The NSA, CISA, and FBI have jointly named six Chinese artificial intelligence companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—as perpetrators of industrial-scale attacks on US frontier models. The agencies allege these firms have been extracting proprietary capabilities from leading American systems, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024. This coordinated effort, likely conducted with Chinese government awareness, aims to slash development timelines and save billions in training costs by distilling knowledge directly from established US models rather than building from scratch.
The theft isn’t subtle. Attackers exploit inference APIs by purchasing swarms of fake accounts through gray-market proxies to bypass geographical restrictions. These fraudulent networks execute millions of highly coordinated queries using identical or similar prompts to map out model behaviors. More aggressively, they employ prompt injection techniques to jailbreak systems, forcing models to reveal hidden chain-of-thought reasoning. DeepSeek, for instance, reportedly used prompts that instructed models to articulate their internal logic step-by-step, effectively handing over the intellectual property behind their responses.
US officials are calling for immediate, coordinated action across the American AI ecosystem to combat what they describe as aggressive and malicious distillation activities. They urge domestic firms to collaborate with allies to detect sophisticated campaigns that route requests through multiple pathways. However, the recommended mitigations come with a catch. Strengthening security against these large-scale extraction attempts may frustrate legitimate users, as stricter detection methods could limit access or complicate interactions with AI services.
This accusation marks a significant escalation in the tech cold war, moving beyond hardware export controls to direct allegations of intellectual property theft in software. While the agencies provide detailed technical descriptions of the attack vectors, the claim of state awareness raises the stakes for diplomatic and economic retaliation. If proven, this systematic distillation could erode the competitive moat that US companies have built through massive capital investment, potentially reshaping the global balance of AI power without the corresponding R&D spend.
