US accuses Chinese AI firms of distilling frontier models

On September 8, 2026, the NSA, CISA, and FBI released joint advisory AA26-251A warning that 'China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities' ^[1]. The advisory and Anthropic's parallel investigation describe a common playbook: gray-market proxy 'transfer stations,' native APIs, cloud platforms, and third-party aggregators used to funnel prompts to frontier models, paired with automated failover when one access route is blocked ^[4]. Anthropic's own telemetry ties DeepSeek, Moonshot AI, and MiniMax to more than 16 million exchanges with Claude routed through roughly 24,000 fraudulent accounts organized into what the company calls 'hydra cluster architectures,' with one proxy network alone running more than 20,000 fraudulent accounts ^[2][3].

MiniMax's traffic pattern illustrates the speed of the operation: 'When we released a new model during MiniMax's active campaign, they pivoted within 24 hours, redirecting nearly half their traffic to capture capabilities from our latest system,' Anthropic said, adding that MiniMax also used prompt injection against Claude Code ^[2]. That same tool has its own complication: in July 2026 Anthropic shipped Claude Code 2.1.197, which removed a proxy-fingerprint detection mechanism covering 147 Chinese domains, and the company has since promised a fix ^[9].

Security professionals largely back Washington's framing. Ismael Valenzuela of Arctic Wolf called the campaign 'abuse of legitimate access by sophisticated, well-resourced adversaries' ^[6], while Databricks CEO Ali Ghodsi pointed to the underlying economics: the extracted capability is 'just so extremely powerful and so extremely cheap, and it's just available to anyone' ^[3].

But the verdict is not unanimous. Commentary on X reframed the advisory as a shift from hardware export controls to a cognitive-extraction lens - 'copying the brain, not the chip' - and noted that skepticism echoed even among some US AI researchers, including some at OpenAI, who see distillation as a normal industry practice rather than a uniquely Chinese offense. China's Ministry of Commerce rejected the accusations outright, calling distillation 'a neutral and widely used industry practice employed by companies around the world, including American firms' ^[7].

The six named companies show a wide range of technique and scale. DeepSeek is accused of distilling four versions of Claude, two versions of Gemini, five versions of ChatGPT, and Grok 4, generating more than 150,000 exchanges with Claude alone ^[1][2]. Moonshot AI's campaign was larger still - 18 different U.S. models distilled to build its Kimi-K2/K3 line, with more than 3.4 million Claude exchanges logged ^[1][2]. MiniMax is accused of chain-of-thought and reinforcement-learning (RL) data extraction, generating more than 13 million Claude exchanges ^[2][3].

Alibaba's activity was described as industrial-scale distillation aimed at improving its Qwen model family ^[4]; StepFun was flagged for extracting reasoning and coding capability across late 2025 and early 2026, and Z.AI for pulling billions of tokens out of GPT-5.5 and Claude Opus ^[4]. Even framed at this range of scale, all six cases rely on the same underlying mechanics detailed in the advisory - fraudulent accounts and proxy infrastructure built to look like ordinary usage.

China's response has moved beyond rhetoric. Its Commerce Ministry warned that 'if the US takes action to contain or suppress Chinese AI companies in the name of combating distillation, China will certainly take resolute measures in response' ^[7], a threat landing just ahead of planned Trump-Xi talks ^[8].

Some outlets have already reframed the dispute as a cybersecurity matter rather than a trade one ^[5], and the advisory itself steers U.S. companies toward defensive measures - subscription-to-usage monitoring, deliberate response degradation for suspected scraping traffic, and closer intelligence sharing - rather than purely legal remedies ^[1]. With both governments talking past each other on whether large-scale model querying is theft or ordinary practice, how - or whether - that gap closes could shape the negotiating posture on AI policy well beyond this single advisory.