Reported by 2 outlets

Timeline

1. original reporting

   DeepSeek, Alibaba and Chinese AI Firms Extract Billions of Tokens From U.S. AI Models

   gbhackers.com · 34d ago · September 9th, 2026

   U.S. intelligence and cybersecurity agencies have accused six China-based AI companies including DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI of extracting billions of tokens from leading American AI systems through industrial-scale knowledge-distillation campaigns. A joint Cybersecurity Advisory, AA26-251A, issued by the National Security Agency, Cybersecurity and Infrastructure Security Agency and FBI, said the campaigns […] The post DeepSeek, Alibaba and Chinese AI Firms Extract Billions of Tokens From U.S. AI Models appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from bleepingcomputer.com

   US says Chinese firms extracted billions of tokens from frontier AI models

   bleepingcomputer.com · 34d ago · September 9th, 2026

   cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. A joint advisory from CISA, NSA, and the FBI states that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens through millions of requests from frontier AI models from Anthropic, OpenAI, Google, and xAI. The agencies assess that the scale and sophistication of the operations indicate Chinese government awareness, mentioning that this approach is likely a core development strategy for the offending firms. AI model distillation is a legitimate technique in which a “student” model learns from the outputs of a well-trained model, helping researchers and developers reduce training costs and speed up AI deployment. However, as Google warned in February , distillation attacks can occur outside these companies’ controlled environments, abusing API access to extract the knowledge and logic of powerful models and compete with them at a fraction of the training cost. CISA’s advisory explains that Chinese firms distribute API requests across fraudulent or shared accounts, APIs, cloud services, aggregators, and “transfer station” proxies to bypass geographic restrictions, usage limits, and detection. Some of the prompts used attempted to expose restricted chain-of-thought reasoning, while automated systems switched providers and checked whether defenders had degraded the re