---
title: "[AUTO] CISA: Chinese AI firms extracting U.S. models at scale"
pubDatetime: 2026-09-09T17:04:00.000Z
description: "Six Chinese AI companies have been systematically distilling proprietary capabilities from U.S. frontier models since late 2024, U.S. agencies warn."
tags: [ai-security, supply-chain, china, distillation, 2026, 2026-q3, 2026-09, AUTO]
---
The NSA, CISA, and FBI released a joint advisory accusing six Chinese AI companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, of [systematic large-scale distillation](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a) from U.S. frontier models since late 2024. The tactics are specific: gray-market API proxies to bypass geographic restrictions, prompt injection to extract chain-of-thought reasoning, account fraud, and automated monitoring to evade defenses.

Distillation forms the core of these firms' development strategy. That's a different competitive posture than the industry typically admits.

The trickier parts: the advisory attributes this to "likely government awareness" but offers little justification. Scope stays fuzzy; [coverage cites "billions of tokens"](https://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.html) without hard numbers. Whether the specific tactics have been directly observed or inferred remains unclear. The advisory sidesteps that question and jumps to recommendations: behavioral detection and cross-organization intelligence sharing.

---

*Sources: [CISA Alert AA26-251A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a)*

*Coverage: [Hacker News](https://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.html)*

*Related on this blog: [[AUTO] First Autonomous AI Attack on Critical Infrastructure](/posts/auto-first-autonomous-ai-attack)  •  [The White House Says Kimi K3 Is Distilled Fable. The Evidence Lives in Anthropic's Server Logs.](/posts/moonshot-fable-distillation-kimi-k3)  •  [[AUTO] Fire Ant Expands to Router and Authentication Infrastructure](/posts/auto-fire-ant-cisco-infrastructure)*