NSA and FBI Accuse DeepSeek and Moonshot of Stealing US AI Models
On September 8, 2026, the NSA, FBI and CISA issued joint cybersecurity advisory AA26-251A, accusing six China-based AI companies, including DeepSeek and Moonshot AI, of running "industrial-scale" distillation campaigns against American AI models. The companies did not respond publicly, and China's embassy rejected the allegations. We explain what distillation is, what the advisory alleges, what it does not show, and what it means for anyone building with these models.
⚡ Quick facts
- Issued: September 8, 2026: joint advisory AA26-251A from the NSA, FBI and CISA
- Named firms: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI
- Targets: Anthropic's Claude, OpenAI's GPT, Google's Gemini and xAI's Grok
- Alleged scale: billions of tokens over millions of requests since 2024, per the advisory
- Response: the companies did not comment; China's embassy dismissed the allegations
What distillation is
Distillation means training a model on the outputs of a stronger one. It is a standard technique when you own both models. It becomes contested when the stronger model belongs to someone else: most AI providers' terms forbid using their outputs to build competing models. The practical effect is that a lab can copy much of a rival's capability for a small fraction of the cost of training it.
What the advisory alleges
According to The Next Web and Engadget, the advisory names six companies and describes campaigns running since 2024:
- DeepSeek: since late 2024, against Claude, Gemini, GPT and Grok, including for its R1 model.
- Moonshot AI: millions of exchanges with Claude and GPT models since mid-2025, used for its Kimi models.
- Alibaba: Claude and GPT-5 in late 2025, for Qwen.
- MiniMax: chain-of-thought and reinforcement-learning data, plus prompt injection against Claude Code.
- StepFun: reasoning and coding capability.
- Z.AI: billions of tokens from GPT-5.5 and Claude Opus.
The methods described are familiar to anyone who runs an API: networks of fraudulent accounts, traffic routed through cloud and aggregator proxies, a grey market of resold API access called "transfer stations", jailbreaks to extract hidden reasoning, and automatic failover when an account is banned. The advisory says the campaigns likely ran with Chinese government awareness, and argues that DeepSeek's widely cited $5.6 million training cost excludes the value of distilled data.
What it does not show
The advisory is an accusation, not a court finding. Its evidence is not public, the named companies have not answered it, and Chinese embassy spokesman Liu Chang dismissed it, per ProPakistani. It also announces no sanctions or legal action. Distillation is not new as an allegation either: OpenAI said in early 2025 that it was investigating DeepSeek, and Anthropic made similar accusations earlier in 2026. What is new is US security agencies putting their name to it.
What the agencies recommend
- Detect distillation patterns: high-volume, systematic querying across many linked accounts.
- Share indicators across the industry, so a banned network cannot simply move to another provider.
- Quietly alter outputs to suspected distillers, so stolen data is less useful for training.
Our take: what it means if you build with these models
- Using DeepSeek, Kimi or Qwen is not affected directly. The advisory targets how models were trained, not people who use them. Nothing in it bans their use.
- Expect stricter API access. Providers are likely to add identity checks, rate limits and pattern detection. Legitimate high-volume users should keep usage clearly tied to a verified account.
- Avoid resold API access. Cheap "transfer station" proxies are exactly what the advisory describes. They can be cut off, and they see your data.
- Watch policy, not headlines. The real signal will be export rules or procurement bans, if any follow. None are announced yet.
For background on one of the named labs' models, see our DeepSeek V4.1 Flash explainer.
Sources
- CISA: Cybersecurity advisory AA26-251A
- The Next Web: NSA, FBI and CISA advisory on Chinese AI distillation
- Engadget: US authorities accuse Chinese AI companies
- ProPakistani: FBI and NSA accuse Chinese AI firms
Frequently asked questions
What is advisory AA26-251A?
A joint cybersecurity advisory from the NSA, FBI and CISA, issued September 8, 2026, accusing six China-based AI companies of industrial-scale distillation of US AI models.
Which companies were named?
DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.
What is model distillation?
Training one model on the outputs of a stronger one. Most AI providers' terms forbid using their outputs to build competing models.
Is the accusation proven?
No. It is an accusation by US agencies. The supporting evidence is not public, the companies have not responded, and China's embassy rejected it.
Can I still use DeepSeek or Qwen?
The advisory does not ban any model or app. It concerns how the models were trained and recommends defenses for US AI providers.
What defenses does it recommend?
Detecting systematic querying, sharing indicators across companies, and quietly altering outputs given to suspected distillers.