NSA, CISA, and FBI Warn Chinese AI Firms Including DeepSeek Are Conducting Industrial-Scale US Model Distillation

Advisory AA26-251A issued Sept 8, 2026 by CISA, NSA, FBI on Chinese AI model distillation campaigns

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) issued joint advisory AA26-251A on September 8, 2026, warning that China-based AI companies are conducting systematic, industrial-scale knowledge distillation campaigns targeting US frontier AI models.

Named firms: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — all cited explicitly

The advisory explicitly names six China-based AI companies: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. Explicitly naming specific companies in a joint advisory from three major US security agencies is unusual and signals high government confidence in the attribution.

Billions of tokens extracted across millions of API exchanges from US AI models since late 2024

The advisory states that named companies extracted billions of tokens across millions of exchanges from US frontier AI models since at least late 2024 — a scale indicating organized, systematic data extraction well beyond opportunistic research use.

Targeted models include Claude, GPT, Gemini, and Grok variants; activities violate ToS

The distillation campaigns specifically targeted multiple variants of Claude (Anthropic), GPT (OpenAI), Gemini (Google), and Grok (xAI) — the major US frontier models. The advisory notes these activities systematically violated the terms of service of the targeted US AI companies.

Distillation framed as firms' primary AI development strategy, not supplemental — shortcuts billions in R&D

The agencies characterize distillation not as an incidental research technique but as the core strategy underlying these companies' AI development — shortcutting billions in R&D costs and undermining fair competition. This framing implies Chinese AI competitive capabilities are substantially built on extracted US frontier model knowledge.

DeepSeek targeted reasoning, optimization, domain functions to train R1 and V3 models (late 2024–mid 2025)

DeepSeek is specifically detailed as having run organized campaigns targeting reasoning capabilities, model optimizations, and domain-specific functions to train its R1 and V3 models, with activity spanning late 2024 through mid-2025.

Alibaba's Qwen models cited as another beneficiary of similar distillation campaigns

Alibaba is cited alongside DeepSeek for conducting similar distillation campaigns targeting US frontier models, with its Qwen model family identified as a direct beneficiary of the extracted knowledge.

Activities likely conducted with Chinese government awareness, per advisory

The advisory states the campaigns were likely conducted with Chinese government awareness — a significant attribution that frames the distillation as state-tolerated or state-directed industrial espionage, not independent corporate behavior.

Recommendations: anomaly detection, targeted responses to distillation attempts, cross-org intel sharing

The advisory calls on US AI companies to: implement comprehensive detection of anomalous API request patterns, deploy targeted response changes when distillation is suspected, and establish cross-organization intelligence sharing to identify and counter campaigns collectively.