Turns out "great minds think alike" isn't quite the explanation when six Chinese AI companies all happen to develop suspiciously Claude-and-GPT-shaped capabilities. The U.S. government has a different word for it, and it starts with "distillation" and ends with a formal advisory.

An Advisory With Receipts

On September 8, the NSA, CISA, and FBI published a joint advisory accusing six Chinese AI firms — Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun, and Z.AI — of running "industrial-scale" distillation campaigns against U.S. frontier models. The agencies say these companies extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini, and Grok since at least late 2024.

Distillation itself is a normal, widely used AI training technique — a "student" model learns from a more capable "teacher" model's outputs. What makes this advisory notable is the alleged method: bypassing geographic restrictions, violating terms of service, and routing requests through fraudulent accounts and API proxy "transfer stations" specifically to dodge detection. DeepSeek, the advisory claims, targeted specific knowledge domains to extract reasoning capabilities and cut its own compute costs; Alibaba is accused of distilling Claude and GPT-5 in late 2025 to boost its Qwen models.

The Moat Was Made of API Calls

This lands right where AI companies are most nervous: the assumption that a frontier model's edge is protected because it's expensive to train from scratch. Turns out you don't need to train from scratch if you can quietly ask the finished model a few hundred million questions and learn from the answers.

For everyone else, the real takeaway isn't geopolitical scorekeeping — it's a reminder that "model provider terms of service" is doing a lot of unglamorous security work most businesses never think about. If a nation-state-scale operation can route around usage restrictions with proxy accounts, the access controls on your own AI integrations deserve a second look too.

Nothing kills a competitive moat faster than an API key and a lot of patience.

If your business is wiring AI models into real workflows and you want that integration built with proper access controls from day one instead of bolted on after an incident, let's talk about how we approach it.

Source: CISA