Loading story…
The NSA, CISA, and FBI issued a joint advisory alleging that China-based AI companies have systematically extracted proprietary capabilities from U.S. frontier models since late 2024. The advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, alleging campaigns targeting variants of Anthropic Claude, OpenAI ChatGPT, Google Gemini, and Grok.
The agencies said the companies allegedly generated billions of tokens and millions of model interactions through unauthorized or obscured access, distributing requests across accounts, APIs, cloud providers, aggregators, proxies, and gray-market services to evade safeguards and attribution. They characterized the activity as part of China’s AI-development strategy and urged AI developers, government agencies, and allied partners to improve detection, adjust response measures, and share threat intelligence.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Google's Threat Intelligence Group reported that threat actors were increasingly targeting proprietary AI models, source code, model weights, and cloud-compute quotas.
Anthropic said it detected and disrupted six illicit Claude-distillation campaigns by China-based AI labs since February 2026, including a 151-million-exchange Alibaba-affiliated operation and campaigns attributed to Moonshot, DeepSeek, Zhipu/Z.ai, Xiaomi, SenseTime, and MiniMax. It said it responded with account restrictions and identity verification, summarized internal reasoning, and protections against reasoning-context manipulation.
A purported Anthropic threat-intelligence report alleged that seven PRC-based AI labs ran Claude-distillation campaigns from December 2025 through August 2026. It alleged that DeepSeek and Moonshot routed customer prompts to Claude Opus without users' knowledge while extracting reasoning-related outputs, using fraudulent accounts, proxies, compromised API keys, and cross-session replay techniques.
OpenAI accused DeepSeek of conducting model distillation to extract capabilities from its models.
U.S. agencies allege that China-based AI companies began industrial-scale campaigns to extract proprietary capabilities from U.S. frontier AI models in late 2024, using billions of tokens and millions of interactions.
Chinese Foreign Ministry spokesperson Mao Ning rejected U.S. allegations that Chinese AI companies maliciously copied U.S. AI technology through model distillation. She said China's AI progress resulted from domestic scientific and technological self-reliance and called on the United States to stop what China characterized as false accusations and smears.
The NSA, CISA and FBI issued a joint advisory alleging that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI systematically targeted Claude, ChatGPT, Gemini and Grok models through APIs, cloud providers, aggregators, proxies and other routes. The advisory recommended enhanced detection, response controls and intelligence sharing among government, industry and allies.
White House Office of Science and Technology Policy Director Michael Kratsios publicly accused Moonshot AI of attempting to extract proprietary functions from Anthropic's Fable model.
Anthropic reportedly made similar accusations concerning Chinese activity intended to distill capabilities from its AI models.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
17 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceitpro.com
Open sourcethecybersecguru.com
Open sourcetechrepublic.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The White House has accused China-linked actors and other foreign entities of running **industrial-scale AI model extraction and distillation campaigns** against U.S. frontier AI companies, saying the operations use tens of thousands of proxy or fraudulent accounts, jailbreaking techniques, distributed probing, and iterative prompt engineering to copy proprietary model behavior at scale. A memorandum from Office of Science and Technology Policy Director Michael Kratsios said the activity targets American AI innovation without requiring a traditional network breach, and warned that derivative systems may reproduce benchmark performance while stripping away safety controls, neutrality safeguards, and other protections built into the original models. Federal agencies have been directed to expand information sharing with AI firms and develop best practices for detecting, mitigating, and remediating the campaigns, with officials pointing to stronger telemetry, logging, identity controls, and real-time detection of distributed abuse as likely defenses. The administration is also weighing accountability measures, including possible sanctions and legal or export-control actions, while lawmakers advance legislation to identify and punish foreign actors targeting U.S.-owned AI models; China has rejected the allegations as "slander" and unjustified suppression, even as prior claims from OpenAI and Anthropic tied Chinese firms including **DeepSeek**, **Moonshot**, and **MiniMax** to large-scale distillation efforts.
Jun 29, 2026
Anthropic accused Alibaba and its **Qwen** research division of illicitly accessing its Claude models in what it called the largest known AI distillation attack against the company. In a letter to the U.S. Senate Banking Committee, Anthropic said operators used nearly **25,000 fraudulent accounts** to generate more than **28.8 million** Claude exchanges between April 22 and June 5, targeting high-value capabilities from the **Mythos Preview** model, including software engineering and agentic reasoning. The company said the activity was designed to replicate frontier-model performance without incurring the full cost of training a competing system. Anthropic warned that adversarial distillation can transfer advanced capabilities while omitting the original model’s safety guardrails, raising both security and national security concerns beyond intellectual property theft. The company linked the alleged operation to a broader pattern involving other Chinese AI labs, including **DeepSeek**, **Moonshot AI**, and **MiniMax**, and called for antitrust-safe threat intelligence sharing, continued AI chip export controls, and penalties for firms found to have improperly used U.S. model outputs. The disclosure has also spurred proposed U.S. legislative action, including potential sanctions or blacklisting of Chinese companies accused of training rival systems on unauthorized American AI outputs.
Jul 12, 2026
Chinese military- and state-linked researchers used outputs from advanced Western AI models, including systems from OpenAI and Anthropic, to train smaller domestic models for defense and security applications, according to reviews of more than 80 Chinese academic papers and patent filings. The reported work is tied to the People’s Liberation Army, the National University of Defense Technology, the Academy of Military Sciences, PLA Unit 96941, the North University of China, and other defense-affiliated institutes, with claimed use cases spanning battlefield hardware, naval warfare, unmanned systems, surveillance, public-security platforms, and cyber operations. The published research describes **model distillation** aimed at reproducing reasoning capabilities in cheaper edge-deployable systems, alongside efforts to bypass safeguards, remove watermarks, and obscure model provenance. Reported experiments also included multimodal prompt-injection techniques that hid instructions inside images of tanks and warships, while proposed cyber uses covered threat analysis, malware detection, intelligence collection, and social-media monitoring. The findings highlight a potential export-control gap because restricting advanced chips does not stop access to model outputs through APIs or leaked responses, although the evidence cited comes from papers and patents rather than confirmed operational deployments.
Aug 5, 2026