What did the joint NSA, CISA, and FBI cybersecurity advisory accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of doing since late 2024 through industrial-scale AI distillation—specifically their alleged extraction of billions of tokens from U.S. frontier models s

The advisory alleged that six China-based AI companies made industrial-scale extraction of proprietary U.S. frontier-model capabilities a central part of their development strategy, not merely a legitimate ancillary use of distillation. It described this as an allegation, not an adjudicated finding. 12

What the advisory alleged

• Since at least late 2024, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI allegedly extracted billions of tokens through millions of interactions with Claude, GPT, Gemini, and Grok variants, likely with Chinese-government awareness. 1
• The alleged access routes were providers’ native APIs, remote cloud providers, and third-party aggregators that obscure customer metadata, as well as “transfer-station” proxy services used to evade geographic controls, safeguards, terms of service, and traceability. 1
• It also alleged bulk purchases and sharing of premium subscriptions, automated failover among access routes when blocked, chain-of-thought extraction, and evaluation systems designed to identify defensive changes in model answers. 1
• The source supplied here supports the existence of gray-market “transfer stations,” but does not independently substantiate the specific Taobao and Xianyu marketplaces named in the question. Insufficient evidence.

Company-specific allegations

• DeepSeek: The agencies said it ran an organized campaign beginning in late 2024 to create synthetic training data for R1 and V3, targeting reasoning, domain-specific knowledge, and specialized functionality to reduce research and compute costs. 1

  • The advisory specifically listed legal-specialization optimization, API rule-driven tasks, chain-of-thought draft writing, agentic functions, Q&A optimization, coaching/assistant capabilities, functional-creation optimization, supervised fine-tuning optimization, and creative/occupational writing optimization. 1
  • It alleged use of outputs from Claude, Gemini, GPT, and Grok model variants, and said DeepSeek’s public $5.6 million training-cost figure omitted the cost/value of data obtained by the alleged distillation. 1

• Moonshot AI: The advisory alleged a widespread campaign since mid-2025, including significant Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2. 1

  • It said Moonshot sought supervised fine-tuning, reinforcement-learning, software-engineering, and mathematics capabilities. 1

• Alibaba: The agencies alleged industrial-scale distillation to improve Alibaba’s Qwen family. 1

• MiniMax, StepFun, and Z.AI: The advisory alleged they also engaged in malicious distillation of U.S. models. 1

  • The supplied evidence does not provide a MiniMax-specific campaign, model, or capability attribution beyond that general allegation. Insufficient evidence.

China’s response, sanctions, and diplomacy

• The supplied sources do not contain China’s official response or a statement by Foreign Ministry spokesperson Mao Ning. Insufficient evidence.
• They likewise do not substantiate the exact warning reportedly made by Treasury Secretary Scott Bessent concerning sanctions or Entity List designations. Insufficient evidence.
• The supplied evidence does not establish the connection to planned mid-September U.S.–China AI-safety talks, nor does it independently document the claimed narrowing performance gap between Chinese and U.S. systems. Insufficient evidence.

Recommended defenses

The agencies urged three immediate measures: 1

1. Detect and mitigate anomalies: Flag malicious prompts, accounts, networks, and behaviors; monitor unusually high subscription-to-usage ratios, immediate maximum use by new accounts, and enterprise-scale throughput. 1

2. Change responses selectively: Subtly modify model outputs for suspected extraction attempts, reducing the value of the responses to a distillation campaign without necessarily revealing the detection method. 1

3. Share intelligence across the ecosystem: Correlate activity among model providers, cloud platforms, and API aggregators to expose campaigns deliberately distributed across providers and pathways. 1

CISA’s broader collaboration guidance also supports voluntary AI-cybersecurity information sharing with government and industry partners. 4 The available evidence does not independently substantiate the reference to Google identifying campaigns of more than 100 million prompts. Insufficient evidence.