Actor Profile

Six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—are attributed by CISA, NSA, and FBI as conducting coordinated, industrial-scale AI model distillation attacks against U.S. frontier AI providers since late 2024. The agencies assess that the scale and sophistication indicate Chinese government awareness and that distillation represents a core development strategy for these firms. Motivation centers on reducing AI development costs and timelines by extracting knowledge from advanced models (Anthropic Claude, OpenAI GPT, Google Gemini, xAI Grok) to build competing systems at a fraction of normal training expenditure. DeepSeek and Moonshot AI are identified as the most prolific offenders, targeting multiple model families across providers.

TTPs (Tactics, Techniques, Procedures)

The campaign employs advanced distillation tactics including: distributed API abuse across fraudulent and shared accounts, cloud services, aggregators, and "transfer station" proxies to evade geographic restrictions and rate limits; chain-of-thought (CoT) reasoning extraction via crafted prompts designed to expose restricted model logic; automated failover mechanisms that switch providers and access pathways when blocking is detected; and sophisticated quality evaluation frameworks to identify defensive countermeasures such as degraded responses. Infrastructure obfuscation includes cycling through numerous IP addresses and user agents, and coordinating activity across multiple access routes. Relevant MITRE ATT&CK techniques include T1078 (Valid Accounts) for credential abuse, T1071.001 (Application Layer Protocol: Web Protocols) for API-based exfiltration, T1090 (Proxy) for transfer station infrastructure, and T1213 (Data from Information Repositories) for knowledge extraction.

Targets & Patterns

Primary targets are U.S.-based frontier AI model providers: Anthropic (Claude models), OpenAI (GPT models, including GPT-5.5), Google (Gemini models), and xAI (Grok models). The targeting pattern reflects strategic focus on the most advanced publicly accessible AI systems. DeepSeek and Moonshot AI demonstrated the broadest targeting, hitting all four providers. MiniMax targeted three providers (Anthropic, Google, OpenAI), while Alibaba and StepFun focused on Anthropic and OpenAI. Z.AI specifically targeted next-generation models (GPT-5.5, Claude Opus 4.8). The selection criteria appear driven by model capability and API accessibility, with attacks designed to compress years of R&D investment into accelerated development cycles for Chinese AI products. The technology sector is the exclusive target, with no evidence of attacks against other verticals.

Historical Context

AI model distillation is a legitimate machine learning technique, but Google publicly warned in February 2025 about adversarial distillation attacks abusing API access outside controlled environments. The CISA/NSA/FBI advisory represents the first formal U.S. government attribution of state-aware, industrial-scale distillation operations. The campaign timeline (late 2024 onward) coincides with China's push for AI self-sufficiency amid export controls on advanced chips and growing competition in the global AI market. This activity differs from traditional cyber espionage by exploiting intended API functionality rather than software vulnerabilities, representing an evolution in intellectual property theft tactics adapted to the AI era. No direct links to prior named campaigns are provided in available data.

Defensive Recommendations

  • Implement behavioral analytics to detect anomalous API usage patterns: new accounts immediately reaching maximum usage limits, continuous activity without normal human idle periods, and unusually high subscription-to-usage ratios
  • Monitor for infrastructure-level indicators including shared accounts accessed from numerous IP addresses or user agents, identical prompts submitted across multiple providers, and coordinated switching between access routes or aggregators
  • Deploy response modification techniques when distillation operations are suspected, such as degrading output quality or injecting noise to reduce knowledge transfer effectiveness
  • Establish intelligence-sharing mechanisms with peer AI providers to correlate attack patterns, shared infrastructure (transfer station proxies), and adversary tradecraft across the ecosystem
  • Implement chain-of-thought reasoning protections by detecting and blocking prompts designed to expose restricted model logic, and monitor for automated quality evaluation probes that test for defensive countermeasures

---

# Geopolitical Context

Geopolitical Context

The joint advisory from CISA, NSA, and FBI alleging industrial-scale AI model distillation by six Chinese companies represents a significant escalation in U.S.-China technology competition. The agencies assess that the scale and sophistication of operations—extracting billions of tokens from frontier models operated by Anthropic, OpenAI, Google, and xAI—indicate likely Chinese government awareness or coordination. This framing positions the activity not as isolated corporate espionage, but as part of a state-aligned strategy to accelerate China's AI development while circumventing the substantial computational and financial costs associated with training frontier models. The advisory arrives amid broader U.S. efforts to maintain technological advantage through export controls on advanced semiconductors and AI systems, and reflects growing concern that adversaries can leverage API access and distillation techniques to erode American AI leadership without direct network intrusion or traditional cyber espionage.

State Actor Alignment

The advisory explicitly states that U.S. agencies assess Chinese government awareness of these operations, characterizing distillation as "likely a core development strategy" for the named firms. While the document does not formally attribute the activity to the Chinese state, the language employed—combined with the joint issuance by intelligence and cybersecurity authorities—signals official U.S. assessment of state alignment or tacit endorsement. The six companies named (DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI) operate within China's regulatory environment, where major technology firms maintain close relationships with government industrial policy objectives. This incident may prompt consideration of sanctions, export restrictions on API access, or enhanced vetting requirements for accounts accessing U.S.-based frontier AI services. The advisory itself serves as a form of public attribution, likely intended to impose reputational costs and justify defensive countermeasures by U.S. AI providers.

Business Impacty pro region

For European allies and partners, this advisory underscores the vulnerability of AI-as-a-service models to systematic exploitation by state-aligned actors. European AI developers and cloud providers offering API access to advanced models face similar risks, particularly as the EU advances its own AI regulatory framework under the AI Act. The incident may accelerate transatlantic coordination on AI security standards, API access controls, and intelligence sharing regarding distillation campaigns. It also complicates Europe's efforts to maintain technological sovereignty while engaging with both U.S. and Chinese AI ecosystems. Countries participating in multilateral export control regimes may face pressure to extend semiconductor and compute restrictions to include API access governance. For the broader Indo-Pacific region, the advisory reinforces narratives around technology transfer concerns and may influence decisions by partners such as Japan, South Korea, and Australia regarding collaboration with Chinese AI firms and integration of Chinese-developed models into critical infrastructure.

Forecast

If U.S. AI providers implement the recommended behavioral and infrastructure-level detection measures, Chinese firms are likely to adapt their distillation techniques, potentially shifting to more sophisticated obfuscation methods or targeting smaller, less-monitored model providers. Should the U.S. government pursue formal sanctions or entity list designations against the named companies, bilateral technology tensions are likely to intensify, with potential Chinese countermeasures targeting U.S. firms operating in China. If European regulators adopt similar defensive postures, a fragmentation of the global AI services market along geopolitical lines becomes more probable. In the near term, expect increased scrutiny of API usage patterns, tightened account verification requirements, and potential rate-limiting or geographic restrictions by major AI providers. If evidence of state coordination becomes more explicit, this incident may serve as a precedent for treating large-scale distillation as economic espionage subject to diplomatic and legal responses beyond the cybersecurity domain.