The agencies’ central finding is more consequential than another warning about scraped data: they allege that distillation has become a primary development method for the named companies, allowing them to acquire specific reasoning, coding, agentic, vision, and evaluation behaviors without bearing the full cost of building those capabilities. The advisory says the campaigns extracted billions of tokens across U.S. variants of Claude, GPT, Gemini, and Grok.
That changes the immediate security question for model providers, cloud operators, API aggregators, and enterprises exposing their own AI services. The concern is no longer simply whether a customer can exceed a rate limit. It is whether individually ordinary requests, spread across accounts and suppliers, form a coordinated collection operation that can be assembled into a usable training corpus.
The advisory expands an accusation already in public
The joint NSA-CISA-FBI document goes beyond the allegations Anthropic made in February against DeepSeek, Moonshot AI, and MiniMax. Anthropic said then that the three firms had used more than 24,000 fraudulent accounts to generate over 16 million Claude exchanges, targeting advanced capabilities for use in their own models. The new federal advisory adopts the same broad framing while adding Alibaba, StepFun, and Z.AI and supplying a more detailed map of alleged targets and techniques.
According to the agencies, DeepSeek focused on extracting reasoning methods, specialized domain behavior, rubric-based evaluation, agentic functions, and other optimizations for its R1 and V3 models. Moonshot AI is accused of collecting data spanning software engineering, math, reinforcement learning, tool use, computer vision, and supervised fine-tuning for Kimi models. Alibaba allegedly used distillation to improve Qwen capabilities including software engineering, customer-service dialogue, virtual-character creation, and end-to-end agent workflows.
MiniMax, StepFun, and Z.AI are likewise named as participants in the reported campaign. The report says MiniMax pursued chain-of-thought reasoning, code review, software-engineering tasks, and agentic behavior, including alleged attempts to use prompt injection against Claude Code. It says StepFun collected data to improve code-development and agent features, while Z.AI had, by mid-2026, allegedly distilled billions of tokens to develop chain-of-thought reasoning.
These are allegations by U.S. security agencies, not adjudicated findings. The advisory does not release the underlying account records, request samples, infrastructure indicators, or forensic evidence that would allow outside researchers to independently validate attribution for every named company and model pairing. Beijing has previously called U.S. allegations of illicit AI distillation groundless, according to The Associated Press. That evidentiary gap matters, particularly because the advisory’s most serious conclusion is that the activity likely occurred with Chinese government awareness.
Still, the advisory is significant because it represents a public, joint attribution from NSA, CISA, and FBI—not merely a claim by one AI vendor protecting its commercial position.
What makes the reported activity different from legitimate distillation
Knowledge distillation itself is a normal machine-learning practice. A smaller student model can be trained from the outputs of a stronger teacher model to reduce serving costs, improve performance, or transfer learned behavior. Organizations routinely use it inside their own model-development pipelines, and researchers publish distillation techniques widely.
The agencies’ argument is that the reported campaigns crossed into malicious extraction through scale, deception, and access-control evasion. Their description includes account pools that obscure the actual user, proxy services that bypass regional restrictions, centrally managed routing that switches among providers when one begins blocking traffic, and metadata sanitization designed to erase clues about the operator’s identity.
The advisory calls those proxy markets “transfer stations.” In practice, these are intermediaries that resell or relay access to frontier-model APIs, cloud endpoints, or subscriptions. For defenders, the important point is architectural: a blocked account does not necessarily stop the operation if the requester can move traffic through an aggregator, remote cloud provider, relay service, or another account pool without changing its broader behavioral pattern.
The report also describes collections that are targeted rather than indiscriminate. A campaign may seek a model’s code-review style, tool-use decisions, structured legal analysis, reward-model judgments, or the reasoning patterns behind difficult tasks. That is potentially more valuable than collecting generic chatbot answers because it extracts the behaviors that help a competing system perform in specific commercial or agentic workloads.
The agencies say some operators also attempted to force models to reveal hidden chain-of-thought reasoning through jailbreaks and prompt injections. Model providers have increasingly restricted exposure of such internal reasoning, but the advisory warns that prompts asking a system to reconstruct, explain, or narrate its reasoning can still generate useful training signals. The objective is not merely a correct final answer; it is a demonstration of how a high-end model approaches coding, planning, proofs, tool calls, and complex evaluation.
The detection problem is correlation, not a single bad prompt
The advisory’s most useful technical contribution is its insistence that model extraction has to be detected as a campaign. A request for code, a long stream of API calls, or a premium subscription consuming its quota is not inherently malicious. Large enterprises, research groups, and software companies can generate legitimately high and highly repetitive volume.
What separates the activity described by NSA, CISA, and FBI is correlation across accounts, providers, and time. The document identifies several behaviors that should move a provider from ordinary abuse monitoring to investigation:
- Newly created subscriptions that immediately operate at or near maximum capacity can indicate prebuilt automation rather than normal user adoption.
- Shared accounts appearing from multiple IP addresses, user agents, or locations may show account-pool operations, especially when they sustain around-the-clock activity without normal human idle periods.
- Near-identical prompts issued at high volume across otherwise separate accounts can point to centrally orchestrated capability collection.
- Sudden changes in account metadata after a provider disclosure or enforcement action can show that an operator is actively adapting to shared intelligence.
- Synchronized movement across native APIs, cloud endpoints, aggregators, and relays can expose unified request routing that a single provider would otherwise mistake for unrelated customers.
The report maps much of this behavior to MITRE ATLAS, the framework for adversarial threats to AI systems. That is a useful operational choice. Security teams already use ATT&CK-style thinking to connect resource development, initial access, execution, collection, exfiltration, and impact. The model-extraction equivalent is less about malware on a workstation than it is about an attacker acquiring infrastructure, creating accounts, probing a model, extracting responses, validating quality, and feeding the collected outputs into another training pipeline.
For AI providers and cloud platforms, this means telemetry must retain enough detail to support retrospective correlation. Inputs, outputs, account creation signals, payment instruments, IP history, API key behavior, user-agent changes, quota exhaustion, model selection, and blocking events may all be needed to establish a pattern. Logging only errors and billing totals will not show whether an actor simply changed routes after enforcement.
Response degradation is powerful—and risky
The agencies recommend rate limits, identity verification, authenticated API access, behavioral monitoring, telemetry logging, and red-team exercises. Those controls are familiar. Their more controversial proposal is to quietly alter responses for high-confidence suspected extraction activity.
The advisory suggests responding to suspected distillers with less capable models, reduced reasoning depth, output variation, redaction, or differential-privacy techniques. The theory is straightforward: if the collector cannot distinguish degraded outputs from normal model variation, the data becomes less useful for training and the economics of the operation worsen.
This is closer to active defense than standard abuse prevention. It may be effective against an automated pipeline that relies on consistent quality, but it introduces a real operational hazard: false positives could quietly downgrade service for a legitimate customer. A research lab conducting high-volume model evaluation, a large software company stress-testing coding agents, or an enterprise running batch document analysis could exhibit some of the same patterns.
The advisory acknowledges this indirectly by limiting the recommendation to high-confidence malicious distillation activity and by saying third-party evaluators and AI-safety researchers should be informed when a model response has been changed. That limitation should be treated as a requirement, not a footnote. Providers contemplating silent degradation need a documented confidence threshold, a review process, a mechanism to appeal enforcement, and a way to prevent enforcement logic from becoming a hidden reliability failure for paying customers.
For enterprise IT teams, silently altered output has a separate implication. If a company builds business processes around a third-party model API—code generation, security triage, knowledge retrieval, document handling, or support automation—it should already monitor output quality, latency, and model-version changes. The advisory makes that discipline more important. An unexplained shift in output quality may be a service regression, a model update, a safety intervention, or a provider’s targeted abuse-control measure.
What enterprise AI teams should do now
The federal guidance is primarily aimed at U.S. model providers, cloud platforms, and aggregators. A Windows administrator using a commercial chatbot is not expected to identify a foreign distillation campaign. But enterprise teams that expose an internal AI endpoint, operate an Azure-hosted model gateway, resell model access, or build agents on top of external APIs should treat model extraction as part of their abuse-prevention program.
Start with the basics that are frequently skipped during AI rollouts: require strong identity controls for external API users; issue individually attributable API keys; separate development, test, and production access; apply per-tenant and per-key quotas; and retain request telemetry long enough to investigate coordinated activity. Avoid allowing broadly shared “team” credentials to make high-volume calls from unbounded environments.
Teams should also establish baselines before an incident. Know what ordinary usage looks like for each workload: request volume, prompt similarity, working hours, model mix, cache behavior, token consumption, and rate-limit collisions. Without that baseline, an operation that distributes activity over many accounts will blend into normal growth.
Most importantly, do not try to solve a multi-provider collection problem with one provider’s logs. The NSA, CISA, and FBI advisory’s clearest conclusion is that the alleged campaigns depend on fragmentation. Model vendors, cloud hosts, API gateways, payment-risk teams, and aggregators need a lawful mechanism to share behavioral and infrastructure indicators when they detect coordinated abuse.
The practical consequence is uncomfortable but plain: frontier AI services now need the same cross-platform fraud and threat-intelligence discipline long used to counter botnets, credential abuse, and payment fraud. Rate limits remain necessary, but the reported operations are designed to route around them.