CISA names six Chinese labs for mass-distilling U.S. models

WASHINGTON — On Sept. 8, 2026, CISA, NSA, and the FBI released joint Cybersecurity Advisory AA26-251A. It names six China-based AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — for industrial-scale knowledge distillation against U.S. frontier models since at least late 2024.

The agencies say the campaigns extract proprietary capabilities from Claude, GPT, Gemini, and Grok variants through APIs, cloud paths, and “transfer station” proxies — not a one-off scrape. Distillation itself is a recognized training technique. The advisory’s charge is scale, targeting, terms-of-use breach, and geographic-restriction evasion. Do not call it hacking.

The rule in English

The advisory is an attribution-and-mitigation notice, not a statute. It asserts that the named companies ran systematic distillation as a core development strategy — “likely with Chinese government awareness” — pulling billions of tokens across millions of exchanges. Pathways include native APIs, remote cloud providers, and third-party aggregators that obfuscate metadata. Gray-market transfer stations resell frontier access to bypass regional limits and undercut traceability. Bulk premium subscriptions shared across developer teams fund the volume.

Named targets include DeepSeek’s R1/V3 work against Claude, Gemini, GPT, and Grok lines; Moonshot’s Kimi training against Claude and GPT families; Alibaba’s Qwen improvements; MiniMax’s M2 (including prompt injections against Claude Code); StepFun’s Step 4 coding/agent work; and Z.AI’s chain-of-thought extraction from GPT-5.5 and Claude Opus 4.8.

Recommended U.S. lab actions: detect anomalous accounts and subscription-to-usage ratios; subtly alter responses to suspected distillation traffic; share indicators across providers, clouds, and aggregators.

Who wrote it / who it binds

Writers: NSA, CISA, FBI. Audience: U.S. AI companies and the broader ecosystem (cloud, aggregators, infrastructure). The advisory does not itself impose civil fines or criminal charges. It maps tactics to MITRE ATLAS and points to NIST adversarial-ML mitigations, including differential privacy and rate limits.

Who it exempts

Legitimate research distillation and ordinary API use are not the target. The agencies distinguish recognized distillation research from “aggressive, malicious, and targeted” industrial campaigns that extract restricted proprietary functionality. Allied and non-named labs are outside the attribution table.

What a founder or worker should do differently

Founders running frontier APIs: treat subscription-to-usage spikes, new accounts at immediate max quota, and correlated multi-path traffic as distillation signals. Response degradation for high-confidence malicious traffic is an explicit agency recommendation — without tipping the suspected distiller.

Policy desks: this is a national-security framing of model-extraction economics, not a copyright case and not a computer-intrusion indictment in the advisory text. Watch for follow-on export, sanctions, or ToS-enforcement moves.

What’s next

• Named companies’ responses and any denial of the attribution.
• Whether U.S. labs publish distillation-detection metrics after AA26-251A.
• White House NSPM-11 / NSTM-4 follow-through cited in the advisory’s references.
• Allied information-sharing that turns distributed proxy traffic into a single campaign picture.

Source: CISA AA26-251A, Sept. 8, 2026.