The US distillation advisory could quietly change how AI providers treat heavy users

In brief

On 8 September the NSA, CISA and FBI published a joint advisory, AA26-251A, accusing six China-based AI companies of "industrial-scale distillation campaigns" against American AI models. The six are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. China's Commerce Ministry called the accusation "baseless" the next day. Anthropic followed with a report alleging that one of the six relayed hundreds of thousands of its own customers' requests to Claude.

The advisory is guidance, not an indictment or a sanction, and no such follow-up had been announced by 26 September. But it asks US AI providers to do something every heavy user should know about: detect suspected distillers and "subtly" alter the answers they receive, without telling them. That turns access to a frontier model into a security control, with consequences for legitimate customers as well as for the accused.

What the advisory says

Distillation means training a model on another model's outputs. It is a normal technique, and the advisory itself says it "is recognized as a legitimate and useful technique in AI research". The allegation is about scale, intent and terms of service. According to the agencies, the six companies are engaged in "aggressive, malicious, and targeted distillation activities at an industrial scale". The advisory calls distillation "the core – not merely a supplement – of their AI development strategy".

• Targets. Anthropic's Claude, OpenAI's GPT models, Google's Gemini and Grok, made by SpaceXAI (formerly xAI).
• Scale. "Billions of tokens" across millions of requests, from at least late 2024 to mid-2026.
• Methods. Grey-market API resellers the advisory calls "transfer stations", networks of fraudulent accounts, VPNs and obscured metadata, prompts designed to extract a model's chain of thought, and automatic failover between access routes.
• Recommendations to providers. Flag anomalies such as usage far out of line with a subscription, or new accounts that go straight to maximum use. "Subtly" alter responses to suspected distillation without alerting the actor. Share intelligence across providers. Asia Times reports that the advisory also discusses switching suspected distillers to "downgraded" models without informing them.

What followed

• 9 September. A Commerce Ministry spokesperson in Beijing called the claims "baseless and without legal basis" and said distillation "is a common practice". The spokesperson warned of "resolute countermeasures" if the US acted against Chinese companies. None of the six companies responded publicly in the coverage ByteNib reviewed.
• 10 September. Anthropic's threat report alleged that Moonshot relayed almost 300,000 real Kimi customer requests to Claude over ten days, through 5,380 fraudulent accounts, according to Bloomberg's account of the report. It attributed more than 23 million exchanges to Moonshot between May and July, and reportedly named seven China-based labs in all.
• 22 September. Reports said China's Cyberspace Administration was questioning DeepSeek and Moonshot over whether Chinese users' data had reached Claude. Every account traces back to one outlet, The Information. Neither the regulator nor the companies had commented.
• 24–26 September. At the Trump–Xi state visit in Washington, an AI-incident hotline was reportedly discussed but not finalised. That rests on secondary accounts citing Bloomberg, NBC and The Washington Post, not an official readout.

Why it matters beyond the six companies

Heavy legitimate use can look like distillation. The warning signs the advisory lists are high usage relative to a subscription, new accounts running at full volume, and requests that extract reasoning. They overlap with ordinary enterprise work: evaluation harnesses, synthetic-data generation, large batch jobs, and new pilot accounts before procurement catches up. If a provider "subtly" degrades responses to an account it misjudges, the customer sees an unexplained drop in quality and is not told why. A monthly invoice will not show it; only a before-and-after comparison on fixed tests will.

Prompts may travel further than the contract says. If Anthropic's allegation is right, people using Moonshot's Kimi had their requests forwarded to another company's model without knowing it. Chinese regulators are reportedly asking the same question from the other side. The lesson is not about one country. Any hosted AI service can route traffic to third parties unless the contract and the audit rights say otherwise.

The origin of open-weight models becomes a procurement question. Nothing in the advisory restricts the use of open-weight models from the six companies, which are widely deployed. But the US government now alleges on the record that some were built partly on American models' outputs, against those providers' terms. That does not make running them unlawful. It does mean where a model came from belongs in the AI inventory, next to its licence and its hosting location.

What leaders should do next

1. Keep a fixed evaluation set and run it on a schedule. A stable set of prompts with scored outputs is the only way to notice a silent change in quality, whether it comes from anti-distillation measures, a model update or re-routing. It is cheap to build and it settles arguments.
2. Tell your provider before you run at scale. Large evaluation or synthetic-data jobs should run on verified enterprise accounts, with the account team told in advance, not on fresh accounts or personal keys that match the advisory's warning signs.
3. Put data routing in the contract. For every hosted AI service, require a list of sub-processors, disclosure of any onward routing of prompts, and notice of changes. Apply the same rule to staff use of consumer AI apps, whoever the vendor is.
4. Record where each model came from. For each open-weight model in production, note its origin, licence and hosting. Know how quickly you could swap it if procurement policy or law changes. There is no sign yet that it will, but US–China AI policy moved faster this month than most procurement cycles.
5. Read your own terms before distilling. If your team trains smaller models on a commercial model's outputs, check that the provider's terms allow it. Most providers restrict using outputs to build competing models, and the advisory shows enforcement getting more serious.

Sources and scope

The advisory is CISA AA26-251A, with reporting from CyberScoop, The Register and Asia Times. China's response is from People's Daily and the National Law Review. Anthropic's allegations are from its September threat report and Bloomberg. The Chinese probe is from Gizmodo, citing The Information.

The allegations against the six companies are contested and cannot be verified independently from public material. The consequences for legitimate users and the recommendations are ByteNib editorial analysis. This article was researched and drafted with AI assistance, including Anthropic's Claude, and edited under ByteNib's editorial standards. Anthropic is a party to the dispute described here, and its claims are attributed to it throughout.

Continue exploring: AI & Machine Learning analysis, the related implementation tutorial, and the structured learning path.