# China-Based AI Companies Conducting Industrial-Scale Knowledge Distillation Campaigns Against U.S. Frontier AI Models

> CISA, NSA, and FBI jointly warn that six China-based AI companies - DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI - are conducting systematic industrial-scale knowledge distillation of proprietary capabilities from U.S. frontier AI models, extracting billions of tokens across millions of requests since at least late 2024, likely with the knowledge of the Chinese government.

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2405
- **ID:** TL-2026-2405
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The joint advisory AA26-251A, released September 8, 2026 by CISA, NSA, and FBI, describes deliberate, industrial-scale campaigns in which six China-based AI companies systematically distill proprietary reasoning, coding, and agentic capabilities from U.S. frontier AI models. The advisory characterizes this distillation as forming the core - not merely a supplement - of the Chinese AI sector's development strategy, which has 'turned to a comprehensive distillation strategy' to bridge the capability gap with U.S. frontier models. The companies assert these activities are 'likely with the knowledge of the Chinese government,' a finding echoed in the White House NSTM-4 memorandum and State Department messaging to Beijing.

The campaigns target Anthropic Claude (3.7 through Opus 4.8 and Fable 5), OpenAI GPT models (GPT-4o through GPT-5.5), Google Gemini (2.5 through 3 Pro), and xAI Grok. DeepSeek has conducted organized distillation since at least late 2024 to generate synthetic training data for its R1 and V3 models, targeting reasoning capabilities, chain-of-thought (CoT) drafting, and agentic functions. Moonshot AI, active since at least mid-2025, extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data for Kimi-K2, using millions of exchanges targeting agentic reasoning, tool use, coding/data analysis, and computer vision. Alibaba executed what Anthropic called 'the largest known distillation attack to date' - over 28.8 million exchanges through nearly 25,000 fraudulent accounts between April 22 and June 5, 2026, targeting agentic reasoning and software engineering capabilities. MiniMax, distilling since late 2025 to improve its M2 model, used prompt injections against Claude Code and redirected exchanges to newly released Claude models within 24 hours. StepFun was active between late 2025 and early 2026 distilling code and agentic functions for its Step 4 model. Z.AI had distilled billions of tokens of GPT-5.5 and Claude Opus 4.8 data by mid-2026, focused on CoT reasoning.

The adversarial infrastructure spans three access pathways (native APIs, remote cloud providers, and third-party aggregators that obfuscate user metadata) supported by a gray market of API proxies, or 'transfer stations,' that resell frontier-model access at roughly ten percent of official pricing. Enablers include bulk premium subscription exploitation across shared account pools, centralized request-routing infrastructure, automated metadata sanitization, systematic quota and cost optimization, CoT elicitation prompts that instruct models to reconstruct internal reasoning, prompt injection and jailbreaking to reveal hidden reasoning, and automated failover between pathways during blocking attempts. Anthropic's February 2026 investigation measured over 16 million exchanges across approximately 24,000 fraudulent accounts operated by DeepSeek, Moonshot AI, and MiniMax in a single detected wave, using 'hydra cluster' proxy architectures managing 20,000+ accounts concurrently.

The U.S. government response includes White House NSTM-4 (issued April 23, 2026), which found the distillation campaigns 'unacceptable' and commits to information sharing with AI companies, defense-coordination best practices, and accountability measures; the Deterring American AI Model Theft Act of 2026 (H.R. 8283), advanced by the House Foreign Affairs Committee on April 22, 2026, which would mandate extraction-attack assessments, an 'AI Model Extraction Attackers List,' and Entity List/IEEPA sanctions; and a State Department demarche to Beijing. Recommended mitigations for U.S. AI providers include detecting anomalous prompts, accounts, networks, and behaviors; subtly altering responses to suspected distillation attempts to attenuate payoffs; and establishing cross-organization intelligence sharing to correlate distributed campaigns.

## MITRE ATT&CK

- AML.T0008 Acquire Infrastructure
- AML.T0040 AI Model Inference API Access
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak
- AML.T0042 Verify Attack
- AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model
- AML.T0048.004 External Harms: AI Intellectual Property Theft
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [AA26-251A: China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (CISA/NSA/FBI)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a)
- [Anthropic: Detecting and preventing distillation attacks](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks)
- [White House NSTM-4: Adversarial Distillation of American AI Models](https://whitehouse.gov/wp-content/uploads/2026/04/NSTM-4.pdf)
- [H.R. 8283: Deterring American AI Model Theft Act of 2026](https://www.congress.gov/bill/119th-congress/house-bill/8283/text/ih)
- [Anthropic letter to Senate Banking Committee on Alibaba distillation attack (via CNBC)](https://www.cnbc.com/2026/06/24/anthropic-accuses-alibaba-of-campaign-to-extract-ai-capabilities.html)
- [Just Security: The Emerging U.S. Response to Adversarial Distillation](https://www.justsecurity.org/137498/diagnosis-deterrence-us-response-distillation/)
- [The Decoder: How China's gray market sells Claude tokens](https://the-decoder.com/chinas-gray-market-sells-claude-tokens/)
- [Digital Applied: Anthropic Distillation Attacks - DeepSeek, Moonshot, MiniMax](https://www.digitalapplied.com/blog/anthropic-distillation-attacks-deepseek-moonshot-minimax)
- [NIST AI 100-2e2025: Adversarial Machine Learning - A Taxonomy and Terminology of Attacks and Mitigations](https://csrc.nist.gov/pubs/ai/100/2/e2025/final)
- [DeepSeek-V3 Technical Report (arXiv)](https://arxiv.org/abs/2412.19437)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2405