TL;DR — On September 8, 2026, the NSA, CISA and the FBI named six China-based AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI — for running industrial-scale distillation campaigns against US frontier models since at least late 2024. The list of capabilities they allegedly harvested reads like an agent roadmap: agentic reasoning and tool use, computer-use development, chain-of-thought extraction. Two days later the accusation boomeranged. JoyIn, an Ant Group-backed humanoid robotics startup, published an open letter accusing OpenAI of distilling its robotics model and said it has begun legal proceedings. The interesting part is not who is right. It is that the standard of proof being used in public is now symmetric — and that the only defensible mitigation the US government offers is to quietly make your own model worse.
The advisory, in numbers
Advisory AA26-251A states that distillation campaigns “form the core—not merely a supplement” of the six companies’ AI development strategy, and that the extraction happened “likely with Chinese government awareness” (Source : CISA — China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies).
The scale is the argument. The agencies describe “billions of tokens across millions of exchanges/requests” drawn from variants of Claude, GPT, Gemini and Grok. DeepSeek’s campaign targeted reasoning, specialised optimisations and domain-specific functions for its R1 and V3 models; the advisory dismisses the company’s widely cited $5.6 million training cost as misleading because it excludes the data acquired through distillation. Moonshot AI is described as extracting significant Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2. Z.AI is said to have pulled billions of tokens of GPT-5.5 and Claude Opus 4.8 data by mid-2026 (Source : Unite.AI — NSA, CISA, FBI Warn China-Based AI Firms Distill US Frontier Models).
The mechanics are as much procurement as code: native APIs, remote cloud providers, third-party aggregators that strip metadata, bulk-bought premium subscriptions shared across developer teams, and grey-market proxies the advisory calls “transfer stations”. The four techniques it labels novel are regional restriction evasion combined with subscription exploitation, centralised request routing, automated metadata sanitisation, and systematic quota and cost optimisation. Detection indicators include shared accounts hitting from many IP addresses, round-the-clock usage with no human variation, and new subscriptions that immediately run at maximum capacity.
What the six labs actually took
For anyone building agents, the target list is the story. Moonshot’s reported campaigns aimed at agentic reasoning and tool use, coding and data analysis, and computer-use agent development. MiniMax is said to have redirected traffic to a new Claude model within 24 hours of its release.
That is not accidental. A long agent trajectory — plan, tool call, error, correction, final answer — is the most information-dense artifact a frontier API exposes. It contains the reasoning process, not just the answer. Copying a model’s chat answers teaches style; copying its agent traces teaches how it decomposes work. The advisory also flags jailbreak prompts designed to force models to reveal hidden chain-of-thought, which is the same target reached from the other direction.
The defense that taxes your users
The recommended response is where the advisory gets uncomfortable. Three actions are urged: detect anomalies, deploy “targeted response changes” for suspected distillation, and share intelligence across providers. The middle one means serving subtly degraded or differentially private answers to accounts flagged as distillers — and deliberately varying the degradation so the attacker cannot measure it. Providers are advised not to tell suspected users their outputs were altered, while still informing safety researchers (Source : CISA — Advisory AA26-251A).
That is poisoning as a defensive doctrine, and it has a bill. Agent systems treat API output as ground truth for planning and evaluation. If providers can silently degrade responses for accounts they suspect, then output integrity becomes probabilistic — and reproducibility of any third-party evaluation becomes contingent on a provider’s suspicion model. Every lab already bans distillation in its terms of service. The advisory is effectively an admission that a contract is not a firewall, and that the fallback is to make the product worse for everyone in order to make it less worth stealing.
The boomerang
Two days after the advisory, JoyIn CEO Guo Renjie published an open letter in Chinese addressed to OpenAI, claiming the US lab distilled his company’s robotics work: “People often say major tech companies have intelligence networks monitoring the whole internet, this time I believe it, this is a direct distillation of us without any modifications” (Source : CNBC — A Chinese humanoid startup flips ‘distillation’ claim on OpenAI).
The evidence offered is conceptual overlap, not copied weights. Guo points to shared framing around recursive self-improvement and using AI to optimise compute, says JoyIn presented its model framework in Silicon Valley weeks before OpenAI’s chief scientist published “An Alien Mind” on September 6, and notes that OpenAI’s GPT-6 Astra page shares a space-exploration aesthetic with JoyIn’s Aether site. His company has begun filing a lawsuit. CNBC could not independently verify the claims, noted that several of the concepts are generic AI research, and OpenAI did not comment.
JoyIn’s Aether is a perceptive rather than text-based control model, claiming first-attempt task success around 90% and training time cut by two thirds, led by an engineer who previously worked on humanoid imitation learning at Figure. The startup plans to open-source parts of it. Backed by Ant Group, JoyIn is using the vocabulary of American IP enforcement against an American lab — and the claim has the same shape as the government’s: similar concepts, therefore copying. That symmetry is the real news. Research vocabularies predate both companies, and idea similarity is not a legal test in copyright or trade secret law. But once resemblance becomes the public standard, every lab that reads the same papers and ships the same architecture is exposed to it.
FAQ
Is knowledge distillation illegal? No. Training a smaller model on a larger one’s outputs is a standard technique. The advisory targets unauthorised access, terms-of-service breach, and industrial-scale extraction — not the method itself.
What distinguishes the 2026 campaigns from ordinary API use? Infrastructure and scale: millions of exchanges, billions of tokens, metadata-stripping aggregators, grey-market proxies, bulk shared premium subscriptions, chain-of-thought extraction, and automated failover when one pathway is blocked.
Why does this matter to agent builders? Because the harvested capabilities are agentic — tool use, computer-use development, multi-step reasoning. Long agent trajectories leak more than answers, which is why lock-downs on chain-of-thought and rate limits hit legitimate agent workloads first.
Can the leak be stopped? Not cleanly. Attribution through proxies collapses into probability. The options are degrading outputs for suspected accounts, throttling the capabilities enterprises pay for, or competing on the next model instead of protecting the current one.
Further Reading
- CISA — Joint advisory AA26-251A (September 8, 2026)
- NSA — Press release on Chinese distillation of US frontier models
- CNBC — A Chinese humanoid startup flips ‘distillation’ claim on OpenAI
- Santage — NSA names six Chinese AI labs distilling US frontier models
- The Agent Report — Anthropic says Alibaba ran a Claude distillation attack
- The Agent Report — The White House puts Moonshot’s Kimi-K3 in the distillation crosshairs