CISA Names Six Chinese Firms in AI Distillation Advisory

The National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI said Tuesday that six China-based AI companies pulled billions of tokens from American frontier models since at least late 2024, calling it industrial-scale distillation rather than routine research.

The joint advisory, tracked as AA26-251A, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It says the six companies extracted reasoning traces, agentic behavior and specialized outputs from Anthropic's Claude, OpenAI's GPT, Google's Gemini and xAI's Grok, in each case without authorization from the model owner.

What the advisory says DeepSeek and Moonshot did

The agencies credit DeepSeek with distilling four Claude versions, two Gemini versions, five ChatGPT versions and Grok 4 to help train its R1 and V3 models, campaigns the advisory says have run since at least 2024. Moonshot AI gets a longer list: the advisory says it distilled 18 U.S. models in total, including Claude Fable 5 data used to train Kimi K3 and GPT-4o data used to train Kimi K2.

Alibaba's entry is thinner. The advisory says only that the company "leveraged industrial-scale distillation to improve" its Qwen model family, with no version-by-version breakdown. MiniMax, StepFun and Z.AI get a single shared line: each "also engaged in malicious knowledge distillation of U.S. AI companies' models," without specifics.

How 'transfer stations' get around the rules

The advisory describes a gray market of proxy services it calls transfer stations, used to route distillation requests around the geographic restrictions Anthropic, OpenAI, Google and xAI attach to their APIs. Beyond bypassing location checks, the agencies say the proxies pool bulk API subscriptions across developer teams and strip or rewrite request metadata, which breaks the traceability a provider would normally use to link a burst of queries back to a single customer.

The mitigations aim at the labs, not Beijing

Rather than propose an enforcement mechanism against the six companies, the advisory's recommendations are addressed to the U.S. AI companies being distilled. It tells them to watch for accounts whose usage far exceeds what their subscription tier would normally support, to consider quietly degrading output quality for accounts flagged as likely distillation sources, and to share threat intelligence with competitors, an unusual ask in a market defined by secrecy over training data and technique. It also points providers toward MITRE's ATLAS framework and NIST's AI 100-2e2025 publication for guidance on rate limiting, differential privacy and output obfuscation.

The advisory sets no deadline, unlike the Known Exploited Vulnerabilities deadlines CISA has issued on the same week's patch cycle, and none of the six named companies has publicly responded to it. CyberScoop's reporting on the advisory notes that the accusation follows a similar one made in June by Michael Kratsios, the White House's director of the Office of Science and Technology Policy, who separately accused Moonshot AI of the same conduct months before this advisory made it official U.S. policy language.

Company	Models cited in the advisory	What the advisory claims
DeepSeek	4 Claude versions, 2 Gemini versions, 5 ChatGPT versions, Grok 4	Used to train R1 and V3
Moonshot AI	18 U.S. models, including Claude Fable 5 and GPT-4o	Trained Kimi K3 and Kimi K2
Alibaba	Not itemized	"Leveraged" distillation to improve Qwen
MiniMax, StepFun, Z.AI	Not itemized	Each "also engaged" per the advisory

The advisory does not include a CVE identifier or a technical indicator of compromise, because distillation through a paid API is not an intrusion; it is a terms-of-service violation the agencies are choosing to treat as a national-security matter. That framing is also why the story reaches beyond the business dispute Anthropic raised in August over Moonshot and DeepSeek traffic patterns: this time the accusation carries three federal agencies' names rather than one company's.

What happens next is unclear. The advisory does not say whether NSA, CISA and FBI plan to name additional companies if the pattern continues, or whether the mitigation guidance will be revisited once U.S. labs report back on how many accounts they have throttled under it.