On September 8, the National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI published a joint cybersecurity advisory that reads less like a typical breach notice and more like an indictment of an entire national strategy. Advisory AA26-251A names six Chinese AI companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and accuses them of running industrial-scale campaigns to siphon the outputs of America’s most advanced AI models and use them to train their own.
The three agencies say the activity has been running since at least late 2024, involves millions of individual requests, and has pulled billions of tokens out of frontier systems built by Anthropic, OpenAI, Google and xAI. Just as notable as the accusation itself is the advice the agencies are giving American AI companies in response: quietly feed suspected offenders a worse, cheaper model, and do not tell them it happened.
Quick facts
- Advisory AA26-251A was published jointly by the NSA, CISA and the FBI on September 8, 2026
- It names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI
- The agencies say the campaign has run since at least late 2024, likely with Chinese government awareness
- Billions of tokens were extracted across millions of requests from Claude, GPT, Gemini and Grok models
- Z.AI is singled out for distilling billions of tokens of GPT-5.5 and Claude Opus 4.8 data by mid-2026
- Recommended response includes silently serving “downgraded” models to suspected accounts
What distillation is, and where it turns into theft
Knowledge distillation is not, on its own, anything unusual or illegal. It is a standard machine learning technique where a smaller “student” model learns by studying the outputs of a larger, more capable “teacher” model, a shortcut that can save enormous amounts of training cost and time. Every major AI lab uses some version of it internally, and plenty of legitimate research relies on studying published outputs from other systems.
What the advisory describes is different in kind, not just degree. Instead of distilling from data they own or are licensed to use, the agencies say the six named companies ran millions of automated queries against competitors’ commercial APIs, systematically harvesting responses at a scale and pattern far outside normal usage, then used that harvested output to train and improve their own models. That shifts the activity from a legitimate research shortcut into what the advisory treats as unauthorized extraction of a competitor’s product, executed through the front door of a public API rather than through any kind of technical break-in.
How the agencies characterized it
The advisory describes the campaign as “aggressive, malicious, and targeted,” and assesses that its scale and coordination make it likely the Chinese government is aware of the activity, treating rapid distillation of foreign frontier models as a core part of these companies’ development strategy rather than an occasional shortcut.
Who the advisory says targeted what
The six companies were not accused uniformly. The advisory draws a rough hierarchy, with DeepSeek and Moonshot AI named as the most aggressive offenders, distilling from multiple Claude, GPT, Gemini and Grok models at once. The remaining four firms are described as more selective, each concentrating on a narrower set of targets.
| Company | Models reportedly targeted | Advisory’s characterization |
|---|---|---|
| DeepSeek | Claude, GPT, Gemini and Grok models | Named a top offender |
| Moonshot AI | Claude, GPT, Gemini and Grok models | Named a top offender |
| MiniMax | Claude, Gemini and GPT models | Broad but narrower targeting |
| Alibaba | Claude and GPT models | Targeted improvement of own products |
| StepFun | Claude and GPT models | Targeted improvement of own products |
| Z.AI | GPT-5.5 and Claude Opus 4.8 specifically | Billions of tokens distilled by mid-2026 to build reasoning capability |
The Z.AI detail is the most concrete number in the whole advisory, and it is worth sitting with. Agencies say that by mid-2026 the company had distilled billions of tokens worth of output specifically from GPT-5.5 and the kind of frontier reasoning models labs like OpenAI have been racing to push forward this year, along with Claude Opus 4.8, in order to build up its own model’s chain-of-thought reasoning ability. In plain terms, the advisory is saying Z.AI used the step-by-step thinking of two of the world’s most expensive AI systems as a training set, at a fraction of the cost it would take to develop that reasoning ability independently.
Every one of the millions of queries described in the advisory passed through ordinary-looking API infrastructure like this, not a break-in. Photo via Pexels.
The part that will bother privacy advocates: quiet downgrades
The advisory does not stop at description. It tells American AI companies how to respond, and the recommended playbook is unusually blunt for a government document. Providers are told to improve behavioral and infrastructure-level detection of distillation-style query patterns, and when an account is suspected, to respond not by banning it outright but by quietly routing it to a less capable, “downgraded” version of the model instead of the real one.
The advisory goes further and explicitly instructs providers to avoid telling suspected accounts that this switch has happened. The stated logic is straightforward: notifying someone that they have been detected only teaches them how to adjust their query patterns and evade detection next time. It is also the kind of instruction that sits uneasily next to normal expectations of transparency, since it means any customer, including ordinary businesses and developers with no connection to a distillation campaign, has no way to know for certain whether an unusually weak or inconsistent answer from a commercial AI API reflects a real model limitation or a silent, unannounced downgrade triggered by an automated fraud system that got a false positive.
Why now, and why it matters beyond one advisory
The timing lines up with a broader pattern this year of Chinese AI firms closing the gap with US labs on both price and capability. DeepSeek in particular slashed its own prices to near nothing while investors valued the company at $74 billion anyway, a business model that becomes far easier to sustain if a meaningful share of your model’s underlying reasoning ability was trained on another company’s far more expensive research rather than built from scratch. The same frontier labs the advisory says were targeted have also been treating their own most capable systems as sensitive assets in other contexts, restricting access to advanced capabilities the way OpenAI limited its Astra model’s most powerful cybersecurity tools to a small vetted group rather than the general public. Extraction at the scale described in this advisory threatens the entire economic logic behind spending hundreds of millions of dollars training a frontier model in the first place, since that advantage erodes quickly if a rival can approximate the result for a fraction of the cost by querying the finished product instead of building their own from the ground up.
What happens next
None of the six named companies had issued a formal public response to the specific advisory at the time of writing. The agencies have not announced sanctions or legal action tied to the report, framing it instead as guidance for industry rather than the opening move in an enforcement case. For the American AI companies on the receiving end, the practical choice now is between two uncomfortable options: tighten detection and start quietly degrading service for suspected accounts, risking legitimate customers getting caught in the net, or leave their APIs open as before and accept that a growing share of their most expensive research may keep ending up, one query at a time, inside a rival’s next model release.
