NSA, CISA and FBI ask providers to quietly route suspected distillers to weaker models
The joint advisory names six Chinese AI firms and tells providers to degrade suspect accounts without telling them. Its three detection signals also describe a lot of ordinary enterprise batch traffic.
The Engineer · Build desk
What happened
- The NSA, CISA and FBI published a joint advisory on 8 September 2026 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as running knowledge-distillation campaigns against US frontier models.
- The agencies say the six firms extracted billions of tokens across millions of exchanges from Claude, GPT, Gemini and Grok since at least late 2024, likely with the knowledge of the Chinese government.
- Requests were allegedly routed through gray-market proxy services called transfer stations that resold access cheaply, obscured identifying metadata and switched pathways automatically when blocked.
- The advisory recommends providers serve altered responses or weaker models to accounts they judge to be distilling, and advises against telling those accounts that anything has changed.
- None of the six named companies had issued a public response to the specific allegations at the time of publication.
Why it matters
- Who's exposed exposure A legitimate fleet that shares one key and runs overnight trips the same signals the advisory lists, and the price of the false positive is answer quality the customer cannot trace to a cause.
- What it costs cost The hardening on offer, stricter identity checks, tighter account-sharing rules and lower usage limits, is billed to paying customers whose traffic looks industrial because it is.
- Who has to decide decision Any team that treats provider model behaviour as stable has to decide how it would detect a downgrade the vendor is being advised not to disclose.
- What doesn't add up contradiction The agencies say distillation buys shorter timelines and lower spend, while the OSTP memorandum says the resulting models fall short of the originals except on selected benchmarks, which leaves the value of what was allegedly taken unsettled.
Next story · Invest · Sep 30
OpenAI says it disrupted Moonshot-linked users trying to extract its models' protected reasoningConfirmed8 publishers
TechRepublic reports the advisory suggests three ways to degrade a suspect account: reduce reasoning depth, change how correct answers are reached, or move the user to a less capable model, with no notification [8]. IBTimes describes the same passage as advising providers to subtly alter responses or serve less sophisticated models to users identified with high confidence as malicious distillers, again without informing them [9]. A block returns a status code you can log, escalate and appeal. An unannounced quality drop arrives in an eval dashboard with no cause attached.
"Confirmed" and "high confidence" are different bars, and the two accounts of the advisory carry different ones. TechRepublic reports the agencies acknowledge that false positives would affect legitimate users, and recommend altering responses only during confirmed malicious campaigns, supported by stronger identity checks, behavioral monitoring and information sharing among model providers, cloud companies and API aggregators [14].
The signals on offer for making that call are thin. The advisory lists accounts shared across multiple IP addresses, continuous 24-hour usage, and new subscriptions that immediately consume their maximum quota [13]. A shared service key behind autoscaling workers hits the first, a nightly batch job the second, and a team that buys a plan on Monday to start a backfill the third.
Where the allegations get specific, they get specific about versions. DeepSeek is accused of campaigns involving Claude Sonnet 3.7, Claude Sonnet 4 and Claude Sonnet 4.5 along with multiple GPT, Gemini and Grok models, to generate training data for its R1 and V3 models [4]. Moonshot AI is accused of extracting Claude Fable 5 data to train Kimi-K3 and GPT-4o data to train Kimi-K2 [5]. Naming a model version points at request logs as the evidence.
The number worth doing arithmetic on is an older one. IBTimes reports Anthropic said DeepSeek, Moonshot and MiniMax generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts [16]. That averages about 670 exchanges per account [22]. Per-account rate limits do not see a campaign shaped like that. Catching it means correlating behaviour across accounts and across providers, which is the part of the mitigation list that only works if other companies cooperate [14].
The rationale the agencies give is economic. They say the firms conducting these campaigns achieve "significantly shorter AI development timelines and reduced financial expenditures" [10]. A White House Office of Science and Technology Policy memorandum from April 2026 put a limit on that, saying models developed through unauthorised distillation "do not replicate the full performance of the original", although they can appear comparable on selected benchmarks [15]. For anyone reading a distilled model's benchmark table, the memo's position is that the numbers hold on the benchmarks chosen and not past them.
"China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale," US officials said [11]. The advisory says the activity was conducted "likely with Chinese government awareness" and does not allege that Chinese intelligence agencies directly participated [3]. China's Foreign Ministry called the claims lacking factual basis and legal grounding, and said distillation is a widely used technical method [18]. "We hope the US will earnestly implement the important consensus reached by the leaders of both countries and refrain from making false accusations and smearing China," Foreign Ministry spokesperson Mao Ning said, according to Reuters [17]. Reuters reports the dispute arrives ahead of a planned Sept. 24 meeting between President Donald Trump and Chinese President Xi Jinping [20].
What to watch
- A provider publishing whether it degrades flagged accounts, and at what confidence threshold, would settle the gap between 'confirmed' and 'high confidence'.
- A named enterprise tracing a measured quality drop to an abuse flag rather than to a model update.
- Any move by clouds or API aggregators to publish the account-sharing enforcement rules the advisory's signal list implies.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence48
- Adoption18
- Hype gap+28
- Incentives74
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI published a joint advisory on 8 September 2026 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as companies involved in knowledge-distillation campaigns against US frontier AI models.
- [2]
The agencies say the six firms extracted 'billions of tokens' across millions of exchanges and requests from US frontier models including Claude, GPT, Gemini and Grok, with activity dating back to at least late 2024 and carried out 'likely with the knowledge of the Chinese government'.
- [3]
The advisory said the activity was conducted 'likely with Chinese government awareness' but did not allege that Chinese intelligence agencies directly participated.
- [4]
DeepSeek is accused of conducting organised distillation campaigns involving Claude Sonnet 3.7, Claude Sonnet 4 and Claude Sonnet 4.5, as well as multiple GPT, Gemini and Grok models, to generate training data for its R1 and V3 models.
- [5]
Moonshot AI is accused of extracting Claude Fable 5 data to train its Kimi-K3 system and of using GPT-4o data to train Kimi-K2.
- [6]
The companies allegedly used proxy services known as 'transfer stations' that resold access to US models at reduced prices while obfuscating identifying metadata, and routing infrastructure that distributed requests across multiple pathways and automatically switched between them during blocking attempts.
- [7]
The advisory alleges the use of fraudulent accounts and bulk procurement of premium subscriptions to bypass regional restrictions and provider safeguards.
- [8]
The advisory recommends that AI companies alter responses sent to suspected distillation operations: providers could reduce reasoning depth, change how correct answers are reached, or move suspicious users to less capable models without notifying them.
- [9]
The advisory advises companies to subtly alter responses or use less sophisticated models for users identified with high confidence as conducting malicious distillation, without informing those users of the change.
- [10]
The US agencies said companies conducting these campaigns can achieve "significantly shorter AI development timelines and reduced financial expenditures" when training frontier systems.
- [11]
"China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale," US officials said.
- [12]
The advisory accused DeepSeek of extraction campaigns targeting reasoning and specialized functions used to develop its R1 and V3 models, Alibaba of targeting software engineering, customer-service and agentic capabilities, MiniMax of extracting reasoning and software-development capabilities, StepFun of targeting coding and agentic functions, and Z.AI of extracting chain-of-thought reasoning data.
- [13]
Warning signs described in the advisory included accounts shared across multiple IP addresses, continuous 24-hour usage and new subscriptions immediately consuming maximum quotas.
- [14]
Such defenses could affect legitimate users if detection systems produce false positives, so the agencies recommend altering responses only during confirmed malicious campaigns, supported by stronger identity checks, behavioral monitoring and information sharing among model providers, cloud companies and API aggregators.
- [15]
The White House Office of Science and Technology Policy said in an April 2026 memorandum that models developed through unauthorised distillation campaigns 'do not replicate the full performance of the original', although they can appear comparable on selected benchmarks.
- [16]
Anthropic said three Chinese AI laboratories, DeepSeek, Moonshot and MiniMax, had generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts.
- [17]
"We hope the US will earnestly implement the important consensus reached by the leaders of both countries and refrain from making false accusations and smearing China," Chinese Foreign Ministry spokesperson Mao Ning said, according to Reuters.
- [18]
China's Foreign Ministry described the claims as lacking factual basis and legal grounding, while saying distillation is a widely used technical method.
- [19]
None of the six named companies had issued a public response to the specific allegations at the time of publication.
- [20]
The dispute arrives ahead of a planned Sept. 24 meeting between President Donald Trump and Chinese President Xi Jinping, according to Reuters.
- [21]
Distillation itself is a legitimate AI technique that allows a smaller model to learn from the outputs of a more capable system; the US allegation centers on how the technique was used, including request volumes, account pools, proxy services and attempts to bypass geographic and usage restrictions.
- [22]
Anthropic's disclosed figures average about 670 exchanges per fraudulent account.
- [23]
For enterprise AI customers, providers may introduce stricter identity checks, tighter account-sharing rules, lower usage limits or undisclosed model downgrades when they detect suspicious activity.
Sources
2 independent publishers whose own reporting we read for this story.
- US Names Six Chinese AI Firms Accused of Stealing Claude, GPT and Gemini Capabilities
ibtimes.co.uk
1 article · September 10, 2026
- techrepublic.comUS Accuses Six Chinese AI Firms of Distilling Frontier Models
1 article · September 10, 2026
Topics and entities
Topics
- Teacher-student distillation pipelines
- Joint cyber advisories
- US-China Open Model Competition
- AI API Abuse