The NSA Named Six Chinese Labs. The Fix Is a Silent Downgrade.

TL;DR

On September 8 the NSA, CISA and the FBI published joint advisory AA26-251A, naming six China-based AI companies and alleging they extracted "billions of tokens across millions of exchanges/requests" from US frontier models since at least late 2024 to train their own. The named six: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.

Read the accusations, then read the mitigation section twice. The agencies advise US model providers to serve suspected distillers a quietly degraded model, and explicitly advise against telling them. If you run high-volume API traffic, the behavioral profile that triggers this is uncomfortably close to a well-configured agent fleet.

Six names, and what each allegedly took

The advisory's opening claim is not that distillation happened at the margins. It says China-based AI companies are "conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies' models through industrial-scale knowledge distillation campaigns," campaigns that "form the core" of their development strategy rather than a supplement to it.

Nick Andersen, CISA's Acting Director, put the ask plainly: "We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns."

The per-company allegations, as written:

• DeepSeek: an organized campaign "since at least late 2024" targeting reasoning capabilities, specialized optimizations and domain-specific functions, producing synthetic training data for models including R1. The advisory adds that DeepSeek's widely quoted $5.6M training cost is misleading because it excludes the cost of data acquired this way.
• Moonshot AI: widespread distillation since mid-2025, extracting "significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data" for Kimi-K2, across "millions of exchanges targeting agentic reasoning/tool use."
• Alibaba: in late 2025, "distilled Claude-4, Claude Opus, Claude Sonnet, and GPT-5 to improve their AI models' software engineering skills."
• MiniMax: improved its M2 model using Claude Code, Claude Sonnet 4, Claude Opus, Gemini 1, Gemini 2.5 Pro and Gemini 3 Pro.
• StepFun: between late 2025 and early 2026, pulled from multiple Claude and GPT variants "to improve its Step 4 model's coding and agentic functions."
• Z.AI: "By mid-2026, distilled billions of tokens of GPT-5.5 data and Claude Opus 4.8 data" for reasoning.

The targets span every major US lab: Claude variants from Anthropic, GPT variants from OpenAI, Gemini from Google, and xAI's Grok.

How the traffic allegedly got in

Knowledge distillation is a legitimate technique: train a smaller model on a bigger model's outputs. The agencies are not claiming the method is illegitimate, they are claiming the sourcing was. Think of it as copying the top student's homework, except the advisory says the copying went after the working-out rather than the answers. DeepSeek, it alleges, "employed prompts instructing models to imagine and articulate the internal reasoning behind completed responses and write it out step by step," which is a polite description of prying open a hidden chain of thought.

Getting the volume through required plumbing. The advisory describes a gray market of API proxies it calls "transfer stations", used "to bypass U.S. AI companies' geographic restrictions, breach terms of use, evade safeguards, and undermine traceability." On top of that: fraudulent accounts "not registered to legitimate users," clusters of accounts sharing registration details and payment methods, automated request metadata sanitization, and centralized routing across native APIs, cloud providers, third-party aggregators, relays and vendor account pools.

The best detail in the whole document is small: MiniMax, the advisory says, "even used prompt injections to try to trick Claude Code into believing it was a MiniMax product." That is either industrial espionage or the most ambitious rebrand attempt of the year.

The recommendation you should read twice

The advisory gives US AI companies three immediate actions. The first and third are unremarkable: detect anomalous prompts, accounts, networks and behaviors, and share intelligence across model providers, cloud platforms and API aggregators.

The second is not. Verbatim: "Deploy targeted response changes: Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs."

Avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model. Informing malicious distillers would enable them to improve their defense evasions.

So: serve a worse model, and say nothing. The advisory also recommends differential privacy, which it describes as "adding calibrated noise to model outputs," plus per-key and per-IP quotas and progressive throttling. As adversarial security engineering this is coherent. As a norm for a commercial API that thousands of unrelated businesses build products on, it introduces a failure mode that has no error message.

Your agent fleet fits the profile

Here is where it lands on you. The behavioral indicators the advisory tells providers to hunt for are, verbatim: "shared accounts from multiple IPs/user agents, 24/7 sustained usage without human variation/idle periods, anomalous subscription-to-API usage ratios, and new subscriptions immediately at maximum usage."

Now describe a competent production agent deployment. One service account key, many workers, many egress IPs. Cron schedules, so no idle periods and no circadian rhythm. An enterprise contract negotiated in advance, so throughput starts at the ceiling on day one instead of ramping. Independent analysis of the advisory has already pointed out this overlap, and the advisory itself contains no false-positive analysis and no guidance for customers on the receiving end.

Four things worth doing this month, none of which require you to believe anything about geopolitics:

• Split shared keys. One API key per workload, mapped to an owner. A single key fronting your entire fleet is both an operational risk and the first indicator on that list.
• Log what actually served you. Record the returned model identifier and any service tier or fingerprint field on every call, and diff it daily. If a downgrade ever happens silently, this is the only artifact that will show it.
• Run a canary set. Thirty to fifty fixed prompts with graded answers, on a schedule, against your production endpoint. Alert on score, output length and latency together, because a quality shift rarely moves only one of them.
• Get it in the contract. At renewal, ask for written commitments on model identity and an appeal path with an SLA for abuse-detection flags.

What the advisory does not say

Fairness demands the caveats, and they are substantial. This is an intelligence assessment, not a court finding. The public document names companies and describes techniques but does not publish the underlying evidence, and none of the six had issued a public response at the time of writing. The agencies also acknowledge that distillation itself is a valid training method; the accusation is about scale, fraud and terms-of-service breach, not about the math.

The advisory is also silent on the question every builder here actually has: if these models were trained the way the agencies say, what does that mean for the many production stacks now running GLM, Kimi, Qwen and MiniMax weights? No guidance, no risk framing, nothing. Six named vendors, zero words for their customers.

Key Takeaways

• Joint advisory AA26-251A (NSA, CISA, FBI, September 8, 2026) names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI over "industrial-scale" distillation of US frontier models since at least late 2024.
• Specific claims include Claude Fable 5 data behind Kimi-K3, GPT-4o data behind Kimi-K2, and billions of tokens of GPT-5.5 and Claude Opus 4.8 data behind Z.AI's reasoning work.
• The advisory calls DeepSeek's quoted $5.6M training cost misleading because it omits the cost of maliciously acquired data.
• Recommended mitigation number two is to subtly alter responses for suspected distillers, and to avoid informing them of the downgrade.
• The detection indicators (shared keys, 24/7 usage, instant max throughput) describe a normal enterprise agent fleet, and the advisory contains no false-positive analysis.
• Defensive move for builders: split API keys per workload, log the served model identifier, run scheduled quality canaries, and get model-identity language into your contract.

Sources: CISA advisory AA26-251A, CISA press release, joint advisory PDF (media.defense.gov), CyberScoop, Unite.AI, Defense One