A joint advisory from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Federal Bureau of Investigation says China-based artificial intelligence companies have conducted high-volume campaigns to extract proprietary capabilities from U.S. frontier AI models. The agencies describe knowledge distillation as the central element of the companies’ model-development strategy, rather than a supplementary research technique.
The advisory alleges that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges and requests from U.S. models since at least late 2024. The targeted systems included variants of Claude, GPT, Gemini and Grok. The agencies say the activity was designed to obtain restricted functionality, reasoning capabilities and specialized performance while shortening development timelines and reducing financial expenditures for companies training frontier models.
The scale and distribution of the activity are central to the agencies’ assessment. Rather than relying on one provider or access route, the companies allegedly spread requests across native application programming interfaces, remote cloud providers and third-party aggregators. Some aggregators automatically obfuscated user metadata, while a gray market of API proxies known as “transfer stations” was used to bypass geographic restrictions, evade safeguards and make the activity harder to trace.
The advisory says operators also reduced costs by purchasing premium subscriptions in bulk and sharing them among developer teams. They allegedly used automated failover between access pathways when a provider blocked activity. Other tactics included chain-of-thought reasoning extraction and quality-evaluation systems intended to identify defensive changes in model responses. The agencies say the companies distributed operations across multiple providers, platforms and pathways to avoid a single point of detection.
DeepSeek is identified as having conducted an organized campaign since at least late 2024 to generate synthetic training data for models including R1, released in early 2025, and V3. The advisory says the campaign targeted legal specialization, API rule-driven tasks, question-and-answer optimization, agentic capabilities, writing and other functions. It lists data drawn from multiple Claude, Gemini, GPT and Grok variants. The agencies also say DeepSeek’s publicly quoted $5.6 million training-cost figure does not include the cost of data acquired through the alleged distillation activity.
Moonshot AI is described as having conducted a widespread campaign since at least mid-2025. The advisory says the company extracted Claude Fable 5 data for its Kimi-K3 model and GPT-4o data for Kimi-K2. It also lists activity involving models from Anthropic, OpenAI, Google and xAI to obtain supervised fine-tuning, reinforcement-learning, software-engineering and mathematical capabilities.
The advisory attributes additional activity to Alibaba, MiniMax, StepFun and Z.AI. Alibaba allegedly distilled Claude-4, Claude Opus, Claude Sonnet and GPT-5 data in late 2025 to improve software engineering, customer-service dialogue, image and character creation, and the integration of reinforcement learning, supervised fine-tuning and distillation. MiniMax allegedly used Claude Code and other Claude and Gemini models in late 2025 to improve its M2 model’s chain-of-thought reasoning, reinforcement learning, supervised fine-tuning and software-engineering capabilities. The agencies further allege that MiniMax used prompt injections in an effort to make Claude Code treat it as a MiniMax product.
StepFun allegedly used data from Claude and GPT systems between late 2025 and early 2026 to improve coding and agentic functions in its Step 4 model. By mid-2026, Z.AI had allegedly distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 to develop chain-of-thought reasoning capabilities, the advisory says.
The agencies assess that industrial-scale distillation can shorten development timelines and reduce financial expenditures for companies training frontier models. They characterize the combined activity as systematic extraction of proprietary functionality that threatens U.S. technological leadership. The advisory does not present distillation itself as inherently improper; instead, it distinguishes ordinary research use from targeted efforts to obtain restricted capabilities through unauthorized access and activity that violates providers’ terms of use.
For U.S. AI companies, the advisory recommends detecting anomalous prompts, accounts, networks and behavior, while monitoring subscription-to-usage ratios, maximum usage immediately after account creation and enterprise-scale throughput patterns. It also recommends subtly changing responses for suspected distillation attempts to reduce the value of extracted outputs. A third measure is cross-organization intelligence sharing among model providers, cloud platforms and API aggregators so distributed campaigns can be correlated across the ecosystem.