NSA, CISA and FBI Name DeepSeek and Five Other Chinese AI Firms Over Industrial-Scale Distillation

For the first time, America's top security agencies put model distillation into a formal cyber advisory, along with a sly recommendation for AI providers: don't ban suspicious accounts, just feed them a dumber model.

Three key facts

On September 8, the NSA, CISA and FBI issued joint advisory AA26-251A naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It says the firms have run industrial-scale distillation against US frontier models since late 2024, extracting billions of tokens over millions of exchanges from multiple versions of Anthropic's Claude, OpenAI's GPT, Google's Gemini and xAI's Grok.

The advisory describes proxy networks juggling tens of thousands of fake accounts at once. Targets varied: Moonshot AI focused on agentic reasoning, tool use, coding and computer-use agents, while MiniMax went after chain-of-thought reasoning, reinforcement learning and software engineering. It also notes DeepSeek's claimed $5.6 million training cost leaves out what the distilled data was worth.

The mitigations are the eye-catcher. Red flags include 24/7 usage with no human idle periods, new subscriptions maxing out immediately, accounts shared across many IPs, and odd subscription-to-API ratios. Providers are advised to answer suspected distillation with "downgraded" models and to avoid telling the users.

WangDou's Take

Distillation has been an open secret for years. The news is that Washington just promoted it from a terms-of-service spat to a national-security matter, with the NSA's name on it. The "quietly downgrade them" advice paints a vivid picture: you're hammering an API at 3 a.m., the model suddenly gets dumber, and you'll never know whether your prompt got worse or you got flagged as a spy. The catch is that "runs 24/7," "maxes out on day one" and "shared across IPs" describe basically every AI startup running agents. Serious distillation crews will rotate proxies and slip through; paying developers eat the collateral damage. And dragging out DeepSeek's $5.6 million training figure again tells you this advisory has a second audience: investors, who are being told the "cheap can catch up" story left part of the bill off the page.

Source: Unite.AI · Quartz · NSA/CISA/FBI advisory