Anthropic and OpenAI made this accusation seven months ago. Both AI labs told Washington that Chinese firms were quietly harvesting their models to train rivals, and for months, the claim sat as a private-sector complaint. This week, the U.S. government put its name on it.
The National Security Agency, the FBI and the Cybersecurity and Infrastructure Security Agency released a joint advisory on Tuesday, Sept. 8, accusing six China-based AI developers of extracting proprietary capabilities from American models at what the agencies called an industrial scale.
The agencies named DeepSeek, Moonshot AI, Alibaba (BABA), MiniMax, StepFun and Z.AI, Bloomberg reported.
Related: Anthropic’s $2 trillion IPO could test the limits of AI mania
The technique is called distillation, where a cheaper model learns from a more capable one, a common and legitimate practice industrywide. What the advisory alleges is different: routing millions of queries through proxies and fraudulent accounts to extract billions of tokens from Claude, GPT, Gemini and Grok since late 2024.
The advisory also took direct aim at DeepSeek’s origin story. Its widely cited $5.6 million training cost for the R1 model excludes the true cost of data it allegedly acquired through distillation, the agencies said.
The other four firms named face similar allegations:
- Moonshot AI has extracted Claude and GPT data since mid-2025 to train its Kimi models, drawing specifically on Anthropic’s Fable models, the advisory says.
- MiniMax pulled reasoning and coding data from Claude and Gemini models, then tried to convince Claude Code it was a MiniMax product, per the advisory.
- StepFun targeted Claude and GPT coding capabilities between late 2025 and early 2026, the same advisory states.
- Z.AI extracted billions of tokens from GPT-5.5 and Claude Opus by mid-2026, one of the most active campaigns the agencies identified.
Washington just co-signed a private sector complaint
None of this is new information. I wrote in June about Anthropic’s accusation that operators tied to Alibaba’s Qwen lab generated 28.8 million exchanges with Claude through nearly 25,000 fraudulent accounts, the largest distillation campaign the company had documented, first reported by Bloomberg.
Anthropic had already named DeepSeek, Moonshot and MiniMax in February for a comparable campaign, according to Fortune.
What changed this week is the source, not the substance. A blog post from a private company carries no legal weight. A joint advisory from the NSA, the FBI and CISA is a formal government finding, and that distinction matters more to investors than facts that were already public.
Alibaba’s shareholders just gained a key exhibit
Alibaba is the only name on the list that trades on a major U.S. exchange, making this more than a policy story.
A securities class action already accuses Alibaba of calling unauthorized distillation a hypothetical risk in its annual report while the conduct was allegedly ongoing, according to a press release announcing the suit.
Alibaba’s American depositary shares have fallen roughly 45% from their high over the past year, according to the same press release, with most of that decline coming after Bloomberg first reported Anthropic’s letter to Congress in June.
The stock closed at $112.47 on Tuesday, still far from a recovery.
A government advisory that corroborates the same allegation hands plaintiffs’ attorneys something they lacked in June: a federal finding instead of a company’s letter. The lead plaintiff deadline is October 5.
Sanctions talk collides with an industry that disagrees
Treasury Secretary Scott Bessent said in July that the administration could sanction Chinese AI firms and add them to the Entity List if distillation crossed into IP theft, telling CNBC officials that it has “the ability to sanction them because of this theft.” That threat now has an intelligence finding behind it, not just a cable interview.
Not everyone in the industry agrees with the framing. Nvidia CEO Jensen Huang has called distillation fundamental to intelligence itself, and Microsoft CEO Satya Nadella has argued that labs restricting distillation in their own terms built their models by training on data scraped from the open web, according to SiliconANGLE.
That tension matters for timing. The advisory lands weeks before an expected Trump-Xi meeting, and enforcement could become a bargaining chip rather than an immediate priority.
More AI:
- Nvidia just made a move Wall Street wasn’t ready for
- Microsoft just took sides in AI policy fight
- OpenAI just disclosed something genuinely alarming
The real fight is over who owns a model’s output
Chip export controls tried to slow China’s AI progress by restricting hardware. Distillation enforcement, if it materializes, would restrict something harder to police: a model’s output, generated the instant someone sends it a query.
Anthropic, OpenAI and Google built their businesses on the assumption that access to a model does not mean access to what trained it.
This advisory is the clearest signal yet that Washington intends to treat that assumption as a legal boundary, not a technical one.
Whether it can enforce that boundary against firms it does not regulate, without disrupting a relationship it is actively managing with Beijing, is the question this story leaves open.
Related: The secret letter triggering a U.S.-China AI showdown