FBI-NSA-CISA: China distilled 4 frontier AI models since late 2024

For threat intelligence and security teams, the new FBI/NSA/CISA advisory is a rare public attribution of model extraction activity—not a network intrusion but a persistent abuse of commercial AI APIs. The claim that Chinese firms evaded terms of use through multiple routing pathways should trigger reviews of API telemetry, anomaly detection, and access controls at any organization serving or consuming frontier models. With Beijing signaling retaliation, this dispute is now a live operational and policy risk, not just a bilateral talking point.

A new escalation in the US-China AI technology conflict emerged on September 9, 2026, when Beijing formally rejected a joint US government advisory accusing Chinese artificial intelligence developers of "aggressive, malicious" industrial-scale efforts to extract capabilities from frontier American AI systems. The advisory, issued the previous day by the FBI, National Security Agency, and Cybersecurity and Infrastructure Security Agency, asserts that Chinese developers have distilled capabilities from Anthropic's Claude, OpenAI's GPT, Google's Gemini and SpaceXAI's Grok since at least late 2024. China's Commerce Ministry called the claims groundless and warned of resolute countermeasures, setting the stage for a contentious AI governance discussion in planned Trump-Xi talks later in the month.

“

For threat intelligence and security teams, the new FBI/NSA/CISA advisory is a rare public attribution of model extraction activity—not a network intrusion but a persistent abuse of commercial AI APIs.

Distillation is a legitimate technique in artificial intelligence in which a smaller "student" model learns from outputs of a larger "teacher" model, often to build more efficient systems. However, US agencies frame the Chinese use as unauthorized and malicious because it allegedly relies on routing distillation requests through multiple pathways to evade detection, violating US AI companies' terms of use. The advisory is significant because it unites three major agencies with distinct mandates—FBI counterintelligence, NSA signals intelligence, and CISA infrastructure defense—in a single public attribution. It signals that the US government now regards model extraction as both an economic espionage and cybersecurity threat, not merely a policy or competitive issue.

Beijing's response was immediate and coordinated across two ministries. The Commerce Ministry accused Washington of pursuing a "monopoly of the AI industry" and asserted that distillation is "a common practice" used by many AI companies worldwide including US firms, reflecting "anxiety and double standards." It explicitly tied any US suppression of Chinese AI companies under distillation pretexts to possible "resolute countermeasures." The Foreign Ministry, through spokesperson Mao Ning, sought to reframe the narrative around technological self-reliance and cooperation, saying China's AI development is the result of high-level technological self-reliance and strength. This dual strategy—denial and threat on one side, calls for cooperation on the other—mirrors Beijing's broader approach to technology disputes with Washington.

For cybersecurity practitioners, the advisory matters beyond US-China politics. It points to a growing operational problem for frontier model providers: API abuse, model extraction, and unauthorized distillation erode competitive advantages and can enable foreign adversaries to close capability gaps. The claim that Chinese AI companies route distillation requests through multiple pathways suggests sophisticated evasion of rate limits, content filters, and know-your-customer controls. If confirmed, it implies that standard API security controls are insufficient against determined state-linked actors. The implications extend to enterprise AI users, who may face stricter identity verification, telemetry sharing, licensing terms, and potentially forced geo-fencing from major model providers as enforcement pressure increases.