US cybersecurity and intelligence agencies have accused China-based AI firms of conducting industrial-scale distillation attacks to extract proprietary functionalities from U.S. frontier models.
In a joint bulletin from the NSA, CISA and FBI, the agencies describe “systematic extraction” through distillation as a core element of China-based developers’ AI programmes, claiming they have siphoned billions of tokens from models such as Anthropic Claude variants, OpenAI GPT, Google Gemini, and SpaceXAI Grok since late 2024. The advisory warns that these campaigns have been driven by aggressive, targeted tactics and may have the blessing of the Chinese government.
Particular firms named include DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z[.]AI, with activities spanning late 2024 to mid-2025 and into 2026. The report details how these groups purportedly sought to replicate advanced reasoning and codified features—ranging from CoT reasoning and domain-specific functions to software engineering and dialogue capabilities—by distilling from multiple U.S. frontier models.
The methods allegedly used to gain access include APIs, remote cloud providers and third-party aggregators that obfuscate user metadata, sometimes aided by proxy services to distribute operations and evade detection. The joint guidance urges U.S. AI firms to strengthen detection and mitigation, alter responses for suspected distillation, and correlate activity across providers to uncover distributed campaigns, while emphasising that API keys and partner access remain valuable targets for abuse.