NSA, CISA and FBI name six Chinese AI companies as industrial-scale distillers of US models
The conduct described is authorised API traffic at scale rather than an intrusion, the detection asked for is billing telemetry providers already hold, and on Beijing's role the advisory goes no further than likely government awareness.
The Watch · Security desk
What happened
- A joint NSA, CISA and FBI advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as extracting billions of tokens from Claude, GPT, Gemini and Grok since at least late 2024.
- By the advisory's own count, DeepSeek drew synthetic training data for its R1 and R3 models from twelve US model versions across Anthropic, OpenAI, Google and xAI.
- Moonshot AI is accused of distilling 18 US models to train Kimi-K2 and Kimi K3, using millions of queries aimed at agentic reasoning, coding, data analysis and computer vision.
- The evasion described spreads requests across accounts, models and platforms, routes them through cloud providers and third-party aggregators to obscure metadata, and uses proxies and gray markets to beat geographic limits.
Why it matters
- What doesn't add up contradiction CISA's release says the activity happened likely with Chinese government awareness, while CyberScoop reports the agencies called it tacitly encouraged but not directed by Beijing; the difference decides whether a provider is documenting a contract dispute with named customers or a state collection operation.
- What it costs cost The recommendation to subtly alter responses for suspected distillation accounts puts the error cost on whoever gets misclassified, because a quietly degraded answer looks like an ordinary answer to the customer paying for it.
- What it limits constraint Because the agencies concede that distillation and weight-sharing are routine research practice, any threshold strict enough to catch industrial volume also catches well-funded evaluation work, and the provider has to draw that line on contract terms rather than telemetry.
- What it sets up precedent Three US agencies have now put six corporate names in a cyber advisory over terms-of-service violations, which makes account-level enforcement against those firms a documented federal position rather than a unilateral commercial call.
Next story · Leadership · Sep 11
Garry Tan points regulators away from distillation days after agencies named six Chinese labsConfirmed2 publishers
The mechanism is a paid API call and a saved answer. Nothing in the advisory describes an intrusion, a stolen weight file or a bypassed authentication control. Knowledge distillation trains a smaller model on a larger model's outputs, and CISA calls it a valid technique that can be misused to acquire a competitor's capabilities in less time and at less cost than building them [8]. The violation asserted is of terms of service [12].
That is why the recommended telemetry is ratio-based rather than volume-based. Requests spread across accounts, models and platforms, then routed through native APIs, remote cloud providers and third-party aggregators to break metadata correlation, defeat any per-account threshold [2]. So the advisory points instead at subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput on plans that do not justify it [3].
The counts are specific. DeepSeek's inputs break down as four versions of Claude, two of Gemini, five of ChatGPT and Grok 4 [17], which is twelve model versions feeding synthetic training data for R1 and R3 [20]. Moonshot AI is credited with 18 US models behind Kimi-K2 and Kimi K3, among them the system CyberScoop identifies as Fable 5, Anthropic's most advanced commercially available model [6]. Moonshot has been accused in public before: Michael Kratsios of the White House Office of Science and Technology Policy made the same claim about Fable 5 in June, and described the same guardrail-evasion apparatus [16].
On who ordered any of it, the two published accounts sit apart. CISA's release says the extraction happened "likely with Chinese government awareness" [18]. CyberScoop reports the practice is tacitly encouraged but not directed by political leaders in Beijing [19]. Neither is a tasking claim, and the advisory names six commercial companies rather than a service or a unit [1]. What the agencies do assert on the record is that the scale since 2024 makes distillation a critical part of China's AI industrial policy [13], and that the named activity is aggressive, malicious and targeted at industrial scale, as opposed to the weight-sharing and distillation that firms and open-source projects do in ordinary research [9].
The line between those two is contractual and quantitative, not a signature, and it lands on the same providers who are currently defending suits from artists, authors and media organisations over what went into their own training sets [15].
The third ask is the one no single provider can execute alone: correlate activity across model providers, cloud platforms and API aggregators to reveal distributed campaigns [7], supported by information sharing across the US government, industry and allied nations [10]. Nick Andersen, CISA's acting director, urged companies to take immediate steps [14]. Until a correlation channel exists, each provider sees its own slice of traffic the government measures in billions of tokens [1].
What to watch
- Whether any named provider publishes account terminations or token volumes tied to the six companies.
- Whether the cross-provider correlation channel CISA asks for gets an owner, or stays a recommendation.
- Whether a paying customer surfaces evidence of degraded responses after being misclassified as a distillation account.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence60
Perspective Coverage
8 publishers- Builder
- Builder 30%
- Operator
- Operator 50%
- Investor
- Investor 20%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges and requests from US frontier AI models, including variants of Claude, GPT, Gemini and Grok, since at least late 2024.
- [2]
Tactics listed in the advisory include spreading requests across different accounts, models and platforms; using native APIs, remote cloud providers and third-party aggregators to obfuscate user metadata; and leveraging proxies and gray tech markets to get around geographic restrictions, terms of use and built-in model safeguards.
- [3]
The advisory recommends providers detect anomalous and malicious prompts, accounts, networks and behaviours, and monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.
- [4]
CISA, with NSA and FBI, released a joint cybersecurity advisory warning that China-based AI companies are targeting US AI companies to systematically extract proprietary models through knowledge distillation campaigns, which the agencies say form the core of China's AI development strategy.
- [5]
The advisory recommends providers subtly alter responses for suspected malicious distillation attempts, to attenuate the payoffs to companies running industrial-scale distillation campaigns.
- [6]
Moonshot AI allegedly distilled 18 different US models, including Fable 5, described by CyberScoop as Anthropic's current most advanced commercially available model, to train Kimi-K2 and Kimi K3, using millions of queries aimed at agentic reasoning, coding and data analysis, computer vision and visual processing.
- [7]
The advisory recommends establishing cross-organisation intelligence sharing to correlate activity across model providers, cloud platforms and API aggregators, in order to reveal distributed campaigns.
- [8]
CISA describes knowledge distillation as a machine learning technique that trains a less capable model using the outputs of a larger, more capable one, a valid training method that can be misused to acquire competitors' capabilities in less time and with less cost than developing them legitimately.
- [9]
The agencies acknowledge that companies and open-source organisations commonly share weights or distill other AI systems in the course of legitimate work or research, but claim the Chinese companies are engaged in "aggressive, malicious, and targeted distillation activities at an industrial scale".
- [10]
The advisory states that addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing spanning the US government, private industry and allied nations.
- [11]
CyberScoop dates the joint warning to Tuesday.
- [12]
CISA says the distillation tactics used by the China-based AI companies violate the US companies' terms of service and shorten those companies' AI research development, undermining fair competition.
- [13]
The agencies wrote that the sheer scale of the distillation efforts since 2024 indicates distillation is a critical part of China's AI industrial policy.
- [14]
CISA Acting Director Nick Andersen said the agency strongly urges AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns.
- [15]
The frontier AI companies named as victims are themselves facing lawsuits from artists, authors, media organisations and others who say the companies illegally trained models on copyrighted or trademarked work.
- [16]
In June, Michael Kratsios, head of the White House Office of Science and Technology Policy, made a similar accusation that Moonshot AI distilled Fable 5 to train its own models, and described a similar sophisticated system for evading guardrails and usage restrictions.
- [17]
According to the advisory, DeepSeek distilled four different versions of Claude, two versions of Gemini, five versions of ChatGPT and Grok 4 to generate synthetic training data for its R1 and R3 models.
- [18]
CISA's release states the extraction happened "likely with Chinese government awareness".
- [19]
CyberScoop reports the US agencies said the practice is tacitly encouraged but not directed by political leaders in Beijing.
- [20]
The DeepSeek inputs listed in the advisory total twelve US model versions.
Sources
8 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comUS says Chinese firms extracted billions of tokens from frontier AI models
2 articles · September 9, 2026
- cisa.govCISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models with Industrial-Scale Knowledge Distillation Campaigns to Shortcut AI Development | CISA
1 article · September 8, 2026
- cyberinsider.comChinese AI firms use industrial-scale distillation to copy US models
1 article · September 9, 2026
- cyberscoop.comFeds accuse China of ‘systematic’ distillation of U.S. AI models
2 articles · September 8, 2026
- helpnetsecurity.comChinese AI firms are siphoning capabilities from American models, CISA warns
2 articles · September 9, 2026
- securityaffairs.comUS Agencies Warn Chinese AI Firms Are Extracting Advanced AI Models
1 article · September 9, 2026
- securityweek.comUS Agencies Warn China Is Systematically Extracting Frontier AI Capabilities
2 articles · September 9, 2026
- thehackernews.comU.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok
1 article · September 9, 2026
Topics and entities
Topics
- US-China Technology Competition
- Knowledge Distillation
- Government cybersecurity advisories
- AI model extraction