Washington, Sept. 9 — U.S. cybersecurity agencies have raised the alarm over a new and aggressive form of AI espionage, accusing six Chinese companies of conducting large-scale knowledge distillation operations against leading American AI models. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) issued a joint advisory in September 2026, detailing what they call a systematic effort to clone U.S. AI capabilities without the massive financial and technical investment required to develop them from scratch.
Knowledge distillation is a standard AI technique where a smaller model is trained using outputs from a larger model. But in this case, U.S. officials and companies like Anthropic say Chinese firms are using an unauthorized, aggressive form of adversarial distillation by scraping massive data volumes from frontier U.S. models.
The advisory states that the campaigns, which began in late 2024, are designed to systematically extract proprietary functionalities and capabilities from U.S. frontier AI models to narrow the performance gap while bypassing costly research, development, and compute constraints. Anthropic, the company behind the AI assistant Claude, noted one instance where entities generated over 16 million exchanges using roughly 24,000 fake accounts. The advisory names six Chinese AI developers: DeepSeek, Moonshot AI, Alibaba Group, MiniMax, StepFun, and Z.AI.
The targeted U.S. frontier models include Claude (Anthropic), GPT (OpenAI), Gemini (Google), and Grok (xAI). The Chinese firms reportedly used a gray market of API proxies known as transfer stations, employing shared premium subscriptions, cloud providers, highly distributed proxy networks to mask geographic locations, and thousands of fraudulent accounts.
A Three-Pronged Defense Strategy
The U.S. government is urging frontier AI developers, cloud providers, and API aggregators to take action. The response includes three main steps: first, implementing comprehensive detection and mitigation by monitoring and flagging anomalous behaviors such as immediate maximum usage from newly registered accounts, irregular enterprise-scale throughput patterns, and abnormal subscription-to-usage ratios. Second, deploying targeted response changes by subtly altering or degrading responses generated for suspected malicious distillation queries to reduce data quality.
Third, establishing cross-organization intelligence sharing to correlate user activity data across competing model providers, cloud platforms, and API frameworks. These measures aim to make it harder for bad actors to clone American AI capabilities without paying the full price of development.
But the challenge is clear: the line between legitimate AI research and espionage is getting increasingly blurred.
Chinese Firms Dispute the Claims
For its part, the Chinese government and affiliated tech analysts have dismissed the allegations, stating that Washington is conflating commercial competition with national security to manufacture justifications for further economic sanctions. This comes at a sensitive time, as U.S. and Chinese leaders are scheduled to hold bilateral talks. As the situation unfolds, one thing is clear: the battle over AI is no longer just about innovation — it’s about control, security, and the future of global technology leadership.
