On September 8, the NSA, CISA, and FBI published a joint advisory that deserves more attention than it's getting. Six China-based AI companies, named individually, spent roughly two years extracting capabilities from U.S. frontier models at what the agencies call "industrial scale." Billions of tokens. Millions of API exchanges. And a recommended countermeasure that quietly breaks one assumption most teams building AI workflows have been making all along.
What the Advisory Actually Says
The advisory, designated AA26-251A, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. According to the agencies, these companies pulled billions of tokens across millions of exchanges from Claude, GPT, Gemini, and Grok, using fraudulent accounts, bulk premium subscriptions, and proxy networks that mixed distillation traffic with normal queries to frustrate detection.
The specific examples are worth reading. Between late 2025 and early 2026, StepFun pulled from Claude Opus 4.1 and 4.5, Claude Sonnet 4.5, GPT-5 Mini, GPT-5 Pro, and multiple GPT-5 variants to improve coding and agentic functions in its Step 4 model. Z.AI distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 to build chain-of-thought reasoning capabilities. MiniMax ran over 13 million individual exchanges. A single proxy network operated more than 20,000 fraudulent accounts simultaneously.
The agencies state that these campaigns form "the core, not merely a supplement" of those companies' AI development strategy. That is a significant claim. It means these are not opportunistic scrapes. They are the primary R&D method.
The Part Worth Paying Attention To: Silent Degradation
The advisory's recommended mitigation is the detail most coverage has skipped. The agencies recommend that U.S. AI providers do not simply block accounts identified as conducting malicious distillation. They recommend quietly degrading responses instead.
The logic is defensive: if a suspected account suddenly gets blocked, the operators know they've been caught and adapt. If responses are degraded gradually, the operators may not notice, the distillation campaign collects lower-quality data, and the intelligence services can observe the operation longer.
That is a coherent counterintelligence strategy. It also means that any U.S. AI provider could, right now, be serving degraded responses to some accounts with high confidence of malicious activity, and those accounts have no indication that anything is wrong.
Here is where this becomes relevant to legitimate teams. A large corporate VPN, a shared cloud egress IP, a proxy service used by a development team for other purposes: any of these could theoretically share infrastructure with a flagged distillation campaign. If a provider's detection system is imprecise, legitimate accounts could be caught in the same degradation bucket. You would not get an error. You would get answers that are subtly weaker than what the model is actually capable of.
I am not saying this is happening at scale to legitimate users. The agencies presumably have fairly precise targeting. But "quietly degrade" as a policy means there is no user-visible signal when it applies, and that is a new category of risk to understand.
What to Do About It
For most teams running AI in production, this advisory changes a few things worth acting on:
Run your own baseline evals, regularly. Not to detect geopolitical targeting. But because if your AI integration's output quality shifts and you have no baseline to compare against, you will not notice. A monthly eval run against a fixed set of representative inputs gives you a reference point. If something changes in the model's behavior, you'll see it. This is good hygiene regardless of the silent-degradation scenario.
Don't assume a cheaper alternative is equivalent. The advisory is effectively a technical argument that the named companies built their models partly by extracting from U.S. frontier models. That may have helped them close a capability gap. It does not mean those models perform identically on your specific workloads. Run your own comparisons on your actual data before switching to any model, regardless of origin, to save on cost.
Diversify your model stack thoughtfully. Running a single model for every AI task in your workflow is a single point of failure, cost, and now policy risk. Routing different tasks to different models based on capability fit is good architecture anyway. This advisory adds another reason to avoid total dependency on any one provider.
Understand your API egress. If your team's API calls route through shared corporate infrastructure or a proxy, know what else routes through those same IPs. Not because you are a distillation campaign, but because network-level detection sometimes operates at the IP range rather than the account level.
DeepSeek Launches a New Model Today
The timing is striking. DeepSeek, the first company named in the advisory, announced V4.1 Flash with an official release on or around September 10, Beijing time. The model claims to comprehensively surpass its predecessor V4 Pro on performance, cost, speed, and total time. Pricing at launch is significantly lower than the current V4 Pro rate.
I am not going to tell you what to do with DeepSeek V4.1 Flash specifically. The advisory does not make a direct legal claim that using the model is off-limits for enterprise teams outside China. What it does do is put a documented claim on the table: that the model's capabilities were developed partly through unauthorized extraction from U.S. frontier models. Your organization's legal and security teams are the right people to evaluate what that means for your use case.
What I would say is: this is a good week to be more deliberate about which models you pick and why, rather than defaulting to "cheapest token" or "highest benchmark score" as the only evaluation criteria.
The Bigger Picture
The AI capability race is now operating on at least three tracks simultaneously: raw model performance, cost efficiency, and geopolitical infrastructure risk. A year ago, most practitioners only had to think about the first two. The CISA advisory makes the third one explicit.
The models that power support automation, document processing, email drafting, and ticket triage for teams like mine are not neutral infrastructure. They are the output of enormous R&D investments, and they are now at the center of a documented theft and counterintelligence operation. That does not mean stop using AI. It means know what you're building on.
If you run AI in production, run an eval suite this week. Pick a set of representative inputs for your most important use cases, log the outputs, and keep that log. In six months you will be glad you have it.
Sources
- CISA Advisory AA26-251A: China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns (September 8, 2026)
- CISA, NSA and FBI Warn of China-Based AI Companies Targeting U.S. AI Models (September 8, 2026)
- DeepSeek V4.1 Flash Release Date: Around September 10, New Pricing from the Same Day (CellCog)
- US Distillation Advisory: What AI Model Buyers Should Do (Digital Applied)
Running AI in production and want to talk through how to set up a baseline eval suite? Drop me a line.
Comments