China-based artificial intelligence companies have extracted billions of tokens through millions of exchanges with U.S. frontier AI models since at least late 2024, using the resulting data in the development of competing systems, according to a joint advisory from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Federal Bureau of Investigation. The agencies said the activity represents industrial-scale knowledge-distillation campaigns that have become a core part of some companies’ AI-development strategies rather than a supplementary research technique.

The advisory identifies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as participants. It says the companies targeted models from U.S. providers, including variants of Claude, GPT, Gemini and Grok. The agencies describe the activity as systematic extraction of proprietary functionality and capabilities, while noting that distillation itself is a legitimate technique in artificial-intelligence research.

The advisory says DeepSeek has conducted an organized distillation campaign since at least late 2024. The company targeted reasoning capabilities, specialized optimizations and domain-specific functions to generate synthetic training data for its R1 and V3 models. The targeted systems included Claude, Gemini, GPT and Grok variants. The extracted capabilities included legal specialization, application-programming-interface rule-driven tasks, chain-of-thought drafting, agentic functions, question-and-answer optimization, coach and assistant capabilities, functional creation and supervised fine-tuning optimization, as well as creative and occupational writing.

The agencies also say DeepSeek’s publicly cited training cost of $5.6 million is misleading because it does not include the cost of data acquired through extensive distillation. The figure appears in the advisory’s discussion of DeepSeek’s organized campaign and the costs associated with its model-development approach.

Moonshot AI’s campaign began at least by mid-2025, the advisory says. The company extracted significant Claude Fable 5 data for its Kimi-K3 model and GPT-4o data for Kimi-K2. The activity also targeted capabilities related to supervised fine-tuning, reinforcement learning, software engineering and mathematics across Claude, GPT, Gemini and Grok systems.

The advisory places other companies’ activity across a later period. In late 2025, Alibaba distilled Claude-4, Claude Opus, Claude Sonnet and GPT-5 to improve software engineering, customer-service dialogue, image and character creation, and the integration of reinforcement learning, supervised fine-tuning and distillation capabilities.

MiniMax used Claude Code and other Claude and Gemini systems in late 2025 to improve its M2 model’s chain-of-thought reasoning, reinforcement learning, supervised fine-tuning and software-engineering capabilities, according to the advisory. The company used Claude Code for internal software-development tasks, including code generation, analysis and refinement. The agencies also say MiniMax used prompt injections in an attempt to make Claude Code treat it as a MiniMax product.

Between late 2025 and early 2026, StepFun distilled data from Claude, GPT and other U.S. systems to improve coding and agentic functions in its Step 4 model. By mid-2026, Z.AI had distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 to develop chain-of-thought reasoning capabilities, the advisory says.

The companies used several access routes for their requests. These included native application programming interfaces, remote cloud providers and third-party aggregators that automatically obfuscate user metadata. The advisory also describes a gray market of API proxies called “transfer stations.” It says those proxies can bypass geographic restrictions, breach terms of use, evade safeguards and undermine traceability.

The agencies said operators reduced costs by buying premium subscriptions in bulk and sharing them among teams of developers. They also described automated failover between access pathways during blocking attempts, chain-of-thought reasoning extraction and quality-evaluation systems designed to detect defensive countermeasures. The companies also sought to combine capabilities and proprietary features from multiple U.S. frontier models.

The agencies assess that companies conducting industrial-scale distillation can achieve shorter AI-development timelines and reduce the financial expenditures associated with training a frontier model. The advisory describes the activity as a threat to U.S. technological leadership and says it warrants a coordinated response across the AI ecosystem, including the U.S. government, private industry and allied nations.

To limit the activity, the agencies recommend that U.S. AI companies monitor anomalous and malicious prompts, accounts, networks and behavior. They also recommend monitoring subscription-to-usage ratios, maximum usage immediately after account creation and enterprise-scale throughput patterns.

The advisory further recommends that providers make targeted response changes for suspected distillation attempts, including subtle alterations intended to reduce the value of extracted responses. It calls for intelligence sharing across model providers, cloud platforms and API aggregators so organizations can correlate activity associated with distributed campaigns. The agencies’ recommendations focus on detection, mitigation and coordination across services used to access frontier AI models.