The NSA, CISA and FBI published an AI distillation advisory on September 8, 2026, naming six China-based firms — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI — as running “industrial-scale” extraction campaigns against Claude, GPT, Gemini and Grok since late 2024. The agencies say billions of tokens were pulled across millions of exchanges, and they want providers to silently degrade suspect traffic rather than block it.
What is the AI distillation advisory, and who issued it?
The AI distillation advisory is joint cybersecurity advisory AA26-251A, published by the NSA, CISA and the FBI on Tuesday, September 8, 2026. It accuses six China-based AI companies of systematically harvesting the outputs of US frontier models to train their own. The agencies call the activity “aggressive, malicious, and targeted.”
Distillation itself is not exotic. A smaller model is trained on a larger model’s outputs until it approximates the teacher’s behavior at a fraction of the compute cost.
What the advisory alleges is the industrialized version: fraudulent accounts, proxy networks, and prompts engineered to pull hidden reasoning traces out of paid APIs.
Which six companies were named
The named firms cover most of China’s frontier-model landscape. Notably, Tencent and ByteDance are absent from the list.
| Company | Best-known models | Alleged campaign window |
|---|---|---|
| DeepSeek | R1, V4 Flash / V4 Pro | From late 2024 |
| Moonshot AI | Kimi series | Intensified mid-2025 |
| Alibaba | Qwen series | Late 2025 |
| MiniMax | MiniMax / abab series | Late 2025 |
| StepFun | Step series | Late 2025 – early 2026 |
| Z.AI | GLM series | Mid-2026 |
Four of those six ship the cheap open-weight and low-cost API models that have been compressing token prices all year. We covered two of them directly in GLM-5.3-Flash vs Qwen3.8-Flash-Next.
Which US models were targeted
The advisory lists an unusually specific target set. On the Anthropic side: Claude 3.7, Sonnet 4 and 4.5, Opus 4.1 and 4.8, Haiku, Fable 5 and Claude Code.
On OpenAI’s side: GPT-4, 4o, 4 Mini, 4 Nano, GPT-5, 5.1, 5.2 and 5.5. Google’s Gemini 1, 2.5 Pro, 2.5 Flash and 3 Pro appear, as does xAI’s Grok 4.
That breadth matters. It means the alleged extraction was not one lab’s problem — it was a sector-wide leak through the front door of every commercial API.
How much data was actually extracted?
The agencies quantify the campaign as “billions of tokens across millions of exchanges and requests” since late 2024, run through “tens of thousands” of fraudulent accounts operated simultaneously via proxy networks. The advisory does not attach a dollar figure to the loss.
The sharpest numbers come from a vendor, not the government.
Anthropic’s own numbers are the hard data point
In a February 23, 2026 disclosure, Anthropic reported roughly 24,000 fraudulent accounts across three campaigns generating more than 16 million exchanges with Claude.
Broken out: MiniMax accounted for over 13 million exchanges, Moonshot AI over 3.4 million, and DeepSeek over 150,000. A single proxy network ran more than 20,000 accounts at once.
Anthropic’s framing was blunt: distillation “is a widely used and legitimate training method,” but “competitors can use it to acquire powerful capabilities from other labs in a fraction of the time.” The company added that “illicitly distilled models lack necessary safeguards, creating significant national security risks.”
Note the asymmetry inside those figures. MiniMax generated roughly 87 times more exchanges than DeepSeek, yet DeepSeek is the name in every headline.
Why does the US want providers to degrade answers instead of blocking?
The advisory’s operational recommendation is the genuinely novel part. Rather than banning suspect accounts, it tells providers to alter what those accounts receive — quietly.
As DIGITIMES reported, the guidance is to “subtly alter responses to high-confidence malicious distillation requests, without telling the user,” and to treat “model outputs themselves as an exfiltration surface.”
The logic is poisoning the well. A blocked account tells the attacker exactly which detection signal fired; a degraded account keeps paying for training data that quietly gets worse.
The problem is that “high-confidence” is doing enormous work in that sentence. A false positive means a paying enterprise customer silently receives worse answers with no notification, no SLA credit, and no way to know. The advisory offers no guidance on that liability, and no provider has publicly said whether it will comply.
Who wins and who loses financially?
Wealth Engine’s read: this is a margin story dressed as a security story. The advisory does not create a cause of action, impose a fine, or name a sanction. What it creates is cost.
The compliance bill lands on inference providers
The advisory’s detection indicators — accounts shared across multiple IPs and user agents, round-the-clock usage, anomalous subscription-to-usage ratios, new subscriptions that immediately hit maximum usage — describe behavior that is also common to legitimate agent fleets and resellers.
Building that detection layer is a real engineering line item for OpenAI, Anthropic, Google, and every aggregator and cloud reseller sitting between them and end users. Aggregators carry the worst of it: they see the traffic but not the identity behind it.
The cheap-model trade gets a political discount
Here is the losers’ side. Every named lab now carries headline risk for Western enterprise buyers, regardless of whether the allegations are ever tested.
- Procurement friction rises. Legal teams that shrugged at a Qwen or GLM deployment in June now have a federal advisory to cite.
- Open weights become the hedge. A self-hosted open-weight model carries no API relationship to police — one reason drops like Tencent’s 770B Hy4 release matter more after an advisory like this.
- Closed Chinese APIs are the most exposed. DeepSeek has not released V4.1 weights, so restricted institutions cannot self-deploy it even if they want the price.
- US labs gain pricing cover. If the cheap alternative carries geopolitical risk, the premium tier defends its price without cutting it.
The timing is almost comic. On September 9 — the day the advisory hit the news cycle — DeepSeek opened a limited beta of V4.1 Flash, a natively multimodal model capped at 20 concurrent requests per account and scheduled to go offline the next day. Vercel’s AI Gateway listed the beta at $0.22 per million input tokens and $0.66 per million output, with a 1M-token context window.
For scale, our own coverage of Claude Fable 5.1 pricing put that model at $10 per million input tokens. DeepSeek’s beta rate is about 2% of that on input. Which is precisely the economic fact the advisory is trying to explain.
Is the $5.6 million DeepSeek training cost claim dead?
The advisory takes direct aim at the number that defined the last two years of AI cost discourse. DeepSeek publicly claimed R1 cost about $5.6 million to train; the agencies assert that figure excludes the cost of the distillation data that made it possible.
That is an accusation, not an accounting. No revised figure is offered, and no methodology is published for how the agencies arrived at the conclusion.
It still lands, because the $5.6 million number has been the load-bearing argument for every “compute spend is a bubble” thesis since early 2025. If the true input includes billions of tokens harvested from models that cost billions of dollars to train, the efficiency story changes shape.
What should API providers and buyers do now?
The advisory’s recommendations are short and operational. For anyone running or reselling model access, the checklist is:
- Instrument for anomalous prompt patterns, not just anomalous volume — the advisory flags chain-of-thought extraction and jailbreaks aimed at revealing hidden reasoning.
- Watch subscription-to-usage ratios. New accounts that immediately max out are the single cleanest signal named.
- Track account sharing across IPs and user agents, including traffic routed through “transfer stations” that evade regional restrictions.
- Decide your response policy before you need it. Block, throttle, or degrade — each has a different contractual exposure.
- Share intelligence across providers. The advisory explicitly asks model providers, cloud platforms and aggregators to pool indicators.
For enterprise buyers, the practical move is documentation, not panic. If a named vendor is in your stack, record why, what data touches it, and what the fallback is.
Frequently asked questions
Is model distillation illegal?
Not inherently. Distillation is a standard training technique. What the advisory alleges is breach of provider terms of service via fraudulent accounts and evasion infrastructure — a contractual and potentially fraud-related matter, not a settled criminal one.
Did the named companies respond?
As of publication, no public denial or response from DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun or Z.AI had been reported by Quartz, Gizmodo or NBC News coverage of the advisory.
Does this ban Chinese AI models in the US?
No. AA26-251A is an advisory, not a regulation. It imposes no restrictions on buyers. Existing limits are separate: US government devices already face restrictions, Taiwan bans government DeepSeek use, and Japan requires case-by-case approval.
How does this connect to US-China trade talks?
Gizmodo reported that US-China AI security talks involving Treasury Secretary Scott Bessent are scheduled for mid-September. Publishing an advisory days before a negotiation is leverage as much as it is disclosure.
Do the labs themselves think distillation is a crisis?
Not uniformly. OpenAI CEO Sam Altman said in July: “I would rather people not distill from us, for sure. But this is not in my top ten list of worries.” That is a useful counterweight to the advisory’s tone.
Will API prices go up because of this?
Unlikely directly. Detection costs are small relative to inference costs. The plausible effect is on the discount side: less pressure on US labs to match Chinese pricing, which we tracked in the cheapest 1M-context model comparison.
What is the difference between this and a model breach?
No weights were stolen. Nothing was exfiltrated from a server. The alleged extraction happened entirely through paid, public API endpoints — which is why the advisory calls model outputs an exfiltration surface.
The bottom line
The AI distillation advisory is the first time the US government has formally treated a model’s answers as a national-security asset. That framing will outlast the news cycle.
But read the document for what it is. There is no penalty, no damages figure, no legal action, and no published methodology behind the claim that DeepSeek’s $5.6 million R1 figure is misleading. The strongest evidence in the story is Anthropic’s own February disclosure, and Anthropic is an interested party.
The recommendation to silently degrade suspect traffic is the part that deserves scrutiny. It asks commercial providers to knowingly serve worse product to paying accounts based on probabilistic detection, and it says nothing about what happens when the detection is wrong.
The trade: this is bearish for Chinese closed API vendors selling into Western enterprises, mildly bullish for US frontier pricing power, and neutral-to-positive for open-weight releases that sidestep the API relationship entirely. Watch whether any major provider publicly adopts the degradation guidance. If one does, the terms-of-service rewrite that follows will tell you more than the advisory did. If none does, the advisory was diplomacy — and the mid-September talks were always the point.
Sources
- CISA — Joint Cybersecurity Advisory AA26-251A
- Anthropic — Detecting and preventing distillation attacks
- Gizmodo — U.S. agencies issue stern rebuke over alleged distillation
- Unite.AI — NSA, CISA, FBI warn China-based AI firms distill US frontier models
- DIGITIMES — US agencies tell AI firms to degrade answers to suspected distillation traffic
- Quartz — US intelligence agencies accuse Chinese AI firms of industrial-scale distillation