U.S. Agencies Allege Mass AI Distillation—Legitimate Users May Feel the Defenses

On September 8, 2026, the FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency issued a joint advisory alleging that China-based AI companies were systematically extracting capabilities from U.S. frontier models. The NSA’s September 8 release describes the activity as industrial-scale distillation conducted to train the companies’ own models.

The September 8 advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. A TechRepublic review of the allegations and defenses says stronger verification, lower limits or altered model routing could also affect legitimate organizations whose high-volume API traffic resembles extraction activity.

What is confirmed, alleged and disputed

The publication of the joint advisory is confirmed; the conduct attributed to the six companies remains a U.S. government allegation, not a court finding or an independently demonstrated measurement of how much their models learned through the alleged campaigns.

• Confirmed government action: the FBI, NSA and CISA jointly published the warning on September 8 and attributed industrial-scale distillation activity to six China-based companies.
• Agency allegation: the companies collectively obtained billions of tokens through millions of requests involving variants of Claude, GPT, Gemini and Grok, with activity dating from at least late 2024.
• Agency assessment: the activity probably occurred with Chinese government awareness. The agencies did not claim that Chinese intelligence services directly participated.
• Confirmed dispute: China’s Commerce Ministry dismissed the accusations as groundless, while the Foreign Ministry urged Washington to stop making what it called unfounded accusations. The Associated Press account of Beijing’s response also records China’s position that distillation is a common industry technique.
• Not established publicly: the available material does not independently quantify the contribution of the alleged extraction to any named company’s models relative to its own research, training data and computing resources.

Why ordinary knowledge distillation is not the accusation

Knowledge distillation is a standard machine-learning technique in which a smaller “student” model learns useful behavior from outputs generated by a more capable “teacher.” Under authorized conditions, it can compress a model, reduce inference costs or preserve selected capabilities in a system that is easier to deploy.

The accusation concerns access, intent and scale rather than the technique alone. The alleged campaigns targeted restricted proprietary functions, generated unusually large volumes of queries and used mechanisms intended to evade geographic, account and usage controls. A lawful enterprise sending many requests therefore is not, by volume alone, conducting the activity described by the agencies.

How the alleged extraction crossed access channels

The allegations describe requests routed through native APIs, cloud platforms, third-party aggregators, multiple accounts and gray-market proxy services known as “transfer stations.” Premium subscriptions were allegedly shared among teams, while automated failover moved traffic when one access path was blocked.

That distributed pattern makes a single credential or IP-address rule an incomplete defense. It also creates overlap with normal business activity: global engineering teams may operate continuously, cloud egress can produce many IP addresses, batch jobs can consume a new account’s quota quickly, and resilience systems may switch providers or routes after a failure.

Where legitimate API customers could feel the defenses

The guidance calls for behavioral detection across prompts, accounts, networks and usage patterns, followed by targeted response changes during suspected malicious campaigns and intelligence sharing among model providers, cloud platforms and aggregators. The customer risk arises when a lawful workload scores like an extraction operation or becomes associated with traffic flagged elsewhere.

• Identity checks: shared credentials, linked accounts or changing cloud tenants may prompt additional ownership verification. A provider trying to connect activity across platforms could also ask customers to explain relationships among accounts, IP ranges and intermediaries.
• Quotas: immediate saturation, sharp bursts or enterprise-scale traffic on a smaller subscription may lead to throttling or review. The visible symptom may resemble ordinary capacity enforcement even when a security classifier triggered it.
• Routing: targeted response changes could mean reduced reasoning depth, a different response path or movement to a less capable model. If the API does not expose that intervention, a successful request would not necessarily prove that the expected capability handled it.
• Output consistency: security-driven variation could affect regression tests, code generation, structured extraction and multi-step agents. The practical concern is not merely a refusal but an accepted request producing answers with different depth or reliability.
• Cross-provider decisions: intelligence sharing can make detection more effective, but it raises unresolved questions about how classifications are corrected and whether a false positive can follow traffic across vendors or aggregators.

These are possible consequences of implementing the recommendations, not confirmation that every model provider has adopted them. The public material does not identify which vendors will use targeted response changes, what confidence threshold they will require or whether customers will be told when security routing affects a result.

What remains unresolved

The established record is limited: three U.S. agencies issued the September 8 advisory, named six companies and described alleged extraction methods; China rejected the accusations. No public adjudication has established the alleged conduct, and the agencies have not released independently auditable totals for each company or model.

For enterprise customers, the next material disclosures would be provider-specific rules for notice, stable model identification, classification appeals and service commitments when anti-distillation controls intervene. Until vendors publish those details, the title’s customer consequence remains a supported risk rather than a confirmed industry-wide service change.

Also read:

• Tesla's Bold Pivot: Fremont Factory Shifts from Model S/X to Mass-Producing Optimus Humanoid Robots
• US Intelligence Agencies Secure $9 Billion for AI Chips and Access to Anthropic’s Mythos Model
• Tea Still Verifies Users After Its 2025 Data Breach