NSA, FBI, and CISA Name Six Chinese AI Companies Running Industrial-Scale Distillation Against US Frontier Models (AA26-251A)

US frontier AI models, specifically variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini, and Grok

The NSA, CISA, and the FBI issued joint advisory AA26-251A on September 8, 2026 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as conducting what the agencies call industrial-scale knowledge distillation campaigns against US frontier models. The advisory states these entities have extracted billions of tokens across millions of exchanges since at least late 2024, and assesses that the campaigns likely occurred with the Chinese government's awareness. Distillation, training a smaller model on a larger model's outputs, is an ordinary machine learning technique; the advisory's concern is its use to acquire a competitor's capabilities without the cost of developing them. The named tradecraft is about access rather than intrusion: gray-market API proxies described as transfer stations to defeat geographic restrictions, account pooling with shared payment methods and consistent metadata across many accounts, prompts constructed to force models to expose their internal chain-of-thought reasoning, and automated failover that switches access pathways when one is blocked. The advisory cites Moonshot AI as having used US frontier models since at least mid-2025 to improve software engineering, mathematics, supervised fine-tuning, and reinforcement learning in its Kimi models. The recommended mitigations are detection of anomalous prompts, accounts, networks, and behaviors including subscription-to-usage ratio monitoring; deliberately subtle response alterations for suspected distillation traffic rather than outright blocking; and cross-organization intelligence sharing on infrastructure indicators

Not a vulnerability. The output of a model is the asset, and the interface that sells that output to legitimate customers is the same interface that hands it to a competitor. Nothing in the described activity requires compromising a system, which is why the recommended controls are abuse detection and quiet response degradation rather than patching