U.S. Agencies Say Chinese AI Firms Extracted Billions of Tokens From Frontier Models
Summary
CISA, NSA, and the FBI say six Chinese AI firms used fraudulent accounts, proxies, and API abuse to extract billions of tokens from U.S. frontier models. The agencies recommend stronger detection, response changes, and intelligence sharing.
Key points
- A joint CISA, NSA, and FBI advisory alleges that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI conducted industrial-scale distillation campaigns against models from Anthropic, OpenAI, Google, and xAI since late 2024.
- The agencies say the firms extracted billions of tokens through millions of API requests; DeepSeek and Moonshot AI were identified as the most active.
- The advisory describes use of fraudulent or shared accounts, proxies, cloud services, and API aggregators to bypass geographic restrictions, usage limits, and detection.
- Reported tactics included attempts to extract chain-of-thought reasoning, automated failover between access routes, and quality checks for detecting defensive countermeasures.
- CISA recommends behavioral and infrastructure-level detection, changing responses when distillation is suspected, and sharing campaign intelligence.
- The agencies assess that the operations’ scale and sophistication indicate Chinese government awareness; this is an assessment, not a confirmed finding in the article.
Article Details
- Event Type
- U.S. agencies' advisory alleging industrial-scale AI model distillation attacks
- Impact
- The advisory says six Chinese AI companies extracted billions of tokens through millions of requests from models operated by Anthropic, OpenAI, Google, and xAI. The agencies assess that the activity could shorten AI development timelines and reduce training costs for the accused firms.
Threat Actors
AlibabaNamed in the joint advisory as a company accused of targeting Claude and GPT models to improve its products.DeepSeekNamed in the joint advisory as a company accused of conducting industrial-scale distillation attacks against U.S. AI models; DeepSeek and Moonshot AI were described as the most active.MiniMaxNamed in the joint advisory as a company accused of distilling Claude, Gemini, and GPT models.Moonshot AINamed in the joint advisory as a company accused of conducting industrial-scale distillation attacks against U.S. AI models; DeepSeek and Moonshot AI were described as the most active.StepFunNamed in the joint advisory as a company accused of targeting Claude and GPT models to improve its products.Z.AINamed in the joint advisory as a company alleged to have targeted GPT-5.5 and Claude Opus 4.8.
Vendors
Anthropiccybersecurity and intelligence agencies say six Chinese AI companies conducted industrial-scale distillation attacks on frontier AI models from Anthropic, OpenAI, Google, and xAI since late 2024.Googlecybersecurity and intelligence agencies say six Chinese AI companies conducted industrial-scale distillation attacks on frontier AI models from Anthropic, OpenAI, Google, and xAI since late 2024.OpenAIcybersecurity and intelligence agencies say six Chinese AI companies conducted industrial-scale distillation attacks on frontier AI models from Anthropic, OpenAI, Google, and xAI since late 2024.xAIcybersecurity and intelligence agencies say six Chinese AI companies conducted industrial-scale distillation attacks on frontier AI models from Anthropic, OpenAI, Google, and xAI since late 2024.
Products
ClaudeDeepSeek and MoonShot AI were marked as the top offenders involved in distilling multiple Claude, GPT, Gemini, and Grok models, followed by MiniMax, which targeted Claude, Gemini, and GPT models.Claude Opus 4.8Alibaba and StepFun are accused of targeting Claude and GPT models to improve their products, while Z.AI allegedly targeted GPT-5.5 and Claude Opus 4.8.GeminiDeepSeek and MoonShot AI were marked as the top offenders involved in distilling multiple Claude, GPT, Gemini, and Grok models, followed by MiniMax, which targeted Claude, Gemini, and GPT models.GPTDeepSeek and MoonShot AI were marked as the top offenders involved in distilling multiple Claude, GPT, Gemini, and Grok models, followed by MiniMax, which targeted Claude, Gemini, and GPT models.GPT-5.5Alibaba and StepFun are accused of targeting Claude and GPT models to improve their products, while Z.AI allegedly targeted GPT-5.5 and Claude Opus 4.8.GrokDeepSeek and MoonShot AI were marked as the top offenders involved in distilling multiple Claude, GPT, Gemini, and Grok models, followed by MiniMax, which targeted Claude, Gemini, and GPT models.