News
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
Publication date not yet evaluated · Added · 2 reports cisa.gov
Page published
Coverage timeline
Why it matters
US intelligence agencies characterizing large-scale model distillation and relay-based credential abuse as a nation-state IP-extraction campaign signals a maturing threat to frontier AI providers, whose usage-metering and account-attribution defenses are being systematically circumvented.
A joint NSA, CISA, and FBI advisory (AA26-251A, Sept. 8, 2026) accuses China-based AI firms including Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun, and Z.AI of conducting industrial-scale knowledge distillation campaigns to covertly extract proprietary capabilities from US frontier models (Claude, GPT, Gemini, Grok), reportedly siphoning billions of tokens across millions of requests since late 2024. Team Cymru research complements the advisory, documenting 10,000+ hidden gateway 'transfer station' servers and tools like Claude Relay Service/sub2api that mask Chinese-origin traffic, bypass region bans, and pool provider credentials to enable large-scale output extraction and distillation.