U.S. Intelligence Agencies Name Six Chinese AI Firms in Industrial-Scale Model Distillation Campaign

What happened

On September 8, 2026, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory (AA26-251A) accusing six China-based AI companies of running industrial-scale knowledge distillation campaigns against U.S. frontier AI models.

The named companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. According to the advisory, these firms have been extracting proprietary functionalities and capabilities from leading U.S. models—including variants of Claude, GPT, Gemini, and Grok—since at least late 2024, pulling billions of tokens across millions of requests.

The agencies describe the activity as going far beyond legitimate research. While knowledge distillation is a recognized and useful technique in AI development, the advisory alleges these companies are engaging in "aggressive, malicious, and targeted distillation activities at an industrial scale" that form the core of their AI development strategy, not merely a supplement to it.

Specific allegations include:

• DeepSeek reportedly distilled data from Claude 3.7, GPT-4o, and Gemini 2.5 Pro Preview to train its R1 and V3 models. The advisory notes that DeepSeek's widely cited $5.6 million training cost is misleading because it excludes the cost of data acquired through distillation.
• Moonshot AI allegedly took data from Claude Fable 5 for its Kimi-K3 model and from GPT-4o for its Kimi-K2 model.
• Alibaba, MiniMax, StepFun, and Z.AI are each described as leveraging distillation for their own models.

The companies reportedly routed requests through native APIs, remote cloud providers, and third-party aggregators to gain unauthorized access, in breach of provider terms of use. The advisory also describes a gray market of proxy services called "transfer stations" used to bypass geographic restrictions and evade safeguards.

Officials said the activity occurred "likely with Chinese government awareness." CISA Acting Director Nick Andersen urged AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns.

The timing is notable: the U.S. and China are expected to hold talks on AI security in the near future, which likely contextualizes the advisory's release.

Why it matters

This advisory represents the most detailed public U.S. government accusation to date of systematic, state-aware intellectual property extraction from American AI companies. It reframes the narrative around Chinese AI development: rather than framing distillation as a gray-area research practice, the U.S. government is labeling it a national security and economic threat.

For AI providers, the advisory signals that the federal government expects stronger technical and contractual safeguards against unauthorized model access. For the broader industry, it raises questions about how accurately the reported costs and capabilities of some Chinese models reflect independent innovation versus extracted proprietary data.

The naming of specific companies and specific source models also gives the allegations a level of granularity unusual for government advisories, potentially foreshadowing export controls, sanctions, or litigation.

What to watch

• Whether the upcoming U.S.–China AI security talks produce any binding agreements or enforcement mechanisms.
• Whether U.S. frontier model providers (Anthropic, OpenAI, Google, xAI) implement new API-level restrictions or rate-limiting in response.
• Whether the named Chinese companies respond publicly or whether the Chinese government issues a formal rebuttal.
• Whether the advisory leads to follow-on actions such as entity list designations, export control changes, or civil litigation from affected U.S. firms.
• Whether third-party API aggregators and "transfer station" proxy operators face new regulatory or legal pressure.