Behind the AI Stock Selloff: The First Direct Clash Between Model Sovereignty and Data Sovereignty

Hong Kong AI Stocks Suddenly Tumble Together

A sudden wave of turbulence swept through Hong Kong's markets. AI large model stocks sold off in unison — Zhipu dropped more than 10% at one point in the afternoon session, MiniMax fell over 5%, Alibaba slid roughly 4.2% to HK$110, snapping a three-day winning streak, while SenseTime and Xiaomi each shed around 2.5% at their lows.

Zoom out on the timeline and the contrast is even more striking. Alibaba had rallied continuously since September 18 (+4.0%, +3.02%, +1.95%), and was still climbing yesterday on AI chip and new model news — only to reverse sharply today. Zhipu's chart is even more volatile: after falling for several straight days, it staged a strong rebound from September 16 to 21 (+5.88%, +2.78%, +5.41%, +1.79%), then dropped 6.55% yesterday and tumbled more than 10% in today's afternoon session.

Notably, DeepSeek^Ad and Moonshot AI (月之暗面) don't have publicly traded shares. That means the listed companies named today are effectively pricing in, on behalf of the entire industry, a clear message to the market: this is no longer a purely technical dispute — it is now being treated as regulatory risk.

The Origin: Anthropic's 154-Page Threat Intelligence Report

The storm traces back to a 154-page threat intelligence report previously published by Anthropic. The report named seven Chinese companies in one sweep — Alibaba, DeepSeek, Moonshot AI, Zhipu, Xiaomi, SenseTime, and MiniMax — accusing some of them of making large-scale calls to Claude through proxy accounts and third-party intermediaries, using Claude as a "teacher model" to extract answers, code, and even reasoning traces for training their own models.

But it's worth being precise: model distillation itself is not the real problem. Using a more capable model as a teacher to train a new one is a technically legitimate and openly discussed approach in the industry. What fundamentally changed the nature of the situation is a separate accusation Anthropic leveled — that some companies may not have been constructing their own training examples at all, but instead routing real user requests directly to Claude for processing.

The implications of this accusation are entirely different. A user thinks they're sending code files or business documents to a domestic large model — but some of that content may have been silently forwarded to an overseas model. The question instantly escalated from "did you learn from Claude?" to "did you send your users' data along with it?" This is the core reason the story suddenly became so sensitive.

---

Model Distillation is a training technique that transfers knowledge from a large, complex model (the "teacher model") to a smaller one (the "student model"). The core approach involves using the teacher model to generate large volumes of input-output pairs — including final answers, intermediate reasoning steps, and even probability distributions — and then training the student model on that data. First systematically formalized by Hinton et al. in 2015, it has since become standard industry practice. OpenAI, Google, and Meta have all publicly acknowledged using similar techniques to varying degrees in their own model training. The controversy is not the technique itself, but whether calling a commercial API to obtain output data violates terms of service — Anthropic's Claude usage terms explicitly prohibit using outputs to train competing models. This provision is technically feasible but nearly impossible to enforce retroactively, which is precisely why Anthropic chose to publish a threat intelligence report rather than pursue direct legal action, underscoring just how complex the evidentiary challenge is.

---

Volume Isn't the Issue — Content Is

Anthropic claimed that Moonshot AI had over 23 million Claude-related interactions between May and July of this year, with nearly 300,000 Kimi user requests forwarded to Claude within a single 10-day window. DeepSeek's related interactions exceeded 12 million over a 14-day period.

But the truly sensitive issue is not the volume — it's what those requests may have contained. Among the cases Anthropic disclosed: a user analyzing surveillance feeds from hundreds of cameras in Chengdu via Kimi; engineers at large state-owned enterprises submitting internal code, system documentation, and even access credentials; and cases involving public security system development and personnel location tracking.

If any of this content was ultimately routed through to Claude, the nature of the situation changes completely. This is why the investigation reported by The Information is most noteworthy not for cracking down on model distillation per se, but because regulators are likely trying to confirm: whether real user data crossed borders as a result of distillation and model routing.

---

Model Routing refers to the mechanism in multi-model architectures that automatically dispatches user inputs to different backend models based on request type, cost, or capability requirements. In domestic large model products, the routing layer is typically invisible to users — a user believes they're conversing with a single local model, when in fact the request may have been silently forwarded to a more capable third-party model to improve response quality. This "capability borrowing" offers short-term competitive advantages, but creates enormous compliance risk: the user's right to informed consent, the legal basis for cross-border data transfer, and the approval obligations under China's Data Security Law and Personal Information Protection Law for providing data overseas are all directly implicated. Once a routing chain includes an overseas node, data flows move outside the scope of domestic regulatory oversight — and this is the core trigger for regulatory intervention in this case.

---

A Counterintuitive Detail: Why Aren't Investigators Focusing on the Highest-Volume Player?

Here's a detail that defies intuition. According to Anthropic's disclosed data, Alibaba's related interaction volume actually exceeded 150 million — far higher than DeepSeek and Moonshot AI. Yet media reports indicate that the investigation is focused on DeepSeek and Moonshot AI.

Why? Because what regulators truly care about may not be "who distilled the most," but rather "who pulled real user data into the pipeline." No matter how large the interaction volume, if a company was using self-constructed training examples, the risk profile is in a completely different league from one that was forwarding actual user prompts externally.

This also reveals the most telling irony of the whole episode: the United States worries that Claude's model capabilities are being extracted by Chinese companies, while Chinese regulators worry that — in the process of extracting those capabilities — Chinese users' own data was sent out in the other direction. The same data pipeline. Both sides believe their core assets are leaking.

The First Direct Collision Between Model Sovereignty and Data Sovereignty

What this episode may ultimately change isn't just how DeepSeek or Kimi operate — it's the entire industry's approach to model training and compliance frameworks.

Several trends are now foreseeable: real user data must be completely isolated from overseas teacher models; government and enterprise data must remain within a closed domestic loop; third-party model routing must be auditable; sensitive prompts must not enter overseas models.

The competitive dimensions of the industry may also shift accordingly. Where companies used to compete primarily on benchmark scores, enterprise and government clients may now first ask: "Where does the prompt I send you actually end up?" Data controllability and routing transparency will become considerations that carry the same weight as performance in commercial procurement decisions.

This is the risk that the market has truly begun to reprice behind today's across-the-board selloff in AI stocks. America fears its model capabilities are being taken. China fears its data assets are being sent away. Model sovereignty and data sovereignty have, for the first time, genuinely collided head-on.

(This article is for industry analysis purposes only and does not constitute investment advice. Data cited is sourced from Anthropic's threat intelligence report and overseas media coverage; specific conclusions are subject to official investigations.)

---

Data Sovereignty and Model Sovereignty are two key concepts that have emerged from recent geopolitical competition in technology. Data sovereignty refers to a country's right to govern, control, and protect data generated by its citizens and institutions — the EU's GDPR and China's Data Security Law are both institutional expressions of this principle. Model sovereignty is a newer concept, referring to a country's or institution's ability to maintain core AI capabilities without depending on foreign models or being penetrated by another country's technical architecture. Previously, these two concepts largely inhabited separate policy discussions — data sovereignty as a privacy and compliance issue, model sovereignty as an industrial security issue. What makes this event unique is that through a single technical pipeline — distillation and model routing — assets flowing in both directions are simultaneously at risk, forcing two distinct regulatory logics to converge within a single enforcement action. In the global practice of AI governance, this is effectively unprecedented.