US says Chinese firms extracted billions of tokens from frontier AI models
Chinese firms accused of stealing billions of AI model tokens via industrial-scale distillation attacks.
Summary
US intelligence agencies have identified six Chinese AI companies engaging in industrial-scale "distillation attacks" against American frontier AI models. These firms, including DeepSeek and Moonshot AI, allegedly extracted billions of data tokens by making millions of API requests, significantly reducing their own AI development costs and timelines. The US government suspects Chinese government awareness of these operations, which leverage sophisticated techniques to bypass security measures.
Full text
US says Chinese firms extracted billions of tokens from frontier AI models By Bill Toulas September 9, 2026 12:48 PM 0 U.S. cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. A joint advisory from CISA, NSA, and the FBI states that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens through millions of requests from frontier AI models from Anthropic, OpenAI, Google, and xAI. The agencies assess that the scale and sophistication of the operations indicate Chinese government awareness, mentioning that this approach is likely a core development strategy for the offending firms. AI model distillation is a legitimate technique in which a “student” model learns from the outputs of a well-trained model, helping researchers and developers reduce training costs and speed up AI deployment. However, as Google warned in February, distillation attacks can occur outside these companies’ controlled environments, abusing API access to extract the knowledge and logic of powerful models and compete with them at a fraction of the training cost. CISA’s advisory explains that Chinese firms distribute API requests across fraudulent or shared accounts, APIs, cloud services, aggregators, and “transfer station” proxies to bypass geographic restrictions, usage limits, and detection. Some of the prompts used attempted to expose restricted chain-of-thought reasoning, while automated systems switched providers and checked whether defenders had degraded the responses. “Advanced industrial-scale distillation tactics include chain-of-thought (CoT) reasoning extraction, automated failover between pathways during blocking attempts, and sophisticated quality evaluation frameworks to detect defensive countermeasures,” the advisory explains. “China-based AI companies that conduct industrial-scale distillation against U.S. AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model.” DeepSeek and MoonShot AI were marked as the top offenders involved in distilling multiple Claude, GPT, Gemini, and Grok models, followed by MiniMax, which targeted Claude, Gemini, and GPT models. Alibaba and StepFun are accused of targeting Claude and GPT models to improve their products, while Z.AI allegedly targeted GPT-5.5 and Claude Opus 4.8. The advisory recommends that AI companies improve behavioral and infrastructure-level detection, modify responses when distillation operations are suspected, and share intelligence about these campaigns with all stakeholders. Potential indicators include new accounts immediately reaching maximum usage, continuous activity without normal human idle periods, shared accounts accessed from numerous IP addresses or user agents, identical prompts across multiple providers, unusually high subscription-to-usage ratios, and coordinated switching between access routes. BleepingComputer has contacted all six Chinese AI firms for a statement, and we will add their statements if we get them. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: CISA warns of hackers exploiting critical MLflow vulnerabilityOpenAI says GPT-6 Astra can find zero-days, but is also harder to monitorHackers build AI frameworks for widescale credential theftChatGPT can now connect to your personal apps to mimic writing styleChatGPT Astra is now rolling out to $20 Plus subscription