workflow, where my prompts go?
In our assessment, the most useful response to this incident is to treat prompts as a first-class data object and to record, per workflow, what happens to them. A workable inventory includes:
- Which visible service receives the prompt and which underlying models actually process that prompt.
- Which retention period applies at each step and whether the prompt can end up in a training dataset.
- Which legal basis or consent covers the processing, and whether that is specific and revocable.
- Whether service logs remain separate from training data, and what onward transfer to third parties is possible.
- Which evidence (logs, DPIA, redaction policy) is available if a regulator, client or internal auditor asks for it.
The same logic applies to links between AI services and external systems; anyone wanting to keep sight of that will find pointers in our analysis of the risks of AI connectors to external services.
Which controls belong to responsible prompt management?
A privacy-engineering guide from QubitTool dated June 2026 translates the GDPR and CCPA requirements into concrete patterns. The playbook for AI privacy engineering advises turning off raw prompt logging by default, using short retention periods and redaction when content is needed for debugging, and keeping service logs strictly separate from training data. According to the guide, training on prompts requires explicit consent or an opt-out arrangement with fine-grained control.
The DeepSeek-Claude incident is in effect the inversion of these patterns: users cannot see where their prompts go, which retention period applies or which model answers. A verification layer such as Vera can support these kinds of questions by making visible, per workflow, which independent models a task passes through and which verification steps have been taken, so that control becomes possible; it is not a chatbot and not its own language model. The anonymisation of document values before AI processing is designed so that pre-processing takes place on EU infrastructure and, if the privacy check fails, nothing is forwarded. That does not remove the accountability obligation: the professional final judgement remains with you.
Sources and references
- Chinese AI labs secretly used millions of Claude exchanges to train their models, Anthropic says
- Anthropic Privacy Policy (Consumer Services)
- Updates to Consumer Terms and Privacy Policy
- AI, privacy and compliance in 2026: what changes for LLM providers
- AI Privacy Engineering [2026]: GDPR & CCPA Data Playbook
Sources: The article relies on the accusation by Anthropic described by CNBC, Anthropic's privacy policy and terms of use, and on privacy guides from Regolo.ai and QubitTool.