US Agencies Name Six Chinese AI Firms in Industrial-Scale Model Theft Advisory

30-Second Summary

The NSA, CISA, and FBI issued a joint advisory on September 8, 2026, accusing six China-based AI companies of running industrial-scale distillation campaigns against American frontier models since at least late 2024. The named companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, are alleged to have extracted billions of tokens across millions of API requests from Anthropic, OpenAI, Google, and xAI. The agencies are now instructing US AI providers to secretly downgrade model quality for suspected accounts rather than alerting or banning them.

At a Glance

• Topic: AI Security
• Issuing agencies: NSA, CISA, FBI
• Date: September 8, 2026 (Advisory AA26-251A)
• Announcement: Joint advisory naming six Chinese AI companies for industrial-scale distillation of US frontier models
• What Changed: For the first time, three US national security agencies have jointly named and attributed specific Chinese AI companies for systematic AI model extraction campaigns
• Why It Matters: The advisory changes the risk calculus for any organisation using Chinese AI models in production, and introduces a new risk for heavy API users who may be silently downgraded by their providers
• Who Should Care: Enterprise operators using AI APIs, compliance and legal teams in regulated sectors, any organisation that previously evaluated DeepSeek or Alibaba AI products

Key Facts

• Advisory number AA26-251A, issued September 8, 2026, jointly signed by NSA, CISA, and the FBI
• Six companies named: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI
• Campaigns began in late 2024 and continued through the advisory date
• Targeted models: Anthropic Claude, OpenAI GPT, Google Gemini, xAI Grok
• Scale: billions of tokens extracted across millions of API requests
• Specific target: chain-of-thought reasoning traces, the internal thinking outputs from reasoning models, not just final answers
• The advisory recommends providers use "less sophisticated downgraded models" for suspected accounts and to "avoid informing" those users of the switch
• The advisory is 3,585 words and does not use the words theft, illegal, unlawful, copyright, or trade secret
• Activity assessed as "likely occurring with Chinese government awareness"

What Happened

On September 8, 2026, the NSA, CISA, and FBI jointly published cybersecurity advisory AA26-251A accusing six China-based artificial intelligence companies of conducting what they describe as industrial-scale knowledge distillation campaigns against US frontier AI models. The advisory is the first joint statement from all three agencies specifically attributing AI model extraction to named Chinese technology companies.

The six named companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, are alleged to have sent billions of structured API requests to models from Anthropic, OpenAI, Google, and xAI since at least late 2024. The campaigns were not random scraping. According to the advisory, they specifically targeted chain-of-thought reasoning traces, the intermediate thinking steps exposed by modern reasoning models, with the goal of training their own systems to replicate not just outputs but reasoning behaviour.

The advisory includes detection guidance for US AI providers. Indicators cited include enterprise-scale traffic volumes originating from consumer-tier account subscriptions, newly created accounts immediately saturating usage limits, round-the-clock automated request patterns, and accounts shared across multiple IP addresses. Providers are instructed to respond to suspected accounts by silently substituting a lower-quality model rather than restricting access or notifying the user. The advisory explicitly states providers should "avoid informing" suspected distillers of any change.

Why It Matters

For operators using Chinese AI models, the risk profile has changed permanently. The advisory names DeepSeek specifically. Any organisation that deployed DeepSeek models in production workflows, or is considering doing so, now faces reputational, regulatory, and supply-chain risk that the cost savings do not offset. The story is no longer about whether a Chinese model performs well. It is about whether your organisation is comfortable being named alongside providers under active US government intelligence scrutiny.

The silent downgrade recommendation is itself a governance problem. AI providers acting on this advisory will secretly substitute lower-quality models for accounts that pattern-match to distillers. Legitimate heavy users, enterprise operators running AI in production, agentic workflows, automated pipelines, share many of the same traffic characteristics as distillers. Organisations cannot assume they are receiving the model they contracted for, and most have no mechanism to detect a substitution.

Chain-of-thought reasoning traces are now a defined attack surface. The advisory establishes that internal model reasoning, not just final outputs, has strategic value. Organisations that expose reasoning-capable models via API should review what they log, what third parties can access, and whether their own API usage patterns inadvertently create a comparable extraction profile.

The advisory's language is deliberate. Across 3,585 words it never uses the terms theft, illegal, or copyright. This leaves legal action ambiguous. The US government is treating this as an intelligence and competitive matter, not a criminal one, at least for now. Operators in regulated sectors should not assume the current framing will remain stable.

The geopolitical backdrop is now explicit. The agencies assess the campaigns occurred "likely with Chinese government awareness." For any organisation with Chinese customers, partners, or investors, this advisory may require internal legal review of AI infrastructure choices.

The David and Goliath View

The advisory's detection criteria deserve more attention than most commentary has given them. CISA describes distillers as running enterprise-scale traffic from consumer accounts, hitting usage limits immediately, operating round the clock, and coordinating across IP addresses. That is also an accurate description of a sophisticated enterprise automation stack. The advice to providers to silently downgrade without notification creates a scenario where an operator's AI system degrades in quality and the operator has no way to know why or when it happened.

For smaller organisations that have been drawn to DeepSeek and Alibaba AI on cost grounds, this advisory closes that conversation. The decision was always a risk trade-off. The risk side has now been officially quantified by three US intelligence agencies. No cost saving at the 10-200 person operator scale justifies that exposure.

What this advisory actually points to is the next wave of AI infrastructure requirements: model provenance verification, response authenticity logging, and contractual protections against silent model substitution. These are not yet standard in enterprise AI contracts. They will be.

Where This Fits in the AI Stack

This story sits at the intersection of AI security and AI governance. It affects:

• API and vendor selection: Any organisation using or evaluating Chinese AI APIs needs to reassess against this advisory
• Agent infrastructure: Automated pipelines sending high-volume structured requests need monitoring and traffic documentation to distinguish legitimate use from distillation signatures
• Compliance and audit trails: Regulated sectors may need to demonstrate which models processed sensitive data, something silent substitution makes impossible
• Contract review: Enterprise AI service agreements should be reviewed for model consistency guarantees

Questions Operators Are Asking

Does this affect us if we only use OpenAI or Anthropic? Potentially yes. The advisory instructs those providers to silently downgrade accounts that match distillation traffic patterns. If your agent workflows match those patterns, you may already be receiving degraded responses without knowing it. Providers are not required to notify you.

Should we immediately stop using DeepSeek? If you are using any of the six named models in production, yes. The advisory alone creates a compliance and reputational risk that outweighs performance or cost considerations. If you are in a regulated sector, legal review is advisable before the next deployment cycle.

What does knowledge distillation actually mean? Distillation, as used here, refers to training a smaller or cheaper model using the outputs of a more capable model. Rather than training from scratch on raw data, a company sends large volumes of structured prompts to a frontier model and uses the responses as training data. Chain-of-thought distillation specifically targets the step-by-step reasoning outputs, not just final answers, so the student model learns to replicate the thinking process.

How can we tell if our responses have been silently downgraded? Most current enterprise API contracts provide no mechanism for this. Practical steps include logging the model field in every API response, running benchmark prompts periodically and comparing quality over time, and flagging unexpected drops in reasoning quality to the provider. Building model verification into your AI governance process is the medium-term answer.

What is the legal status of distillation? The advisory conspicuously avoids legal characterisation. Distillation sits in contested territory under copyright and trade secret law, and the US government appears to be treating this as a national security and intelligence matter rather than pursuing criminal charges. Operators should not assume the legal framing is settled.

Citable Summary

The NSA, CISA, and FBI jointly named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI in Advisory AA26-251A on September 8, 2026, accusing all six of conducting industrial-scale distillation of US frontier AI models including Anthropic Claude, OpenAI GPT, Google Gemini, and xAI Grok since late 2024. The advisory states the campaigns extracted billions of tokens targeting chain-of-thought reasoning traces. US agencies instructed AI providers to silently downgrade responses to suspected accounts without notification. Legitimate enterprise operators with heavy API usage may match the advisory's distillation detection criteria, creating an unresolved governance gap around model consistency verification.