--- title: NSA, CISA, and FBI accuse six Chinese AI firms of... description: A joint advisory from the NSA, CISA, and FBI (AA26-251A) accuses six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of... canonical: https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: NSA, CISA, and FBI accuse six Chinese AI firms of large-scale model distillation | daily.dev og:description: A joint advisory from the NSA, CISA, and FBI (AA26-251A) accuses six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of... og:url: https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb og:image: https://api.daily.dev/og/posts/DMdgOqvwb.png og:image:alt: NSA, CISA, and FBI accuse six Chinese AI firms of large-scale model distillation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # NSA, CISA, and FBI accuse six Chinese AI firms of large-scale model distillation **[Collections](https://daily.dev/sources/collections)** · 3 min read · 8 upvotes · 3 comments ## Summary A joint advisory from the NSA, CISA, and FBI (AA26-251A) accuses six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of running large-scale model distillation campaigns against U.S. frontier models since late 2024. The agencies describe tactics like proxy 'transfer stations,' shared premium subscriptions, and metadata-stripping aggregators used to extract capabilities undetected. Moonshot AI is alleged to have distilled 17 U.S. models, including Anthropic's Claude Fable 5, to train Kimi-K3, while DeepSeek reportedly extracted hidden chain-of-thought reasoning rather than just outputs, undermining its low-training-cost narrative. The advisory recommends U.S. labs quietly serve degraded responses to suspected distillers based on behavioral signals like 24/7 usage and immediate max-throughput accounts — criteria that critics note overlap with normal enterprise usage. ## Content The NSA, FBI, and CISA published a joint advisory (AA26-251A) accusing six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—of running coordinated, large-scale distillation campaigns against US frontier models since at least late 2024. The targeted models include Claude, GPT, Gemini, and Grok. ## What the advisory claims The agencies say the campaigns extracted billions of tokens through a mix of techniques: bulk premium API subscriptions shared across developer teams, proxy "transfer stations" that strip account metadata, fraudulent accounts, and jailbreak prompts designed to pull out hidden chain-of-thought reasoning steps. That last technique is notable—rather than just copying finished answers, the prompts were structured to get models to write out their reasoning process, transferring the method itself. Anthropics's own threat intelligence report, released alongside the advisory, puts numbers to the scale. It identifies five campaigns totaling nearly 200 million exchanges: - **Alibaba**: 151 million+ exchanges between May and July 2026, peaking near 3 million per day, tied to Qwen training - **Moonshot AI**: 23 million+ exchanges used to train Kimi-K3, allegedly distilled from 17 US models including Claude. Some of those requests reportedly originated from Chinese military entities running surveillance footage analysis. - **DeepSeek**: 12.1 million+ exchanges over 14 days Moonshot AI allegedly routed requests through proxies to obscure origin, and used tricks like framing chain-of-thought extraction as translation requests to get around Anthropic's summarized-thinking safeguards. ## The DeepSeek cost argument The advisory takes direct aim at DeepSeek's widely cited $5.6 million training cost figure. CISA argues that number only covers compute and leaves out the cost of training data—which, if the advisory's claims are accurate, DeepSeek obtained by distilling US models rather than generating through its own research. The argument is that the cheap-training story is real, but someone else paid for the data that made it possible. ## The recommended response—and its problems The mitigation section asks US labs to serve suspected distillers subtly degraded responses without disclosing that they're doing so. Detection is supposed to rely on behavioral signals: sustained 24/7 usage, new accounts immediately running at maximum throughput, traffic patterns optimized for cache hits. The problem is that those patterns also describe a normal enterprise agent deployment. That leaves each provider to decide, without any disclosed criteria, which customers get quietly downgraded. It's a recommendation that creates real ambiguity for legitimate high-volume users. The agencies also recommend treating distillation abuse as its own security event category with dedicated monitoring and cross-industry telemetry sharing. ## China's response China's foreign ministry dismissed the advisory as "unfounded accusations and smears." Spokesperson Mao Ning attributed China's AI progress to technological self-reliance but didn't address any specific allegations—the routing methods, the bulk subscriptions, or the volume figures. A Chinese embassy spokesman made similar comments. The advisory lands ahead of a planned Trump-Xi meeting on AI governance. Some commentary has noted it also serves a commercial purpose: reframing Chinese models' price advantage as the product of theft rather than efficiency. European companies and public bodies currently use both US and Chinese models without any regulatory response to what the advisory implies about procurement. ## Questions this post answers ### Which Chinese AI companies were named in the NSA CISA FBI advisory on model distillation? Six companies were named: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The joint advisory, numbered AA26-251A, accuses them of running industrial-scale distillation campaigns against U.S. frontier AI models since at least late 2024, using techniques like proxy 'transfer stations' and shared premium subscriptions to avoid detection. _Track how AI providers respond to distillation accusations and enforcement changes on daily.dev._ ### How did Moonshot AI allegedly distill Claude and other US models to train Kimi-K3? Moonshot AI is accused of distilling 17 U.S. models, including Anthropic's Claude Fable 5, to train its Kimi-K3 model. Requests were reportedly routed through gray-market API proxies called 'transfer stations,' bulk premium subscriptions shared across teams, and aggregators that strip account metadata to avoid triggering detection. _Developers evaluating model provenance risks can follow this story's developments on daily.dev._ ### How will AI labs detect and respond to suspected model distillation attempts? The advisory recommends that U.S. labs serve suspected distillers subtly degraded responses without notifying them, based on behavioral signals like sustained 24/7 usage, new accounts hitting maximum throughput immediately, and traffic patterns optimized for cache hits. Critics note these same patterns also describe normal enterprise agent deployments, leaving providers to decide without disclosed criteria who gets downgraded. _Teams running heavy API workloads can watch daily.dev for updates on how providers police usage patterns._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 86 comments across x (as of 2026-09-10). **TL;DR:** Reaction is largely dismissive of the advisory's framing, with many arguing distillation is a normal, unstoppable technique and pointing out the hypocrisy of US labs training on scraped data without consent; the covert-degradation mitigation draws sharp concern as unaccountable and hard to distinguish from normal API usage. **Sentiment:** 10% positive · 65% mixed · 25% skeptical **The case for** - Some see distillation pressure as democratizing access to capable local/open models. - A few frame competition from Chinese labs as healthy, preventing monopolization of frontier AI by a few US companies. **The pushback** - Many argue the advisory is hypocritical since US labs themselves trained on scraped data without payment or consent. - The proposal to secretly serve degraded responses to suspected distillers is criticized as unauditable and indistinguishable from normal heavy API usage. - Several read the advisory as politically motivated, timed around trade/diplomatic tensions or aimed at justifying bans on Chinese models. - Some note there's no clean technical way to detect distillation traffic versus a legitimate business built on the API. **By community** - x (heated): Commenters split between calling distillation ordinary/inevitable and slamming the advisory as hypocritical, with heated arguments over fairness, national security framing, and the ethics of secretly degrading model outputs. **Hottest debate:** Whether distillation off another model's outputs constitutes theft/national-security threat or is just standard, unavoidable ML practice no different from what US labs already do with scraped data. **Open questions** - Is there any reliable way to distinguish distillation traffic from a legitimate high-volume API customer or startup? - What concrete attack vectors (weight exfiltration vs. compromised credentials vs. API scraping) is the advisory actually describing? **Highlights** > @theo China pays for its data while US companies steal the world data for free. Then they give it back. Does not sound this bad to me. > — [jean343 on x · 3 points](https://x.com/jean343/status/2097520417665634779) > @theo @maria_rcks that's a first > — [jetpackjoe\_ on x · 2 points](https://x.com/jetpackjoe_/status/2097481644030476405) > @theo The funny is the advisory admits distillation is legal and useful. So what did they actually do? Break a terms-of-service clause. Calling that "theft" is a stretch when the same labs trained on the whole internet without asking. This isn't cybersecurity. It's Bessent's "we can't > — [ChinaTechFlux on x](https://x.com/ChinaTechFlux/status/2097611721032815038) > @rohanpaul_ai the mitigation is wild. quiet downgrades for anyone whose traffic looks like a distiller, except that profile is also just a normal agent fleet running 24/7. every api call now has a trust question you can't audit, and the provider decides. > — [AllianceDouble on x · 1 points](https://x.com/AllianceDouble/status/2097605710163169322) > @theo does the advisory give a way to tell distillation traffic from a startup just building on your api > — [suqitah on x · 3 points](https://x.com/suqitah/status/2097477701393064347) **Source threads** - [x](https://x.com/rohanpaul_ai/status/2097605329123147987) · 0 points · 10 comments - [x](https://x.com/theo/status/2097476192144408964) · 0 points · 76 comments ## Community discussion Top comments from developers on daily.dev. **@akashskypatel** · 0 upvotes > So what? AI itself is distillation of other copyrighted works. **@eadric** · 0 upvotes > The US AI companies are clearly hypocritical when they complain about China using work someone else paid for … > > BUT, it's also not a good thing China is doing this. If it's theft when US companies do it, it's theft when China does it. And it does seem unstoppable/inevitable, but that doesn't mean it's free of negative consequences. --- Tags: [#machine-learning](https://daily.dev/tags/machine-learning), [#llm](https://daily.dev/tags/llm), [#ai-security](https://daily.dev/tags/ai-security), [#deepseek](https://daily.dev/tags/deepseek) [View this post on daily.dev](https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"NSA, CISA, and FBI accuse six Chinese AI firms of large-scale model distillation","url":"https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb"},"datePublished":"2026-09-09T08:38:24.828Z","dateModified":"2026-09-10T21:34:39.306Z","description":"A joint advisory from the NSA, CISA, and FBI (AA26-251A) accuses six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of...","image":"https://pbs.twimg.com/media/HRwuoNMb0AERmQb.png","thumbnailUrl":"https://pbs.twimg.com/media/HRwuoNMb0AERmQb.png","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":8},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"machine-learning,llm,ai-security,deepseek","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"NSA, CISA, and FBI accuse six Chinese AI firms of large-scale model distillation"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb","comment":[{"@type":"Comment","text":"So what? AI itself is distillation of other copyrighted works.","datePublished":"2026-09-09T15:02:55.963Z","url":"https://daily.dev/posts/DMdgOqvwb#c-x0PuohsWx","author":{"@type":"Person","name":"Akash","url":"https://daily.dev/akashskypatel","image":"https://avatars.githubusercontent.com/u/8129618?v=4"}},{"@type":"Comment","text":"The US AI companies are clearly hypocritical when they complain about China using work someone else paid for …\nBUT, it’s also not a good thing China is doing this. If it’s theft when US companies do it, it’s theft when China does it. And it does seem unstoppable/inevitable, but that doesn’t mean it’s free of negative consequences.","datePublished":"2026-09-09T19:32:53.259Z","url":"https://daily.dev/posts/DMdgOqvwb#c-vysb1Q12o","author":{"@type":"Person","name":"Eric","url":"https://daily.dev/eadric","image":"https://media.daily.dev/image/upload/s--DDmm4_TU--/f_auto/v1780585404/avatars/avatar_mWqleMjdMt41WChovtdJz?_a=BAMAMiWQ0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/nsa-cisa-and-fbi-accuse-six-chinese-ai-firms-of-large-scale-model-distillation-dmdgoqvwb#faq","mainEntity":[{"@type":"Question","name":"Which Chinese AI companies were named in the NSA CISA FBI advisory on model distillation?","acceptedAnswer":{"@type":"Answer","text":"Six companies were named: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The joint advisory, numbered AA26-251A, accuses them of running industrial-scale distillation campaigns against U.S. frontier AI models since at least late 2024, using techniques like proxy 'transfer stations' and shared premium subscriptions to avoid detection. Track how AI providers respond to distillation accusations and enforcement changes on daily.dev."}},{"@type":"Question","name":"How did Moonshot AI allegedly distill Claude and other US models to train Kimi-K3?","acceptedAnswer":{"@type":"Answer","text":"Moonshot AI is accused of distilling 17 U.S. models, including Anthropic's Claude Fable 5, to train its Kimi-K3 model. Requests were reportedly routed through gray-market API proxies called 'transfer stations,' bulk premium subscriptions shared across teams, and aggregators that strip account metadata to avoid triggering detection. Developers evaluating model provenance risks can follow this story's developments on daily.dev."}},{"@type":"Question","name":"How will AI labs detect and respond to suspected model distillation attempts?","acceptedAnswer":{"@type":"Answer","text":"The advisory recommends that U.S. labs serve suspected distillers subtly degraded responses without notifying them, based on behavioral signals like sustained 24/7 usage, new accounts hitting maximum throughput immediately, and traffic patterns optimized for cache hits. Critics note these same patterns also describe normal enterprise agent deployments, leaving providers to decide without disclosed criteria who gets downgraded. Teams running heavy API workloads can watch daily.dev for updates on how providers police usage patterns."}}]} ```