Yesterday, the NSA, CISA, and FBI issued joint advisory AA26-251A naming six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — for conducting industrial-scale knowledge distillation campaigns against US frontier AI models. Billions of tokens. Millions of requests. Claude, GPT, Gemini, and Grok all targeted. If you’re running AI agents in production against any of these APIs, there’s a real chance your fleet already matches the attack signature — and your provider may have quietly downgraded your model without telling you.
What Distillation at Scale Actually Looks Like #
Knowledge distillation is a legitimate ML technique: train a smaller model using outputs from a larger one. What these companies allegedly did was weaponize it at industrial scale. You query the API, record every response, and use those question-answer pairs to train a rival model at a fraction of the original development cost. Nothing breaks. No alarms fire. The evidence hides in usage patterns, not security logs.
The scale here is striking. MiniMax ran over 13 million exchanges. A single proxy network managed more than 20,000 fraudulent accounts simultaneously — mixing distillation traffic with unrelated requests to frustrate pattern detection. When accounts got banned, replacements were live within hours. Critically, these campaigns specifically targeted chain-of-thought reasoning traces — they wanted the thinking, not just the answers. That’s a key reason DeepSeek’s R1 reasoning model improved so dramatically: it may have been trained on reasoning chains from models that took years and hundreds of millions of dollars to develop.
The Detection Problem: Your Agent Fleet Looks Like an Attacker #
Here’s what most coverage is missing. The advisory lists behavioral red flags API providers should watch for:
- 24/7 sustained usage without human variation or idle periods
- New subscriptions immediately hitting maximum throughput
- Shared accounts accessed from multiple IPs or user agents
- Enterprise-scale throughput from accounts that haven’t gradually ramped up
Read that list again. That’s a description of a production AI agent fleet. That’s your CI/CD pipeline. That’s your microservices cluster using a single API key. Security researchers have already flagged this: CISA’s detection profile is so broad it catches legitimate enterprise operators alongside actual distillers.
And the fix the advisory recommends? A silent model downgrade. Providers are instructed to serve “less sophisticated ‘downgraded’ models” to suspected accounts and explicitly told to “avoid informing” users of the switch. If your fleet has been flagged — correctly or not — you’re getting degraded outputs with no way to know it. That’s an SLA problem, and it may be happening right now.
Four Things to Do Before End of Day #
Segment your API keys. One key per service, not one per company. Shared keys accessed from multiple IPs is item one on the red-flag list. Segment now so your legitimate fleet doesn’t look like a 20,000-account proxy network.
Baseline your output quality. If you have logged historical responses to benchmark prompts, run them again. A drop in reasoning quality or response depth could mean you’ve been silently downgraded — the only way to detect it from the outside.
Audit your terms of service compliance. API terms for OpenAI, Anthropic, and Google explicitly prohibit using outputs to train competing models. If you cache responses or pass them to any training pipeline — even inadvertently — you have liability exposure. Review your data handling practices now.
Document your legitimate use case. When providers implement behavioral monitoring at scale, false positives are inevitable. Having documented architecture decisions and business justification for your usage patterns is basic operational hygiene at this point.
The Capability Gap Is Closing Faster Than Anyone Admitted #
The advisory’s most uncomfortable statement: distillation campaigns form “the core, not merely a supplement” of these companies’ AI development strategy. Developing GPT-5-level reasoning legitimately costs hundreds of millions. Distilling it costs a fraction and takes months instead of years. The 6-to-18-month capability advantage US labs held over Chinese competitors was never as wide as assumed if those competitors were systematically extracting the reasoning capabilities that created that gap.
US officials are now discussing whether unauthorized distillation constitutes IP theft with trade and sanctions implications. For developers, the immediate risk is more concrete: your production AI stack may be silently degraded, and the criteria for getting flagged were written broad enough to catch you. Check your keys, baseline your outputs, and expect more providers to expand behavioral monitoring in the next 30 days.