Skip to content
NewsRegulation

NSA, CISA, and FBI name six Chinese AI companies in joint advisory on industrial-scale model distillation

· by Pondero Newsdesk

The short version

A joint advisory from the NSA, CISA, and FBI publicly identifies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as conducting systematic extraction of capabilities from Claude, GPT, Gemini, and Grok since late 2024.

NSA, CISA, and FBI name six Chinese AI companies in joint advisory on industrial-scale model distillation

Three US federal agencies published a joint cybersecurity advisory on September 8, 2026, publicly naming six Chinese AI companies they say extracted billions of tokens from American frontier models since late 2024, per CISA advisory AA26-251A. The advisory carries concrete defensive guidance that any enterprise running high-volume API integrations with Claude, GPT, Gemini, or Grok should read before its providers implement the recommended countermeasures, which are designed to be invisible to the operator being targeted.

What the advisory says

CISA advisory AA26-251A, issued jointly by the NSA, CISA, and FBI, accuses DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of running what the agencies call industrial-scale distillation campaigns against US AI providers. The targets, per the advisory as reported by Help Net Security, included Claude variants, GPT, Gemini, and Grok.

The six firms extracted billions of tokens through millions of API requests beginning in late 2024, per advisory AA26-251A. Z.AI distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 by mid-2026, per the advisory as reported by Help Net Security. DeepSeek's extraction focused, per the advisory, on capabilities that now appear in its R1 and V3 models, covering reasoning, writing, agentic functions, and specialized tasks. Moonshot AI's campaigns, per the advisory, began around mid-2025 and targeted software engineering and mathematics capabilities that now surface in the firm's Kimi models.

How the six firms did it

The advisory describes a layered evasion approach common across all six named firms. They used gray-market API proxy services the advisory refers to as "transfer stations" to route traffic around regional restrictions on Chinese users. Premium account pools distributed requests across many identities to stay under per-account rate limits. Traffic was routed centrally across multiple API providers, cloud services, and aggregators to spread the footprint. Identifying metadata was stripped at the proxy layer to reduce traceability back to the originating organization.

The pattern the agencies describe is detectable but subtle. Indicators of compromise listed in the advisory include continuous usage with no natural human breaks across all 24 hours and seven days; anomalous ratios of premium subscriptions to actual API calls placed; rapid achievement of maximum usage limits shortly after account creation; coordinated behavior across networks of seemingly unrelated identities; and sudden shifts in metadata fingerprints.

Those signals are not unique to malicious distillation. Legitimate high-volume enterprise operations can exhibit some of them in isolation. The advisory acknowledges that tension indirectly by recommending response variation rather than a hard block as the preferred first-line response.

The silent countermeasure and why it matters for enterprise buyers

The most operationally significant recommendation in the advisory is one the agencies frame as a precision instrument: route suspected distillation accounts to less capable model versions and vary the quality of responses rather than blocking them outright. The rationale, per the advisory, is that a hard block signals detection to the actor and prompts them to rotate to fresh accounts. A degraded but functional response does not.

That approach has a direct implication for any team running high-volume API traffic. If a provider implements it, and if a legitimate enterprise account's usage fingerprint is flagged incorrectly as suspicious, that account could silently receive lower-quality responses. No error code, no rate-limit notification, no explanation. The engineering team would see degraded output quality without knowing why, and the degradation would not appear in the provider's status pages.

The advisory also calls for stronger identity verification at the account level, differential privacy layered with rate limiting, updated safety training to reduce the usefulness of extracted outputs, and formal information sharing between US AI providers about known distillation infrastructure. The agencies closed with a direct statement: "We strongly urge AI companies to take immediate steps to safeguard their platforms," per advisory AA26-251A.

Who these companies are and what the context is

Distillation, the technique of training a smaller model on a larger model's outputs, is widely used and not inherently illegal. Many open-source model releases acknowledge it, and providers often permit it under specific terms. What the advisory describes is a different category: systematic extraction at scale, explicitly structured to evade terms of service, usage limits, and geographic restrictions.

Alibaba's inclusion is notable because the company operates at a different scale than the other five named firms. Its presence alongside smaller actors like StepFun and Z.AI signals the agencies concluded that industrial-scale distillation was not confined to a single type of organization.

The advisory is a cybersecurity instrument, not a sanctions document. It does not impose restrictions on its own. Its primary immediate effect is to create a public record naming these six companies and describing their methods in detail, which forms the kind of evidentiary foundation that export-control proceedings and diplomatic engagements typically require before moving forward.

Neither Anthropic, OpenAI, Google, nor xAI had publicly confirmed as of September 9, 2026, that they detected the specific campaigns described, or that they had already implemented the advisory's mitigation recommendations. None of the six named Chinese companies had issued public statements as of that date either.

What to watch next

Three developments are worth tracking. First, whether any of the four named target providers, Anthropic, OpenAI, Google, or xAI, publicly confirms it has deployed the silent response-degradation approach the advisory recommends. A confirmation would tell enterprise buyers that provider-side quality variation is already live in production and would change how they should interpret unexplained output quality dips in their pipelines.

Second, whether the Commerce Department or the Office of the US Trade Representative uses the advisory as a foundation for tightening API access or export controls on the six named companies. The advisory's detailed naming and description of methods is consistent with the kind of public record those agencies typically publish before an enforcement action.

Third, whether any of the six named companies respond publicly. A denial, a legal challenge, or silence are all meaningful signals about how the named firms plan to engage with the US regulatory environment.

For any team running frontier model APIs at high volume: the near-term practical action is to review your usage patterns against the detection indicators the advisory lists and to ask your provider whether it has deployed any of the recommended mitigations. The advisory's preferred countermeasure is designed to be visible to the provider and invisible to the account being throttled.

Sources