Full Report
U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks. The activity has been described as occurring at an industrial-scale and one that forms the "core" of their AI development strategy, according to
Analysis Summary
# Incident Report: Industrial-Scale AI Model Distillation by PRC-Based Entities
## Executive Summary
U.S. intelligence agencies (NSA, CISA, and FBI) have identified a systematic, industrial-scale campaign by China-based AI companies to extract proprietary capabilities from American frontier models through advanced "distillation" attacks. By bypassing geographic restrictions and terms of service, these entities have extracted billions of tokens to rapidly advance their own AI development, significantly reducing their R&D timelines and costs. The campaign targets top-tier models from OpenAI, Google, Anthropic, and SpaceXAI.
## Incident Details
- **Discovery Date:** September 09, 2026 (Joint Advisory Publication)
- **Incident Date:** Ongoing; actively tracked from late 2024 through early 2026
- **Affected Organizations:** Anthropic, OpenAI, Google, SpaceXAI
- **Sector:** Artificial Intelligence / Technology / Research & Development
- **Geography:** United States (Victims); People's Republic of China (Threat Actors)
## Timeline of Events
### Initial Access
- **Date/Time:** Late 2024 (Earliest tracked organized campaign)
- **Vector:** Abuse of APIs, remote cloud providers, and third-party aggregators.
- **Details:** Actors utilized bulk procurement of premium subscriptions shared across developer teams to gain high-volume access to model outputs.
### Lateral Movement (Model Level)
- **Details:** While traditional network lateral movement was not the primary focus, actors moved across different model families (GPT-4 to GPT-5; Claude 4 to Claude Opus) to synthesize and cross-reference extracted capabilities.
### Data Exfiltration/Impact
- **Exfiltration:** Systematic extraction of "billions of tokens" across millions of requests.
- **Impact:** Extraction of proprietary "Chain-of-Thought" (CoT) reasoning, Reinforcement Learning (RL), Supervised Fine-Tuning (SFT) data, and specialized coding/agentic functions.
### Detection & Response
- **Detection:** Identified by U.S. agencies (NSA/CISA/FBI) monitoring the "gray market" of proxies and analyzing large-scale API traffic patterns.
- **Response:** Issuance of Joint Cybersecurity Advisory [AA26-251A] to warn U.S. AI companies and providers.
## Attack Methodology
- **Initial Access:** Use of VPNs, obfuscated accounts, and automated agents to bypass geographic restrictions (Geofencing).
- **Persistence:** Maintaining "gray market" proxy relays and transfer stations hosted outside mainland China.
- **Defense Evasion:** Use of third-party aggregators to hide user metadata; automated failover between different API pathways when blocking attempts occur.
- **Discovery:** Automated quality evaluation frameworks to detect and bypass defensive countermeasures (e.g., "jailbreaking" or prompt engineering to extract reasoning).
- **Collection:** Bulk extraction of reasoning logs and domain-specific optimizations.
- **Exfiltration:** Routing data through Taobao/Xianyu-linked proxy services.
- **Impact:** Intellectual Property (IP) theft leading to reduced competitive advantage and accelerated development for adversaries.
## Impact Assessment
- **Financial:** Significant reduction in training costs for PRC firms at the expense of U.S. R&D; loss of competitive market share.
- **Data Breach:** Extraction of billions of tokens representing the "core" logic and specialized training of U.S. frontier models.
- **Operational:** Violation of Terms of Service (ToS) and bypassing of U.S. export/geographic controls.
- **Reputational:** High-profile demonstration of vulnerabilities in current AI API defensive layering.
## Indicators of Compromise
- **Network Indicators:** Traffic originating from known "gray market" proxy relays and specific third-party aggregators (URLs/IPs defanged in source material).
- **Behavioral Indicators:**
- High-volume, systematic querying of "Chain-of-Thought" prompts.
- Automated failover patterns (switching API keys/endpoints immediately upon rate-limiting).
- Subscriptions shared across abnormally large, geographically dispersed developer teams.
## Response Actions
- **Containment:** Agencies recommended enhanced monitoring of API traffic for distillation patterns.
- **Eradication:** Blocking of known proxy relay stations and gray market access points.
- **Recovery:** Development of "defensive distillation" countermeasures to poison or restrict reasoning outputs to suspicious accounts.
## Lessons Learned
- **AI IP Vulnerability:** Current API protections are insufficient against industrial-scale, state-sponsored distillation.
- **Geofencing Limitations:** Geographic restrictions are easily bypassed via the proxy gray market.
- **Terms of Service Enforcement:** Bulk procurement of premium accounts provides a low-cost entry point for sophisticated IP theft.
## Recommendations
- **Enhanced Monitoring:** Implement behavioral analytics specifically designed to detect "distillation signatures" (e.g., repetitive, highly structured queries meant to map model weights or logic).
- **Stricter KYC:** Strengthen "Know Your Customer" protocols for premium AI subscriptions.
- **Rate-Limiting Evolution:** Move beyond simple volume-based limiting to "contextual rate-limiting" that detects systematic logic extraction.
- **Watermarking:** Implement forensic watermarking on model outputs to track the origin of distilled data if it appears in competitor models.