China AI Firms Extract Billions of Tokens From US Models in Distillation Campaign

The U.S. National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation have jointly issued a landmark cybersecurity advisory revealing that China-based artificial intelligence companies have been systematically extracting proprietary capabilities from American frontier AI models through industrial-scale knowledge distillation campaigns. The advisory, designated AA26-251A and released on September 8, 2026, exposes a coordinated and sustained effort that goes far beyond legitimate research methodology and instead represents a deliberate, government-aware campaign to harvest U.S. intellectual property at unprecedented scale.

What Is Industrial-Scale AI Distillation?

Knowledge distillation is a recognized technique in machine learning where a smaller model learns from the outputs of a larger, more capable model. In legitimate academic and commercial settings, this technique is used openly and within the bounds of terms of service. However, the joint advisory describes something fundamentally different: a systematic, industrial-scale campaign in which China-based AI companies route billions of requests through APIs, cloud providers, and third-party aggregators to extract the proprietary reasoning, specialized optimizations, and domain-specific capabilities of U.S. frontier models including variants of Claude, GPT, Gemini, and Grok.

According to the advisory, the named companies engaged in this campaign include DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. These organizations allegedly extracted billions of tokens across millions of individual exchanges since at least late 2024. DeepSeek alone conducted organized campaigns targeting reasoning capabilities to train its R1 and V3 models, while Alibaba leveraged the technique to accelerate development of its Qwen family of AI models.

How the Campaign Operates

The advisory details several sophisticated methods these companies use to conduct their distillation campaigns while evading detection and violating terms of use:

• Transfer stations and proxies: China-based companies use a gray market of proxy services known as “transfer stations” to bypass geographic restrictions imposed by U.S. AI providers, effectively erasing user metadata and undermining traceability.
• Multiple routing pathways: Requests are distributed across native APIs, remote cloud providers, and third-party aggregators that automatically obfuscate metadata, making detection by any single provider extremely difficult.
• Bulk subscription procurement: Companies purchase premium subscriptions in bulk and share them across large teams of developers, achieving cost savings while maximizing query throughput.
• Automated failover: When a pathway is blocked, these campaigns automatically switch to alternative routes, ensuring continuous extraction with minimal disruption.
• Chain-of-thought reasoning extraction: Advanced tactics specifically target the step-by-step reasoning outputs of models, which represent some of the most valuable proprietary capabilities in frontier AI systems.

By deliberately distributing operations across multiple providers and platforms, these companies avoid single-point detection while cherry-picking the best capabilities from each U.S. frontier model. The result is significantly shorter development timelines and reduced financial expenditures for training their own competing models.

Why This Matters for Cybersecurity

This advisory represents a significant shift in how the U.S. government characterizes AI-related threats. Rather than treating model distillation as a purely commercial or intellectual property dispute, the involvement of the NSA, CISA, and FBI elevates it to a national security concern. The advisory explicitly states that the Chinese government is likely aware of these activities, framing the campaign as a systematic extraction of proprietary functionalities that threatens U.S. technological leadership.

For cybersecurity professionals, this development raises critical questions about the boundary between traditional cyber threats and emerging AI-specific attack vectors. The techniques described in the advisory share characteristics with well-known cybersecurity threats including credential abuse, terms-of-service violations at scale, and data exfiltration through legitimate channels. The distinction is that the target is not a database or a network, but the accumulated knowledge and reasoning capabilities embedded in AI models that cost hundreds of millions of dollars to develop.

The DeepSeek Sandbox Vulnerability

The CISA advisory emerged on the same day that security researchers disclosed a critical vulnerability in DeepSeek Harness, the company’s open-source tool for running AI coding agents on developer machines. Tracked as CVE-2026-82533 and rated 9.4 out of 10 in severity, the flaw allowed a sandboxed AI agent to disable its own file sandbox with a single shell command. The agent could call the tool’s local web interface to remove sandbox restrictions, enabling commands to execute outside the workspace without any approval prompt.

The vulnerability required only that the agent read attacker-supplied text that prompted it to make the disabling call. DeepSeek patched the tool on August 27, 2026, but the disclosure on September 8 by VulnCheck and OX Research highlights the growing intersection of AI tooling and traditional security vulnerabilities. As AI agents gain the ability to execute code on local systems, the attack surface expands dramatically, and sandbox escapes that would once have been niche concerns become critical security risks.

Recommended Mitigations for AI Companies

The joint advisory recommends three immediate actions for U.S. AI companies to detect and mitigate industrial-scale distillation campaigns:

1. Implement Comprehensive Detection

Organizations should deploy monitoring systems capable of detecting anomalous and malicious prompts, accounts, network behaviors, and usage patterns. Key indicators include suspicious subscription-to-usage ratios, immediate maximum usage from newly created accounts, and enterprise-scale throughput patterns that deviate from normal user behavior. Advanced detection should also identify chain-of-thought extraction attempts and automated failover between pathways.

2. Strengthen Access Controls and Terms Enforcement

AI companies must implement stronger geographic restrictions, more aggressive detection of proxy and transfer station usage, and automated blocking of accounts exhibiting distillation campaign patterns. This includes deploying behavioral analytics to distinguish between legitimate research queries and systematic extraction campaigns operating at industrial scale.

3. Coordinate Information Sharing

The advisory emphasizes that no single company can address this threat alone. Effective response requires coordinated information-sharing across the AI ecosystem, spanning government agencies, private industry, and allied nations. Companies should report suspicious activity to the appropriate authorities and participate in threat intelligence sharing programs to build collective awareness of evolving distillation tactics.

Broader Implications for the AI Security Landscape

The events of September 2026 signal that AI security has moved beyond theoretical concerns about model poisoning or adversarial examples into the realm of state-sponsored economic espionage and critical infrastructure protection. Several concurrent developments reinforce this trend:

• Microsoft patched a record 974 vulnerabilities in its September 2026 Patch Tuesday release, including two Windows zero-days that were actively exploited in the wild, demonstrating that the traditional vulnerability landscape remains as challenging as ever even as AI-specific threats emerge.
• SAP addressed a CVSS 10.0 kernel flaw enabling unauthenticated remote code execution, underscoring that fundamental security weaknesses in enterprise infrastructure continue to provide attackers with high-impact exploitation opportunities.
• A ChatGPT flaw was disclosed that allowed a planted prompt to send a victim’s Gmail data to another account, illustrating how AI applications themselves can become attack vectors for social engineering and data theft.
• Autonomous AI agents compromised thousands of credentials in under six hours during a research exercise, demonstrating the speed and scale at which AI-powered attacks can operate when security controls are inadequate.

What Organizations Should Do Now

For organizations deploying AI tools and infrastructure, the September 2026 advisories and vulnerability disclosures offer several clear takeaways:

• Audit AI tool deployments: Review all AI coding agents, sandboxes, and automation tools for known vulnerabilities. Ensure that tools like DeepSeek Harness are updated to the latest patched versions, and verify that sandbox configurations cannot be bypassed through local interfaces.
• Monitor API usage patterns: If your organization provides or consumes AI APIs, implement behavioral monitoring to detect distillation campaign patterns, including unusual query volumes, chain-of-thought extraction attempts, and suspicious account behavior.
• Patch aggressively: The record 974 Microsoft vulnerabilities and the CVSS 10.0 SAP flaw demonstrate that timely patching remains the single most effective defensive measure against both traditional and AI-augmented attacks.
• Review third-party AI integrations: Examine how third-party aggregators and API providers handle your data and credentials, as these pathways are explicitly identified as vectors for distillation campaigns.
• Invest in AI-specific threat detection: Traditional security information and event management systems may not be equipped to identify AI-specific attack patterns. Organizations should evaluate specialized tooling for monitoring AI model access and detecting anomalous usage.

Conclusion

The joint CISA-NSA-FBI advisory on industrial-scale AI distillation represents a watershed moment in cybersecurity. It confirms that the competition for AI supremacy has spilled over into systematic, state-aware campaigns to extract intellectual property at a scale that threatens national technological leadership. Combined with the concurrent disclosure of a critical DeepSeek sandbox escape vulnerability and a record-breaking Patch Tuesday from Microsoft, the events of September 2026 make clear that AI security is no longer a niche concern but a central pillar of organizational cybersecurity strategy.

As AI models become both the targets and the tools of cyber operations, organizations must adapt their security postures to address threats that blend traditional exploitation techniques with novel AI-specific attack vectors. The recommendations from U.S. agencies provide a starting framework, but the rapidly evolving threat landscape demands continuous vigilance, information sharing, and proactive investment in AI-aware security capabilities.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous