A joint warning from the NSA, FBI, and CISA has moved a previously technical term to the center of AI policy: knowledge distillation. The U.S. agencies accuse several China-based AI companies of extracting capabilities from leading American models at scale through access interfaces. Beijing rejects the allegations. For users and businesses, the more immediate question is what this means for access to powerful AI services.
The September 8, 2026 warning is not an independent judicial finding. It is a Cybersecurity Advisory from three U.S. agencies, and therefore a substantial account of their own assessment, but also an attribution made in a political context. That is precisely why its technical indicators and the disputed allegations need to be kept separate.
Key takeaways
- The NSA, FBI, and CISA describe industrial-scale distillation: millions of requests allegedly turned protected U.S. model capabilities into training data.
- Distillation is not inherently improper; the warning says the issue is bypassing access rules, obscured accounts, and automated querying at scale.
- The agencies name DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun, and Z.AI; China calls the accusations groundless.
- For model providers, abuse detection is becoming part of product architecture, not merely a terms-of-service question.
What distillation actually means
In knowledge distillation, a smaller or cheaper model learns from the answers of a more capable teacher model. It is an established research technique: rather than learning only from raw text, a model can learn patterns in structured answers, evaluations, or solution methods. The technique can save compute and does not automatically amount to an attack on another system.
The boundary is crossed when providers limit access and queries are deliberately organized to evade those limits. The U.S. warning describes account pools, API intermediaries, cloud access, and so-called transfer stations. These intermediaries are alleged to obscure origin and usage patterns. The claimed scale is critical: this is not about individual experiments but about sustained, coordinated data collection using highly similar prompts.
What may be especially valuable is not just general answers but behavioral patterns: how a model reviews code, selects tools, or evaluates multi-step tasks. That helps explain why providers increasingly avoid exposing their full internal reasoning. Our report on OpenAI’s automated research intern already showed how much agent progress depends on the combination of model, tools, and evaluation.
The allegations and the response
The advisory names several Chinese companies and alleges that campaigns have operated since at least late 2024. According to the agencies, billions of tokens were extracted through millions of requests from variants of Claude, GPT, Gemini, and Grok. The agencies also say this likely occurred with Chinese government awareness. These are serious claims that the advisory documents and interprets, but they have not been resolved in a public court proceeding.
China’s Commerce Ministry rejected the account as unfounded, according to the Associated Press. It said distillation is a common practice worldwide, including in the United States, and accused Washington of double standards. The named companies initially did not comment to AP. That response does not make API abuse technically impossible. It does show why a security warning should not be treated as a final judgment about individual companies.
Why this is a security issue for every provider
The advisory’s most useful lesson is its list of indicators. Newly created accounts that immediately run at maximum capacity around the clock, large numbers of nearly identical requests, shared payment paths, and rapid switching among intermediaries can point to automated collection. None of those signals proves abuse on its own. Patterns become meaningful only when they are correlated across providers and platforms.
That creates a tension. Developers need open, dependable interfaces, and research teams often test models intensively at high frequency. Overbroad blocks can also harm small businesses, universities, and international customers. Strong safeguards therefore need more than throttling: they should explain decisions, allow appeals, and be as precise as possible. This aligns with the recent debate about controlling capable agents. In the Toby Ord case, the central question is how control works when systems perform many steps on their own.
Outlook: Access becomes strategic infrastructure
Whether the specific U.S. allegations hold up in every detail will depend on further evidence and responses. Regardless, the operating reality of AI models is changing. API access is no longer only a sales channel; it is part of the security boundary around data, capabilities, and cost. Providers will expand usage analysis, tiered access, and coordination with cloud and payment services.
For customers, this is not merely an abstract security-policy story. Tighter controls can affect limits, identity checks, and regional availability. The key will be preventing protection from turning into opaque blanket blocks. Trustworthy AI infrastructure must be able to identify abuse without placing legitimate research and productive users under blanket suspicion.