What the advisory says
The National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI issued a joint cybersecurity advisory on 8 September accusing six China-based artificial intelligence companies of extracting capabilities from American frontier models at industrial scale.
The advisory, catalogued as AA26-251A, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.ai. The agencies write that China-based AI companies are engaging in what they call aggressive, malicious and targeted distillation activities at an industrial scale, against models in the Claude, GPT, Gemini and Grok families. They date the campaign from late 2024 through the middle of 2026.
Distillation itself is ordinary machine learning. A smaller model is trained on the outputs of a larger one until it reproduces enough of the larger model’s behaviour to be useful, at a fraction of the training cost. What the agencies describe is that technique pointed at models the distiller does not own and has not licensed for the purpose, at a volume they measure in billions of tokens across millions of exchanges.
The specific accusations
The advisory is unusually granular about which capabilities it says were targeted. It says Moonshot AI ran millions of exchanges aimed at agentic reasoning and tool use, coding and data analysis, computer-use agent development and computer vision.
It says that in late 2025 Alibaba distilled Claude and GPT models to improve software engineering, customer-service dialogue and image and character creation in its Qwen family, and that MiniMax drew on Claude and Gemini models to improve chain-of-thought reasoning and software engineering in its M2 model.
These are assessments by the three agencies. The advisory does not publish the underlying evidence, none of the six companies is quoted in it, and the document itself frames the conduct as a violation of the American providers’ terms of use rather than as a charged offence.
Routing around the terms of service
On method, the agencies say the requests were routed through several paths at once: native APIs, remote cloud providers that resell model access, and third-party aggregators that strip or obscure user metadata on the way through. The effect they describe is a campaign that looks, to any single provider, like unremarkable traffic from many unrelated accounts.
The recommended mitigations are the more interesting half of the document. Alongside conventional controls — rate limiting, query volume caps, adversarial input detection, differential privacy, all mapped to the MITRE ATLAS framework — the agencies suggest behavioural detection based on the ratio of a customer’s subscription tier to its actual usage, on new accounts that hit maximum usage immediately, and on enterprise-scale throughput from accounts that should not have it.
They also recommend something closer to active defence: making subtle changes to responses for suspected malicious distillation attempts, in order to attenuate the payoffs. That is advice to degrade an answer rather than refuse it, so that a distiller trains on damaged data without knowing it, and it is the first time American agencies have recommended the tactic in a public advisory.
What to watch next
The advisory carries no enforcement power of its own. What it does is establish an official US position that a set of named Chinese models were built in part on extracted American outputs, which is the kind of finding that gets cited later in export-control debates, in procurement rules and in litigation. Whether any of the six companies responds, and whether American providers publicly adopt the response-alteration tactic, are the two things worth watching.
