Three United States security and intelligence agencies have formally accused a group of Chinese artificial intelligence companies of conducting large-scale distillation campaigns against American frontier models. In a joint advisory issued on 8 September 2026, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation said that six China-based firms had used what the agencies called "aggressive, malicious, and targeted distillation" tactics against US models since 2024.
What the advisory alleges
The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies allege that these companies extracted billions of tokens from exchanges within US frontier AI models, and assess that the activity took place likely with Chinese government awareness. The campaigns are said to have targeted variants of Anthropic's Claude, OpenAI's ChatGPT, Google's Gemini and SpaceXAI's Grok.
Distillation, in this context, refers to using a simpler model to query a more advanced one, reducing the time and money needed to create a new model. The technique itself is widely used inside the industry. The agencies' objection concerns how the alleged campaigns were conducted, not the existence of the technique.
How the campaigns allegedly operated
According to the advisory, "China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies' terms of use." The pathways cited include native application programming interfaces, remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection.
The agencies further stated that the companies "deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection," and that they "attempt to distill the best capabilities and proprietary features of each U.S. frontier model to train their China-based AI models." The advisory describes this as "systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership."
Recommendations and earlier claims
The agencies recommended three steps for US AI developers: implement comprehensive detection and mitigation, deploy targeted response changes, and establish cross-organisation intelligence sharing.
The advisory did not arrive in isolation. In July 2026, White House Office of Science and Technology Director Michael Kratsios said that Chinese distillation efforts, specifically those by Moonshot AI, had sought to steal proprietary functions from Anthropic's advanced Fable model. Anthropic had made similar accusations in February 2026. Separately, advocacy groups have asked the White House to take stronger action to keep Chinese companies from importing advanced semiconductor chips.
What is established and what is claimed
Established: on 8 September 2026 the NSA, CISA and FBI published a joint advisory naming six Chinese AI companies and describing alleged distillation campaigns against four US frontier model families. The advisory's text, its recommended mitigations, and the earlier public statements by Kratsios and Anthropic are matters of public record.
Claimed but not independently established: that the named companies extracted billions of tokens from US models, that they did so through deliberate obfuscation of user metadata, and that the activity proceeded with Chinese government awareness. These remain allegations made by US government agencies. The reporting on the advisory does not include the underlying technical evidence, and none of the named companies is recorded as having responded. No court or independent body has ruled on the claims.