U.S. Agencies Accuse Six Chinese AI Companies of Industrial-Scale Model Distillation

If you've ever wondered why an AI company might suddenly lock down your account or ask you to verify your identity again, this story is a good example of why. On September 10, 2026, U.S. cybersecurity and intelligence agencies accused six China-based AI companies of running coordinated, large-scale operations to copy the abilities of top American AI models — and the accusation is serious enough that it's now being treated as a national security issue, not just a business dispute.

This matters right now because the accusation comes from a joint advisory by three major U.S. agencies, and it lands just as the U.S. and China are preparing for high-level talks on AI safety. It's also a useful moment to understand a technique — called "distillation" — that shapes a lot of what happens behind the scenes in the AI industry, whether you're a developer, a business owner, or just someone curious about how these systems get built.

What happened

Three U.S. agencies — the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) — issued a joint advisory naming six companies: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI (formerly known as Zhipu AI). The advisory says these companies extracted billions of pieces of information ("tokens," which are the chunks of text an AI model reads and generates) from models built by Anthropic, OpenAI, Google, and xAI.

According to the agencies, this wasn't a handful of researchers poking around out of curiosity. It allegedly involved millions of automated interactions, going back to at least late 2024, and was described as a core part of how these companies built their own AI models — not a side experiment.

The agencies also said they believe the Chinese government was likely aware of these activities, though the advisory doesn't publicly present proof of direct government involvement. China's Commerce Ministry pushed back hard, calling the technique widely used and "technically neutral," accusing the U.S. of double standards, and pointing out that American companies have also studied Chinese models. Beijing warned it could respond if the accusations are used to justify new restrictions on Chinese AI companies.

What "distillation" actually means

Here's the plain-language version. Imagine a very experienced teacher and a promising but less experienced student. Instead of the student learning everything from scratch, the student watches the teacher solve problems, studies the teacher's answers, and learns to imitate that skill. In AI terms, the "teacher" is a large, powerful model (like one built by Anthropic or OpenAI), and the "student" is a newer or smaller model being trained to perform similarly, but at a lower cost.

This is called knowledge distillation, and by itself it's a completely normal part of AI development. Companies use it all the time to make cheaper, faster versions of their own models, or to teach a small model a specific skill without retraining it from zero.

The problem isn't the technique — it's how it's allegedly being used here. Instead of a handful of legitimate research questions, the advisory describes campaigns sending millions of carefully designed prompts to extract specific abilities: how a model reasons through a problem, how it writes code, how it handles specialized professional tasks like legal work, and more. Done at that scale, and specifically to copy a competitor's expensive, hard-to-reproduce work, it starts to look less like research and more like large-scale extraction.

What each company is accused of

The advisory lays out specific claims for each company:

• DeepSeek — allegedly ran distillation activity from late 2024 through mid-2025 to help build its R1 and V3 models, targeting reasoning, writing, question-answering, and specialized tasks like legal work.
• Moonshot AI — accused of pulling data from Anthropic's Claude models and OpenAI's GPT-4o starting around mid-2025, to improve its Kimi model family, focusing on math, coding, and reinforcement learning (a training method where a model improves based on feedback about its performance).
• Alibaba — accused of targeting Claude and GPT models in late 2025 for coding, customer service, and image generation. Separately, Anthropic had earlier accused operators linked to Alibaba's Qwen research group of running what it called its largest distillation campaign yet — allegedly over 28.8 million exchanges through nearly 25,000 fraudulent accounts in a six-week window in 2026.
• MiniMax — accused of collecting "chain-of-thought" data (a model's step-by-step reasoning, not just its final answer) from Claude and Google's Gemini models to improve its M2 model.
• StepFun — accused of drawing on multiple Claude and GPT models between late 2025 and early 2026 to strengthen coding and task-automation features in its Step 4 model.
• Z.AI — accused of pulling billions of tokens from GPT-5.5 and Claude models by mid-2026, specifically targeting chain-of-thought reasoning.

Chain-of-thought data is considered especially sensitive because it's not just the final answer that's valuable — it's the reasoning process itself, which can be reused to teach another model how to "think" through similar problems.

How companies are supposed to catch this

The advisory also explains how AI providers can try to detect these campaigns, since a normal user occasionally asking questions looks very different from an automated system trying to map out a model's entire skill set. Providers are encouraged to look for a combination of warning signs, then respond with layered defenses.

Step 1: Watch for behavior that doesn't look human

Real people take breaks, sleep, and use services differently depending on time zones and working hours. An account that generates constant, round-the-clock traffic with no natural pauses is a signal worth investigating — especially if it also has enterprise-level volume on what's supposed to be a personal subscription.

Step 2: Track account and infrastructure patterns

Operators allegedly used "transfer stations" — proxy services that buy up large numbers of subscriptions or API keys and resell shared access, making the traffic look like it's coming from many unrelated users instead of one operation. Investigators are advised to look for groups of accounts using similar infrastructure, submitting similar prompts, or suddenly changing identifying details like device information or payment methods.

Step 3: Share signals across companies and platforms

Because an operator blocked by one AI provider can simply move to another provider, a cloud host, or a third-party reseller, the advisory recommends that companies compare notes — sharing known proxy infrastructure and suspicious account patterns with each other, while still respecting privacy and legal boundaries.

Step 4: Make the data less useful if abuse is suspected

If a company suspects an account is part of a distillation campaign, it can quietly respond without shutting the account down outright — for example, giving shorter or less detailed answers, varying its responses, or routing suspicious traffic to a less capable version of the model. Some companies may also use a technique called differential privacy, which adds a small amount of statistical "noise" to outputs, making it harder to reverse-engineer exactly how the model works, at some cost to accuracy.

Why this is being called a national security issue

The advisory argues this isn't only about companies losing a competitive edge. Officials say that copied reasoning and coding abilities could eventually support military systems, intelligence work, or cyberattacks, since the same skills that make a model good at solving problems can also make it good at finding software vulnerabilities or writing malicious code. The government hasn't shown that this has already happened — the concern is about the pathway: faster, cheaper AI development today could translate into stronger capabilities for state security use later.

Conclusion

This dispute captures a genuinely hard problem in the AI industry: the same public interface that lets millions of people use a helpful AI assistant is also the only thing standing between that company's expensive research and anyone trying to copy it at scale. Distillation itself isn't the villain here — it's a normal, useful technique. What the U.S. agencies are describing is something else: coordinated, disguised, high-volume extraction designed to get around the rules. Whether or not this specific dispute cools down diplomatically, expect AI companies to keep tightening identity checks and account monitoring, because access to a frontier AI model is now valuable enough to be worth stealing.

Merits

• Raises public awareness of a real, technical risk that most AI users never think about.
• Encourages AI companies to invest in better identity verification and abuse detection, which also helps against unrelated threats like account takeover and API abuse.
• Distinguishes clearly between legitimate research (normal distillation) and abusive extraction, rather than treating the whole technique as illegal.
• Pushes for cross-company cooperation on shared threat signals, which tends to make detection more effective for everyone.

Demerits

• The advisory does not publicly present direct evidence of Chinese government tasking, which leaves room for the claims to be disputed or politicized.
• Detection methods described (behavioral patterns, traffic analysis) can also flag legitimate power users, researchers, or businesses with unusual usage patterns.
• Defensive measures like quietly serving degraded answers to suspected accounts, if applied too broadly, could affect legitimate researchers and evaluators without their knowledge.
• The dispute risks becoming a diplomatic flashpoint that could affect unrelated AI cooperation between the two countries.

Caution

This article is written for general understanding and is based on a summary of a joint U.S. government advisory and public reporting; it is not a legal or technical analysis, and any names, dates, or figures mentioned should be verified against the original advisory and primary reporting before you rely on them for a decision. AI policy in this area is moving quickly, and the companies named have not all issued detailed public responses to every specific claim, so treat the accusations as allegations rather than settled fact.

Frequently asked questions

• What is AI model distillation? — It's a technique where a smaller or newer AI model ("student") is trained using the outputs of a larger, more capable AI model ("teacher"), so the smaller model can learn similar skills more cheaply.
• Is distillation illegal? — Not inherently. It's a widely used, legitimate machine learning technique. The dispute here is about whether it was done through fraud, fake accounts, and rule-evasion at a massive scale, not about the technique itself.
• Which companies were named in the advisory? — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI (formerly Zhipu AI).
• Which AI companies were allegedly targeted? — Anthropic, OpenAI, Google, and xAI.
• What is chain-of-thought reasoning, and why does it matter here? — It's the step-by-step reasoning a model uses to reach an answer, not just the final result. It's considered valuable because copying it can teach another model how to "think" through similar problems, not just repeat answers.
• How do companies detect distillation campaigns? — By looking for unusual patterns like nonstop automated usage, enterprise-level traffic on personal accounts, coordinated account behavior, and sudden changes in identifying information.
• What is differential privacy? — A method of adding small amounts of statistical noise to a model's outputs so it's harder for someone to reverse-engineer exactly how the model behaves, at some cost to precision.
• Why is this being called a national security issue instead of just a business dispute? — Because officials argue that copied AI reasoning and coding skills could eventually support military, intelligence, or cyberattack capabilities, not just commercial products.

Tags

#artificialintelligence #cybersecurity #nationalsecurity #aimodels #china #dataprivacy #machinelearning #technews #aiethics #infosec