Threat Intel
US Agencies Accuse Chinese AI Firms of Large‑Scale Distillation of U.S. LLMs
The FBI, NSA and CISA jointly warned that a group of Chinese startups—Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun and Z.AI—have been quietly harvesting billions of tokens from leading U.S. language models such as GPT, Claude, Gemini and Grok. Using industrial‑scale distillation tactics, the firms allegedly bypassed terms of service, leveraged premium API plans, and routed requests through opaque proxies to avoid detection. The move is said to slash development time and costs for Chinese competitors while potentially compromising U.S. intellectual property.
The FBI, NSA and CISA released a joint advisory on September 8 that paints a worrying picture of how some Chinese AI companies are siphoning the core capabilities of U.S. frontier models. According to the agencies, the firms in question have extracted “billions of tokens” from OpenAI, Anthropic, Google Gemini and SpaceX’s Grok since late 2024.
What’s at stake?
Distillation is a normal part of AI research—large “teacher” models train smaller “student” models to be more efficient or specialized. The problem, the advisory says, is that these companies are using the practice as a covert shortcut, feeding the student models with raw outputs from U.S. LLMs in ways that violate the models’ terms of service. The result is a cheaper, faster path to building competitive AI systems.
How they’re doing it
- Bulk premium subscriptions shared among teams to keep costs down
- Automated fail‑over between API pathways to dodge blocks
- Chain‑of‑thought extraction and quality‑evaluation scripts to harvest the most valuable data
- Use of third‑party aggregators and gray‑market proxy “transfer stations” to mask user metadata and bypass geographic restrictions
"Industrial‑scale distillation tactics allow China‑based AI companies to shave development timelines and reduce training costs dramatically," the advisory noted.
Companies named
- Alibaba
- DeepSeek
- MiniMax
- Moonshot AI
- StepFun
- Z.AI
The agencies say these actions likely occur with the knowledge of the Chinese government and represent a serious threat to the U.S. AI ecosystem. They urge developers and organizations to monitor API usage, enforce strict access controls, and remain vigilant for signs of unauthorized distillation.
Related articles
China AI Firms Launch Industrial-Scale Knowledge Distillation Attacks on U.S. Models
CISA, NSA, and FBI have issued a joint warning that Chinese AI companies are deploying large‑scale knowledge distillation campaigns to siphon data from U.S. AI models. By extracting distilled knowledge, attackers can accelerate their own development while bypassing costly training. The threat poses risks to commercial, governmental, and national‑security AI systems, prompting urgent calls for tighter model protection and monitoring.
Read briefing
China AI Firms Deploy Industrial‑Scale Distillation to Steal U.S. Model Secrets
The NSA, CISA and FBI have issued a joint advisory warning that Chinese AI companies are conducting large‑scale knowledge‑distillation operations against U.S. frontier models such as Claude, GPT, Gemini and Grok. By routing requests through APIs, cloud services, third‑party aggregators and proxy “transfer stations,” firms like DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI harvest billions of tokens to train their own models, violating terms of use and threatening intellectual‑property security. The advisory details the tactics and recommends mitigation steps for U.S. organizations.
Read briefing
AI‑Enabled Attacks: The Open Letter That Left Out Who’s Behind the Threat
A recent open letter from major tech firms warned that AI could make sophisticated cyberattacks cheaper and more common, but it failed to identify the actors exploiting the new tools or how to close the emerging threat window. The warning came after U.S. agencies uncovered AI‑generated exploitation scripts targeting exposed Siemens S7 PLCs in critical infrastructure. Analysts argue that criminals are driven by profit, not novelty, and that the real risk lies in old misconfigurations now being weaponized by AI. The industry must prioritize hardening high‑risk assets, scrutinize AI‑generated cod
Read briefing
Claude AI Misused to Mine Secrets from 1.8M Android Apps – ShinyHunters and State Actors Exploit Anthropic's Model
Anthropic’s Claude model fell into the hands of a mix of financially driven and state‑backed groups, who used it to harvest hard‑coded credentials from 1.8 million Android apps. The ShinyHunters collective, backed by Russian and Chinese actors, automated the download, decompilation, and secret‑scanning of APKs, routing findings to a Telegram hub and leveraging stolen GitHub tokens for further breaches. Rapid token extraction from Azure AD and other high‑profile attacks underscore the speed and scale of AI‑assisted cybercrime.
Read briefing