US Agencies Accuse Six Chinese AI Firms of Industrial-Scale Model Distillation

Reports published on September 9, 2026 detail a joint U.S. government assessment accusing six China-based artificial intelligence companies of systematically extracting capabilities from American frontier models.

CISA, the NSA, and the FBI named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. According to the government advisory, the companies collected billions of tokens through millions of requests directed at models operated by Anthropic, OpenAI, Google, and xAI.

The advisory’s publication date is not fully consistent across reports. Two publications dated their coverage September 9, while another said the agencies released it on September 8. The official CISA material available here does not display a date.

The alleged activity began at least in late 2024. U.S. agencies characterize it as a sustained model-security and intellectual-property campaign, not a conventional intrusion into corporate networks.

Distillation Became an Extraction Operation

Knowledge distillation is a standard machine-learning method. A smaller “student” model learns from answers generated by a stronger “teacher,” allowing developers to transfer useful behaviors without reproducing the teacher’s entire architecture.

The agencies argue that the reported campaigns crossed into abusive extraction through their scale, intent, and access methods. The alleged operators used unauthorized API access, account sharing, fraudulent subscriptions, proxy services, automated prompt generation, and techniques intended to bypass geographic restrictions and provider safeguards.

Requests were spread across native APIs, cloud platforms, third-party aggregators, gray-market proxies, and services described as “transfer stations.” Distribution made each stream of activity less conspicuous and prevented any single provider from seeing the full operation.

Account swarms allegedly submitted identical or closely related prompts thousands or millions of times. Operators then collected the answers as synthetic training data, evaluated their quality, and used them for supervised fine-tuning, reinforcement learning, or dataset refinement.

Some prompts sought restricted chain-of-thought information rather than ordinary answers. DeepSeek, for example, allegedly attempted to make models reconstruct and explain their internal reasoning step by step. MiniMax reportedly used prompt injection against Claude Code, trying to convince the system that it was a MiniMax product and potentially change what it disclosed.

More advanced operations allegedly tested whether providers had intentionally degraded responses. They could switch accounts, models, or access routes after blocking and automatically identify newly released systems.

Six Companies, Different Models and Objectives

DeepSeek’s alleged campaign began at least in late 2024 and continued from late 2024 to mid-2025. The extracted data was reportedly used to produce synthetic training material for its R1 and V3 models; R1 was released in early 2025.

Its listed targets included Claude 3.7, Claude Sonnet 4 and 4.5, Claude Opus 4.1, Gemini 2, Gemini 2.5 Pro Preview, Gemini 2.5 Flash Preview, GPT-4, GPT-4o, GPT-4 Mini, GPT-4 Nano, GPT-5, Grok 3 Mini, and Grok 4. Desired capabilities ranged from legal specialization and agentic behavior to writing, question answering, API-driven tasks, and supervised fine-tuning.

The advisory also disputes DeepSeek’s publicly cited $5.6 million training-cost figure. The agencies contend that it excludes the economic value and acquisition cost of data obtained through extensive distillation.

Moonshot AI allegedly began a broad extraction campaign at least in mid-2025. It reportedly used Claude Fable 5 data for Kimi-K3 and GPT-4o outputs for Kimi-K2, targeting supervised fine-tuning, reinforcement learning, mathematics, and software engineering.

Its source-model list includes Claude Opus 4.1; Claude Sonnet 3.7, 4, 4.5, and 4.5 Thinking; Claude Fable 5; GPT-oss-20b; GPT-3; GPT-4o and GPT-4o mini; GPT-5, GPT-5 Codex, and GPT-5 Pro; Gemini 2.5 Flash, Flash-Image, and Pro; Nano Banana; and Grok Code Fast-1. Moonshot allegedly redirected its collection infrastructure to a new Claude model within 24 hours of launch, suggesting automated monitoring of model releases.

Alibaba’s reported activity occurred in late 2025 and sought to improve its Qwen family. The named targets were Claude 4, Claude Opus, Claude Sonnet, and GPT-5. Collection focused on software development, customer-service dialogue, virtual characters, evaluation datasets, agentic workflows, reinforcement learning, and supervised fine-tuning.

MiniMax allegedly targeted Claude Code, Claude Sonnet 4, Claude Opus 4.5, Gemini 1, Gemini 2.5 Pro, Gemini 3 Pro, and GPT-5 in late 2025. The intended beneficiary was its M2 model. The sought-after functions included code review, software engineering, agentic operation, chain-of-thought reasoning, reinforcement learning, and dataset refinement.

StepFun’s activity is placed between late 2025 and early 2026. It allegedly used Claude Opus 4.1 and 4.5, Claude Sonnet 4.5, Claude Haiku 4.5, GPT-5 Mini, GPT-5 Pro, GPT-5.1, GPT-5.1 Codex, GPT-5.1 Codex Mini, and GPT-5.2 to improve Step 4’s coding and agentic functions. Its operation reportedly pooled accounts to evade rate limits and increase daily spending.

By mid-2026, Z.AI had allegedly extracted billions of tokens from GPT-5.5 and Claude Opus 4.8 to develop chain-of-thought capabilities.

The Security Impact Is Strategic, Not Patchable

The agencies rate the activity as a high-to-critical strategic and economic threat. It does not involve a disclosed software vulnerability, and there is no CVE, CVSS score, affected software release, or patch.

Instead, the target is the accumulated value inside frontier models: reasoning patterns, specialized behaviors, coding proficiency, domain expertise, agentic workflows, and outputs suitable for building training datasets.

Successful extraction can compress years of development by reducing experimentation, compute requirements, and research costs. Competitors may reproduce expensive capabilities without paying the full cost of discovering and training them.

The immediate victims are the model providers and their investors, but defensive consequences may affect legitimate customers. Stronger identity checks, usage restrictions, and deliberately reduced model performance can produce false positives for research teams or enterprises with unusually heavy API workloads.

Providers Should Correlate Accounts, Prompts, and Infrastructure

No single signal proves malicious distillation. The agencies recommend combining account, network, behavioral, and prompt telemetry.

Providers should investigate newly created accounts that immediately consume maximum allowances, operate continuously without human idle periods, or connect through numerous IP addresses and user agents. Shared enterprise subscriptions with throughput inconsistent with their declared purpose also merit review.

Other indicators include repeated prompts across providers, large clusters of related questions, distributed account creation, automated account rotation, and traffic that changes cloud services or proxy routes immediately after enforcement. Requests explicitly demanding hidden reasoning are another useful signal.

Detection must work across organizational boundaries. A campaign divided among several APIs and aggregators may resemble ordinary heavy usage to each individual service. Providers, cloud operators, API intermediaries, and governments therefore need to exchange account patterns, proxy infrastructure, prompt clusters, model-switching behavior, and evidence of automated output-quality testing.

The reported Moonshot behavior—moving to a newly released model within 24 hours—offers another detection opportunity. Rapid migration combined with high-volume, templated queries is more revealing than either characteristic alone.

Defensive Responses Carry Their Own Risks

For accounts assessed as malicious, the agencies propose quietly reducing the training value of outputs. Possible responses include limiting reasoning depth, introducing controlled noise or stylistic variation, withholding selected capabilities, or routing suspicious users to a less capable model.

They specifically advise against informing suspected China-based operators when such rerouting occurs. Silent changes make it harder for extraction systems to diagnose the defense and adapt.

That approach is technically difficult. The alleged campaigns employ quality-control systems capable of detecting altered answers and distinguishing deliberate degradation from routine service problems. Operators can then rotate accounts, rewrite prompts, or move to another provider.

Defensive modifications can also impair independent safety testing. Providers should ensure that trusted evaluators know when models have been changed, while preventing that information from reaching suspected extraction operations.

Attribution Remains Contested

The U.S. agencies assess that the scale, persistence, and operational maturity of the campaigns make distillation a central development strategy for the six companies. They also believe the activity probably occurred with Chinese government awareness.

That remains an intelligence assessment rather than an independently adjudicated finding.

China’s Ministry of Foreign Affairs rejected the allegations as groundless, while a Chinese Embassy spokesperson previously described the U.S. position as a prejudiced smear campaign. Chinese officials maintain that the country’s AI advances result from domestic scientific development and allege that American companies have also distilled Chinese models.

The dispute does not change the defensive problem. Frontier-model providers now face extraction operations that resemble coordinated security campaigns: distributed infrastructure, automated account management, evasive routing, prompt manipulation, and continuous adaptation when controls appear.