US Cyber Advisory: China Distilled 4 Frontier AI Models Since 2024

For security teams, the September 8 joint advisory is less about a single breach than a systemic abuse of legitimate API and model interfaces. It names four U.S. frontier models and says China-based companies have violated terms of use by routing distillation requests through multiple pathways since at least late 2024. That is an operational signal that existing access controls are being tested at industrial scale, not by a lone attacker but by organized actors.

The United States and China are now in an open dispute over AI model distillation, a technical practice that Washington's intelligence community has reframed as an industrial-scale national security threat. On September 8, 2026, the FBI, National Security Agency, and Cybersecurity and Infrastructure Security Agency issued a joint cybersecurity advisory alleging that Chinese AI developers have extracted, or distilled, capabilities from U.S. frontier AI systems since at least late 2024. The advisory specifically names Anthropic's Claude, OpenAI's GPT, Google's Gemini, and SpaceXAI's Grok as affected systems. Beijing responded the following day, with the Commerce Ministry calling the allegation groundless and accusing the United States of seeking a monopoly over the AI industry. The Foreign Ministry, through spokesperson Mao Ning, insisted China's AI development is the product of high-level technological self-reliance and said both countries should cooperate rather than trade accusations.

“

The advisory specifically names Anthropic's Claude, OpenAI's GPT, Google's Gemini, and SpaceXAI's Grok as affected systems.

The core technical issue is that distillation itself is a legitimate and widely used machine-learning technique for compressing large models into smaller, more efficient versions. Chinese officials argue that the practice is common among AI companies worldwide, including in the United States, and that Washington's focus on distillation reflects anxiety and double standards. U.S. authorities, however, describe a more specific pattern: Chinese AI companies allegedly route distillation requests through multiple pathways to gain unauthorized access, violating the terms of use set by U.S. AI providers. That distinction matters because it turns a normally accepted research method into a question of access control, policy compliance, and potentially espionage.

The joint advisory is significant well beyond the immediate diplomatic exchange. It signals that U.S. cybersecurity and intelligence agencies now view AI model extraction as a strategic vulnerability comparable to traditional intellectual property theft. For American AI laboratories, the implication is that API abuse and model-output harvesting may become a higher-priority defensive challenge than conventional network intrusion. The advisory does not describe a direct breach of underlying infrastructure, but it does highlight that frontier capabilities can be transferred without stealing model weights, simply by querying the model at scale and training a new system on those outputs. That is a difficult problem for security teams because the queries may appear as normal usage, especially if routed through intermediaries, cloud accounts, or compromised credentials.

For China, the response signals a hardening position. The Commerce Ministry's statement that China will take resolute countermeasures if the United States suppresses Chinese AI companies under the pretext of targeting distillation introduces the possibility of export controls, procurement restrictions, or other retaliatory measures. This is not merely rhetorical. Beijing has previously responded to U.S. technology controls by restricting critical minerals, launching antitrust probes, and tightening data-security reviews. The threat of countermeasures now extends that pattern into the AI domain, where access to chips, cloud compute, and frontier model APIs is already contested.