Three US security agencies put their names on a document Tuesday that the AI industry has been arguing about for two years: the accusation that China’s leading AI labs built their frontier models, in significant part, on the outputs of American ones. The joint advisory, numbered AA26-251A and published September 8 by CISA with the NSA and FBI, names six companies: DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI. The agencies say the firms extracted billions of tokens across millions of requests from US frontier models, including Claude, GPT, Gemini and Grok, since at least late 2024, and that the activity was likely known to the Chinese government. The document calls the campaigns “aggressive, malicious, and targeted” and says they violate the terms of use of the US companies involved and threaten American technological leadership. Beijing has not responded to the advisory. The named companies have previously denied similar allegations, and distillation itself is a legitimate, widely used training technique. What the agencies allege is a step beyond it: industrial-scale extraction, run through routing infrastructure designed to hide who was asking.
What distillation is, and what the advisory says was done with it
Knowledge distillation is standard machine learning practice. A developer asks a more capable model large numbers of questions, collects the answers, and trains a smaller model on those outputs. OpenAI’s own terms of service prohibit using outputs to build competing models, but the practice happens inside the industry constantly, usually with permission. The advisory describes something larger and covert. According to the document, the Chinese firms sent millions of carefully designed requests to American models, targeting specific capabilities: supervised fine-tuning optimization, reinforcement learning signals, software engineering and math. DeepSeek, the agencies say, queried four separate versions of Claude, two versions of Gemini, five versions of ChatGPT and Grok 4 to generate synthetic training data for its R1 and R3 models. MiniMax spent late 2025 pulling chain-of-thought reasoning and reinforcement learning signals out of Claude Code, Claude Sonnet 4, Claude Opus and Gemini models to build its M2 model, and the advisory says MiniMax even used prompt injections to try to trick Claude Code into believing it was a MiniMax product. Moonshot AI, the company behind the Kimi models, allegedly extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data for Kimi-K2, running a widespread campaign since at least mid-2025. By mid-2026, Z.AI had distilled billions of tokens of GPT-5.5 and Claude Opus 4.8 data to develop chain-of-thought reasoning, the document states. StepFun distilled from more than a dozen Claude and GPT variants to improve the coding and agentic functions of its Step 4 model.
The routing infrastructure
The most technically interesting part of the advisory is not the what but the how. The agencies describe routing systems that direct distillation requests through multiple pathways: native APIs, cloud providers, third-party aggregators, third-party relays and vendor account pools. These systems provide model abstraction, real-time health monitoring, centralized quota enforcement and automated sanitization. Detection, the agencies write, rests on two patterns: consistent operational behavior across otherwise diverse account pools, and correlated timing across different pathways that indicates a single hand on the controls. A fourth tactic described in the document, automated metadata sanitization, strips organizational identifiers from requests at the infrastructure layer. The tell is an absence: high-volume campaigns where the scale suggests an institution but the requests carry no consistent organizational markers.
| Company | Alleged distillation targets | Used to build |
|---|---|---|
| DeepSeek | Claude x4, Gemini x2, ChatGPT x5, Grok 4 | R1, R3 |
| Moonshot AI | Claude Fable 5, GPT-4o, Claude Sonnet variants | Kimi-K3, Kimi-K2 |
| MiniMax | Claude Code, Sonnet 4, Opus, Gemini 1-3 Pro | M2 |
| StepFun | Claude Opus 4.1/4.5, GPT-5 series | Step 4 |
| Z.AI | GPT-5.5, Claude Opus 4.8 | Reasoning capabilities |
Why Kimi matters to the story
Moonshot is not just any name on the list. Kimi K3, released in July as an open-weight model, topped Anthropic and OpenAI on a widely watched coding benchmark and briefly sent markets reeling, with Chinese AI stocks surging and Western semiconductor names wobbling. The launch reopened a debate that DeepSeek started in early 2025: whether the hundreds of billions of dollars being spent on chips and data centers in the United States actually produce proportionally better models. The advisory reframes that debate. If Kimi’s coding performance was built in meaningful part on Claude and GPT outputs, the efficiency argument weakens considerably. White House science office director Michael Kratsios made the claim bluntly in July, posting that Moonshot had distilled Anthropic’s Fable model and calling large-scale covert distillation “unacceptable.” Anthropic’s policy head, Sarah Heck, went further, calling it IP theft and industrial espionage. Moonshot denied the allegations then and has not commented on the new advisory. Skeptics of the distillation story, including independent analysts, have argued the timeline does not work: the newest American models had limited availability before Kimi K3 launched, and distillation alone would not explain the benchmark results. That argument now has to contend with a government document laying out specific model pairs and dates.
The cost lands on American startups
The immediate recommendations in the advisory are directed at US AI companies: tighten API abuse detection, watch for the account-pool and metadata patterns described, and enforce rate limits more aggressively. Anthropic has already begun doing some of this. It is the downstream effect that will touch ordinary developers. If US labs respond to the advisory by enforcing their terms of service harder, access gets tighter and licensing terms stricter across the board, not just for flagged accounts. A startup building on Claude or GPT could face new verification requirements, lower rate ceilings or usage audits, and possibly higher prices, because six firms allegedly abused the open door. There is also an open question about enforcement. Export controls restrict the chips, not the API calls, and the Commerce Department is separately drafting a rule to stop Chinese firms from renting US-made GPU compute through data centers in third countries such as Thailand and Singapore, The Information reported in August. Legal analysts note that the Bureau of Industry and Security may lack statutory authority for remote-access controls without amendments to the Export Control Reform Act. In other words, the agencies have named the problem and described it in detail, and the legal tools to stop it are still being written.
What to watch next
Three threads follow from Tuesday’s advisory. First, whether the named companies respond and whether any face sanctions; Treasury Secretary Scott Bessent said in July the US could sanction Chinese firms over IP theft, without naming anyone. Second, whether US labs begin enforcing terms of service in ways that show up in API pricing and access tiers within the next quarter. Third, whether Congress treats the advisory as ammunition for the pending AI-related provisions now moving through committee, including the Commerce Department’s draft rule on remote GPU access. The deeper shift is reputational. Open-weight models from Chinese labs had been winning over US businesses on price and capability, with adoption growing through the summer. A government document alleging that the flagship results rest on extracted American capabilities makes every procurement decision involving those models harder to defend. That, more than any technical measure, may be the advisory’s real effect.
discussion