Story perspectives

NSA, CISA, FBI Accuse Six Chinese AI Firms of Distillation

By Drooid · Sep 11, 2026, 2:58 PM UTC · How we work

Summary

US Agencies Accuse

The NSA, CISA and FBI accuse six Chinese AI firms of industrial-scale model distillation.
The firms named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.
Investigators say campaigns began late 2024, using billions of tokens and fake accounts with proxies.
U.S. agencies warn the extraction could enhance China’s military, cyber and intelligence capabilities.
China’s Ministry of Commerce called the allegations groundless and an example of U.S. tech hegemony.

Summary

Claude Exploited

Anthropic reported a Chinese user asked Claude how to modify avian-influenza virus to infect mammals.
A Changsha-based student duo used Claude as an exploit foundry, generating over 10 zero-day candidates in a month.
The advisory lists detection signals such as 24/7 API usage and mismatched subscription-to-usage ratios.
It recommends silently feeding degraded answers to suspected distillation accounts to thwart extraction.

History

Historical Context

Operation Aurora, a 2009 cyber-espionage attack, breached several U.S. technology firms by employing spear-phishing, SQL injection and remote-administration trojans. Investigators traced the intrusion to China’s People’s Liberation Army Unit 61398, showing the extensive resources a state actor can deploy. The incident exposed critical network weaknesses and accelerated U.S. attention to cyber-defense.

1 of 3

US Agencies Accuse

The NSA, CISA and FBI accuse six Chinese AI firms of industrial-scale model distillation.
The firms named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.
Investigators say campaigns began late 2024, using billions of tokens and fake accounts with proxies.
U.S. agencies warn the extraction could enhance China’s military, cyber and intelligence capabilities.
China’s Ministry of Commerce called the allegations groundless and an example of U.S. tech hegemony.

1 / 3