China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
US intelligence and cyber agencies say Chinese AI labs ran systematic, industrial-scale extraction of Claude, GPT, Gemini and…
NSA, CISA, and FBI issued a joint advisory alleging that China-based AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — have since late 2024 run industrial-scale knowledge distillation campaigns against U.S. frontier models (Claude, GPT, Gemini, Grok), extracting billions of tokens via APIs, cloud proxies, and "transfer station" gray-market services to evade geographic and usage restrictions. The advisory recommends U.S. AI companies monitor for anomalous usage patterns, subscription-to-usage ratios, and enterprise-scale throughput to detect and mitigate this activity.
Why it matters
This is a formal government assertion that distillation of frontier model outputs is being used systematically to shortcut competitors' AI development timelines and costs, which could accelerate enforcement of API terms-of-use, tighter usage monitoring, and geopolitical friction over model access. It signals that frontier labs may tighten API access, rate limits, and account verification in response, which affects anyone building on these APIs.
What is verified
NSA, CISA, and FBI jointly released an advisory alleging China-based AI companies (DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, Z.AI) conducted industrial-scale knowledge distillation against U.S. frontier models (Claude, GPT, Gemini, Grok) since at least late 2024. [1]
The advisory describes techniques including chain-of-thought extraction, use of proxy 'transfer stations' to bypass geographic restrictions, bulk procurement of premium subscriptions, and automated failover between pathways to evade detection. [1]
The agencies recommend U.S. AI companies implement detection of anomalous prompts/accounts, monitor subscription-to-usage ratios and enterprise-scale throughput patterns, and deploy targeted response measures. [1]
What is not
- The advisory text is truncated mid-sentence in the supplied evidence, so the full list of recommended mitigations is not available.
- No independent technical evidence (e.g., traffic logs, forensic analysis) is provided to substantiate the specific attribution claims beyond the agencies' assertions.
- It is unclear what concrete enforcement or policy action, if any, follows from this advisory (e.g., API access changes, legal action, new terms-of-use enforcement by OpenAI/Anthropic/Google/xAI).
- No detail on how this affects API pricing, availability, or terms of service for ordinary developers/agencies using these frontier model APIs.
The case for
The advisory comes from three U.S. government agencies (NSA, CISA, FBI) jointly, naming specific companies and specific techniques (CoT extraction, transfer stations, automated failover), which is a stronger evidentiary basis than typical industry speculation about distillation.
The case against
The advisory is a government assertion without published forensic evidence in the excerpt provided; distillation from model outputs via API is described as widely practiced and only sometimes prohibited by terms of use, and the advisory conflates a legitimate ML technique with a national-security framing that may serve broader geopolitical aims rather than a narrowly technical finding.
What to do with this
Treat this as a signal to watch for API provider policy changes rather than something requiring immediate action. No engineering or workflow change is warranted today based on this evidence alone.
Sources
- 1CISA Cybersecurity Advisoriescisa.gov · Primary source
Original source published 8 September 2026 at 14:00.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.