CISA Names Six Chinese Firms in AI Distillation Advisory
Security / news
CISA Names Six Chinese Firms in AI Distillation Advisory
The joint advisory says DeepSeek, Moonshot AI and Alibaba pulled data from Claude, GPT, Gemini and Grok since late 2024, and tells U.S. labs to start throttling suspected accounts.
The National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI said Tuesday that six China-based AI companies pulled billions of tokens from American frontier models since at least late 2024, calling it industrial-scale distillation rather than routine research.
The joint advisory, tracked as AA26-251A, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It says the six companies extracted reasoning traces, agentic behavior and specialized outputs from Anthropic's Claude, OpenAI's GPT, Google's Gemini and xAI's Grok, in each case without authorization from the model owner.
What the advisory says DeepSeek and Moonshot did
The agencies credit DeepSeek with distilling four Claude versions, two Gemini versions, five ChatGPT versions and Grok 4 to help train its R1 and V3 models, campaigns the advisory says have run since at least 2024. Moonshot AI gets a longer list: the advisory says it distilled 18 U.S. models in total, including Claude Fable 5 data used to train Kimi K3 and GPT-4o data used to train Kimi K2.
Alibaba's entry is thinner. The advisory says only that the company "leveraged industrial-scale distillation to improve" its Qwen model family, with no version-by-version breakdown. MiniMax, StepFun and Z.AI get a single shared line: each "also engaged in malicious knowledge distillation of U.S. AI companies' models," without specifics.
How 'transfer stations' get around the rules
The advisory describes a gray market of proxy services it calls transfer stations, used to route distillation requests around the geographic restrictions Anthropic, OpenAI, Google and xAI attach to their APIs. Beyond bypassing location checks, the agencies say the proxies pool bulk API subscriptions across developer teams and strip or rewrite request metadata, which breaks the traceability a provider would normally use to link a burst of queries back to a single customer.
The mitigations aim at the labs, not Beijing
Rather than propose an enforcement mechanism against the six companies, the advisory's recommendations are addressed to the U.S. AI companies being distilled. It tells them to watch for accounts whose usage far exceeds what their subscription tier would normally support, to consider quietly degrading output quality for accounts flagged as likely distillation sources, and to share threat intelligence with competitors, an unusual ask in a market defined by secrecy over training data and technique. It also points providers toward MITRE's ATLAS framework and NIST's AI 100-2e2025 publication for guidance on rate limiting, differential privacy and output obfuscation.
The advisory sets no deadline, unlike the Known Exploited Vulnerabilities deadlines CISA has issued on the same week's patch cycle, and none of the six named companies has publicly responded to it. CyberScoop's reporting on the advisory notes that the accusation follows a similar one made in June by Michael Kratsios, the White House's director of the Office of Science and Technology Policy, who separately accused Moonshot AI of the same conduct months before this advisory made it official U.S. policy language.
| Company | Models cited in the advisory | What the advisory claims |
|---|---|---|
| DeepSeek | 4 Claude versions, 2 Gemini versions, 5 ChatGPT versions, Grok 4 | Used to train R1 and V3 |
| Moonshot AI | 18 U.S. models, including Claude Fable 5 and GPT-4o | Trained Kimi K3 and Kimi K2 |
| Alibaba | Not itemized | "Leveraged" distillation to improve Qwen |
| MiniMax, StepFun, Z.AI | Not itemized | Each "also engaged" per the advisory |
The advisory does not include a CVE identifier or a technical indicator of compromise, because distillation through a paid API is not an intrusion; it is a terms-of-service violation the agencies are choosing to treat as a national-security matter. That framing is also why the story reaches beyond the business dispute Anthropic raised in August over Moonshot and DeepSeek traffic patterns: this time the accusation carries three federal agencies' names rather than one company's.
What happens next is unclear. The advisory does not say whether NSA, CISA and FBI plan to name additional companies if the pattern continues, or whether the mitigation guidance will be revisited once U.S. labs report back on how many accounts they have throttled under it.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.