The NSA, CISA and the FBI issued a joint cybersecurity advisory, AA26-251A, accusing six China-based AI companies of running industrial-scale distillation campaigns against American frontier models.

The six named: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.

The scale, in the agencies' words: "extracted billions of tokens across millions of exchanges", from late 2024 through mid-2026, likely with Chinese government awareness. The targets included variants of Claude, GPT, Gemini and Grok, with the advisory describing extraction feeding the training of DeepSeek's R1 and V3.

Distillation is not hacking, and that is the difficulty

It is worth being clear about what is being alleged, because the word "advisory" from three security agencies primes you to expect an intrusion, and there was not one.

Distillation means querying a capable model at volume and training a smaller one on its outputs — using the teacher's answers as the student's training data. It requires no access to weights, no breach, no vulnerability. It requires an API key and a budget.

So the conduct described is: paying customers used a product as sold, in enormous quantity. The evasion described is about identity, not access — requests routed through cloud providers, VPNs, third-party aggregators that obfuscate user metadata, and automated agents to bypass geographic restrictions. That is a terms-of-service problem wearing a national security jacket.

Which is precisely why it is hard. There is no patch. There is no indicator to block. The activity is indistinguishable, request by request, from a large legitimate customer.

The site covered DeepSeek's own agent runtime this week, where the security failure was a genuine engineering one. This is the opposite category: nothing failed.

The recommended countermeasure is the remarkable part

The advisory tells US AI companies to "implement comprehensive detection and mitigation measures, subtly alter responses for suspected malicious distillation attempts, and correlate activity across model providers."

Read the middle clause again. The recommendation is not to block suspected accounts. It is to keep serving them, and to quietly change what they get.

The logic is sound on its own terms. Blocking teaches the adversary your detection threshold: they lose the account, adjust, and come back through a different aggregator. Degrading does not. If the extracted outputs are subtly wrong, the student model trains on corrupted data, and the damage compounds silently through a training run rather than being caught at the door. Poisoning the well is a more durable defence than locking it.

It is still a striking thing for three government agencies to recommend to private companies: deliberately serve a paying customer a worse product without telling them.

The problems arrive immediately after the principle:

  • False positives are invisible to the victim. A legitimate high-volume customer flagged in error receives quietly degraded output and has no way to know. They will experience it as the model getting worse.
  • It cannot be disclosed without defeating itself. Any published threshold or method is a specification for evading it.
  • Contracts and consumer law generally assume a provider serves what it advertises.
  • "Correlate activity across model providers" asks competitors to share customer behaviour data with one another, which has its own set of regulators.

None of that makes the advice wrong. It does mean the countermeasure is being recommended in a space with no established norms, and the people most likely to encounter it first are ordinary heavy users.

What this says about where model value sits

The strategic reading is short. If capability can be extracted through the API at a cost far below the cost of building it, then a frontier model's advantage is not the weights. It is the lead time before the outputs have been harvested.

That reframes the whole competitive picture. Guarding the weights is well understood and largely solved. Guarding the behaviour of a model that is exposed to the public by design is not, and may not be solvable — you cannot sell answers and also keep them.

What to do

  • If you are a high-volume API customer, expect scrutiny. Predictable, attributable, contractually clear usage is now worth having.
  • If output quality drops without explanation, ask your provider directly. That is a reasonable question to put in writing.
  • If you build on these APIs, log and version model outputs so you can evidence a change rather than argue about a feeling.
  • Do not read the advisory as an intrusion warning. There is nothing to patch and no indicator to block.

What is not established

  • Evidence. The agencies assert scale and intent; the underlying telemetry is not public.
  • Whether any provider has implemented response alteration, or would confirm it.
  • Company responses. None of the six had publicly responded at time of writing.
  • What "likely with Chinese government awareness" rests on, which is doing significant work in the advisory.
  • Whether distillation at this scale is unlawful anywhere, as opposed to a terms-of-service breach.