The NSA, FBI, and CISA released joint advisory AA26-251A on September 8, titled China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies, per CISA. It names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and assesses that they extracted billions of tokens across millions of requests from Anthropic, OpenAI, Google, and xAI models since at least late 2024, likely with Chinese government awareness. The target lists name specific versions; Z.AI is accused of going after GPT-5.5 and Claude Opus 4.8.
Distillation means training a cheaper model on a stronger model's outputs, and the agencies call it the core of how these companies build. The advisory is a government assessment. No charges accompany it, and it gives no volume beyond billions of tokens. Moonshot is on the list, accused of pulling Claude and GPT outputs into its Kimi models. We covered Kimi K3 in July as the largest open-weight model yet and a real rival to the US labs, and the advisory now alleges how part of that parity was reached, while Moonshot raises in Hong Kong ahead of a listing.
The evasion methods run on the same plumbing legitimate developers use: native APIs, cloud platforms, and third-party aggregators that strip user metadata. A gray market of proxies called transfer stations beat geographic restrictions. Pools of fraudulent accounts shared bulk-purchased premium subscriptions, and automated failover switched pathways whenever one was blocked.
The recommendations reach ordinary customers. The agencies tell US labs to detect anomalous prompts, accounts, networks, and behaviors, to share intelligence across providers, and to subtly alter responses to suspected distillation attempts. That last item means deliberately degraded outputs for traffic a classifier flags. Classifiers misfire. Aggregators are a named pathway, so companies reaching frontier models through them are the likeliest to see tighter verification and quietly worse responses, with no notice.
Bottom Line
The advisory turns distillation into a national-security matter and endorses altered outputs as a countermeasure. If your production traffic reaches frontier models through an aggregator or proxy, move it to direct, verified accounts and add output-quality monitoring that would catch a silent downgrade.