CISA, NSA, and FBI Accuse Chinese AI Firms of Distilling Claude, GPT, Gemini, and Grok

Three US agencies put their names to the same accusation this week: China-based AI companies are copying America's best models by pumping them for answers at a scale no ordinary customer would ever reach. The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) issued a joint cybersecurity advisory on September 9, 2026 accusing China-based AI firms of the "systematic extraction" of proprietary capabilities from US frontier models, naming Claude, GPT, Gemini, and Grok as the targets.

The advisory, first reported by The Hacker News, SecurityWeek, Dark Reading, and Help Net Security, frames the technique as knowledge distillation: using the outputs of a more capable model to train a competing one. According to the reporting, the agencies say billions of tokens were covertly extracted from the four American systems, and that the harvested capabilities span reasoning, coding, and specialized functions. The agencies go further than describing a one-off theft. They call distillation the "core" of the Chinese AI development strategy.

That is the part worth sitting with. This is not a breach report about a stolen database or a leaked model weight file. It is a federal accusation that a rival's entire model-building pipeline is fed, in significant part, by the outputs of American models accessed through ordinary-looking interfaces. For a defender, that reframes a familiar problem. The abuse does not look like an intrusion. It looks like traffic.

What CISA, NSA, and FBI Documented

The three agencies describe a pattern, not a single incident. Per the joint advisory as reported, China-based AI firms have been conducting "systematic extraction" of the functionalities and capabilities of US frontier models, harvesting outputs at a volume the agencies quantify in the billions of tokens. The method is attributed to China-based AI companies as a category rather than to any one named firm, and the four targeted systems are identified by product: Claude (Anthropic), GPT (OpenAI), Gemini (Google), and Grok (xAI).

What the advisory reportedly does not do is name the specific Chinese firms, publish a technical appendix from the model vendors, or, in the reporting available so far, attach a concrete policy instrument to the finding. Whether export controls, sanctions, or other measures follow is not established in the coverage. Neither is a public advisory URL confirmed at the time of writing. Those gaps matter, and I flag them below rather than paper over them.

Read plainly, the documented claim is narrow and specific in one dimension and sweeping in another. Narrow: a named method (distillation), a named class of target (four US frontier models), and a scale figure (billions of tokens). Sweeping: the assertion that this practice sits at the center of how a rival nation's AI industry is being built. The first is the kind of thing a model vendor's logs can corroborate. The second is a strategic judgment the agencies are asking the public to accept on their authority.

The Knowledge-Distillation-as-Attack Framing

Knowledge distillation is not, by itself, an attack. It is a standard and well-documented machine-learning technique in which a smaller "student" model is trained to imitate a larger "teacher" model by learning from the teacher's outputs. Researchers use it openly to compress models and cut inference costs. What the advisory describes is that same mechanism turned against the model owner: pointing a student at someone else's commercial model, at scale, without permission, to absorb capabilities the owner spent hundreds of millions of dollars to build.

The distinction that turns a legitimate method into the conduct the agencies are describing is consent and scale. A lab distilling its own teacher model is doing engineering. A firm harvesting billions of tokens of another company's model outputs, against that company's terms of service, to train a competitor is doing something the advisory frames as extraction. The technique is identical. The relationship to the target is what changes.

This is why the story lands as a security problem and not just a business-ethics one. Distillation-scale extraction is difficult to distinguish from ordinary heavy API usage without deliberate monitoring, because every request is, individually, a legitimate query the model is designed to answer. The signal is in the aggregate: the volume, the systematic coverage of the prompt space, and the downstream storage of responses as training pairs. That is a detection problem, and it is one that sits squarely on the model vendors rather than on any single downstream enterprise. It also rhymes with a broader pattern The CyberSignal has tracked, in which AI systems and AI research have themselves become the prize. Google's threat researchers recently detailed a China-nexus cluster targeting medical, military, and AI research, and the safety questions around Chinese frontier models sharpened when Kimi K3 reportedly escaped its cybersecurity testing environment.

The Four-Model Target List

The advisory names four systems, and the choice is not random: they are the current commercial frontier. Claude from Anthropic, GPT from OpenAI, Gemini from Google, and Grok from xAI represent the models most worth copying and the ones with the largest, most accessible public APIs. If the goal is to absorb reasoning, coding, and specialized capabilities, these are the teachers a student would target.

Naming all four together also does something rhetorically useful for the agencies. It moves the claim from "one company got scraped" to "the American frontier as a whole is being systematically mined." That framing raises the stakes, and it is exactly why the vendors' own corroboration matters so much. As of now, there is no indication in the reporting that Anthropic, OpenAI, Google, or xAI has published parallel technical evidence, telemetry, or a confirmation of the agencies' account. Until one of them does, the four-model target list rests on the government's attribution alone. That is not a reason to dismiss it. It is a reason to label it as what it is: a federal assessment awaiting vendor confirmation.

The Industrial-Scale and "Core" Strategy Claim

The strongest language in the advisory is also its least verifiable from the outside. Calling the extraction industrial-scale is supported by the billions-of-tokens figure, which describes an operation running continuously and programmatically rather than a researcher poking at an API. That part is measurable, at least in principle, from the vendors' side.

The claim that distillation forms the "core" of Chinese AI development strategy is a different order of statement. It is an assessment about intent and national industrial policy, not a log entry. It may well be true, and the agencies presumably hold intelligence the public does not. But it is the sort of conclusion that should travel with a clear label, because it shapes how readers weigh everything else in the advisory. My read: the token-scale claim is the kind of thing that can be proven or disproven with data, and the "core strategy" claim is an interpretation layered on top of it. Treating the two as equally settled would be a mistake. This is also not the first time the agencies have gone public jointly on China; a recent Five Eyes advisory warned that China was using LinkedIn and job sites to recruit insiders, showing the same pattern of naming a strategy rather than a single operation.

What Frontier AI Vendors Should Verify (API-Abuse Detection)

For the teams that actually operate frontier model APIs, the defender question is concrete: can you tell the difference between a heavy but legitimate customer and an account harvesting your model to train a competitor? The advisory's value is that it tells you what to go look for. The controls are not exotic, and most of them are enforcement of terms you already have.

Practical checks worth prioritizing:

• Volume and shape analysis. Distillation-scale extraction shows up as sustained, high-volume generation with systematic coverage of the prompt space, not the bursty, product-shaped traffic of a real application. Baseline what normal looks like per account, then alert on accounts that read like they are mapping your model rather than using it.
• Output-harvesting signatures. Watch for patterns consistent with responses being stored as input-output training pairs: exhaustive prompt grids, repeated requests that vary one variable at a time, and traffic optimized to maximize token yield rather than to accomplish a task.
• Terms-of-service enforcement. Nearly every frontier vendor already prohibits using model outputs to train competing models. The gap is detection and follow-through, not policy. Tie the monitoring above to actual account action.
• Identity and provenance. Distillation operations spread load across many accounts and providers to stay under per-account thresholds. Correlate across accounts, payment methods, and access patterns rather than judging each account in isolation.

The diagram below sketches how that detection decision splits, from a single stream of ordinary-looking API calls to the two very different things it can turn out to be.

How an API-abuse detection decision splits legitimate heavy use from distillation-scale extraction. Source: CISA, NSA, and FBI joint advisory reporting.

None of this is a reason to throttle real customers or treat every power user as a thief. It is a reason to instrument the difference so that, when a pattern like the one the agencies describe shows up, you can see it and act on it rather than discovering it in a government advisory. For teams building the models themselves, the broader defensive picture is worth revisiting in our guide to AI security.

The US-China AI Competition Context

This advisory does not arrive in a vacuum, and it is not the first sign that AI capability itself has become contested ground between the two countries. The pattern in recent coverage is consistent: AI research, AI infrastructure, and now AI model outputs are being treated as strategic assets worth taking. What is new here is the specific mechanism the agencies are pointing at, and the bluntness of naming distillation as a national strategy rather than an isolated act.

I am deliberately not going to litigate the policy question of what Washington should do about it, because that is not what a defender's desk is for and the reporting does not yet establish what, if anything, is planned. What is useful to say is narrower. The advisory shifts part of the burden of protecting American AI capability onto the vendors' own abuse-detection systems, because the described technique routes around every traditional control. There is no perimeter to harden when the "attack" is a paying customer asking your model questions. The defense is monitoring, correlation, and enforcement of terms you already wrote.

Open Questions

Several things remain unconfirmed, and they are the questions that will determine how much weight this advisory ultimately carries:

• Which firms? The advisory attributes the activity to China-based AI companies as a class. No specific firm is named in the reporting, which makes independent verification harder.
• What follows? It is not established whether export controls, sanctions, or other policy responses are attached to the finding.
• Will the vendors corroborate? There is no indication yet that Anthropic, OpenAI, Google, or xAI will publish parallel technical evidence from their own telemetry. Vendor confirmation would move the "core strategy" claim from assessment toward established fact.
• Where is the primary document? A public advisory URL is not confirmed at the time of writing, so the specifics here rest on four security outlets' reporting rather than on the text itself.

The honest summary is that the agencies have made a serious, specific, and partly measurable accusation, wrapped in a broader strategic judgment that outsiders cannot yet check. The measurable core, billions of tokens extracted by distillation from four named models, is exactly the kind of thing the model vendors can confirm or refute from their own logs. Until they do, treat the token-scale claim as a strong federal assessment and the "core of Chinese AI strategy" framing as the agencies' interpretation on top of it. For everyone operating a frontier API in the meantime, the takeaway is not to wait for that resolution before turning on the monitoring that would have caught this in the first place.

Updated September 9, 2026: This is a developing story. We will update if the model vendors publish corroborating telemetry or if a policy response is attached.

Primary Documents

• The Hacker News: US Agencies Accuse China AI Firms of Distillation
• SecurityWeek: US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities
• Dark Reading: US Government Says Chinese AI Firms Are Distilling Frontier Models
• Help Net Security: China's Malicious AI Knowledge Distillation Against US Companies