Six Chinese AI Firms Didn't Hack Anyone. They Bought Subscriptions and Asked Millions of Questions.

The advisory describes a theft with no break-in anywhere in it

No malware. No stolen credentials. No unpatched server. Six companies bought premium subscriptions to American AI products, ran them around the clock for the better part of two years, and kept every answer that came back. On 8 September 2026 the NSA, CISA and the FBI put their names to a document saying that this is the core of a national AI strategy rather than a shortcut around the edges of one.

The technique is called distillation, and it is ordinary machine learning practice: train a smaller model on the outputs of a larger one and it inherits some of the larger one's behaviour. What the advisory describes is that practice run at industrial volume against models nobody was supposed to be able to use this way. The part worth your attention is not the accusation. It is the defence the agencies recommend, because it changes what an API response is.

What the agencies published

The advisory, AA26-251A, names six China-based companies: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. Since at least late 2024 they extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok, likely with the Chinese government's awareness. The agencies write that these campaigns "form the core" of the companies' development strategy rather than merely a supplement. DeepSeek's widely quoted training cost of 5.6 million dollars, the number that shaped a year of commentary about cheap frontier AI, is described as misleading because it leaves out what the distilled data actually cost to obtain.

The mechanism deserves a slow read, because every step of it looks legal. Access came through a gray market of API proxies the advisory calls "transfer stations", resellers that hand out frontier model access at a fraction of the official price and, in doing so, erase the geography and the identity of whoever is really asking. On top of that sat routing software spanning native APIs, cloud endpoints, third-party aggregators and pools of vendor accounts, with health monitoring and automatic failover, so blocking one pathway simply moved the traffic to another. Organisational identifiers were stripped automatically at the infrastructure layer rather than by hand. And the prize was not facts, which are cheap. It was chain of thought, the step-by-step internal reasoning a model works through before it answers, which American providers deliberately hide from users. DeepSeek's method, according to the advisory, was to ask the model to imagine the reasoning behind an answer it had already given and write it out. That teaches a student model how to think about a problem, not merely what the answer was.

• MiniMax redirected its traffic to a newly released Claude model within 24 hours of launch, which means somebody was watching for the release with infrastructure already pointed at it. It also used prompt injection, hidden instructions smuggled into ordinary input, to try to convince Claude Code it was a MiniMax product.
• The operations ran production-grade quality assurance pipelines, built specifically to tell the difference between a provider having a bad day and a provider deliberately degrading their answers.
• Listed detection indicators include accounts shared across many IP addresses, sustained round-the-clock usage with no human idle periods, and new subscriptions that arrive immediately at maximum usage instead of ramping up.

Why it matters

Read that last bullet again, because it also describes your agent pipeline. A service account hitting an API from a dozen egress addresses, running overnight without idle gaps, provisioned at enterprise scale on day one: that is a normal 2026 automation stack and it is the published signature of a distillation campaign. Which brings us to the recommendation that matters most for organisations that buy AI rather than sell it. The agencies advise providers to answer suspected distillers with quietly degraded output, reducing reasoning depth or introducing inconsistencies, and they are explicit that those users should not be told, because telling them would reveal the countermeasure. Safety researchers and third-party evaluators are given an exception. Ordinary customers are not mentioned in it. If anyone in your organisation buys model access through a cheap reseller, you have a second problem, because that reseller is what the advisory means by a transfer station and your prompts are passing through it.

The systemic shift is that a model's answers have been reclassified. For three years the security conversation about AI was mostly about what goes in and what leaks out: training data, personal information, secrets pasted into a chat window. The output was simply the product. Two White House memoranda and one joint advisory later, the output is a strategic asset with an export problem attached, and the sanctioned way to protect it is to make it quietly worse for users the provider has decided are the wrong sort. That is a coherent answer to the threat described. It is also a new clause in every AI contract signed from here on.

What to do about it

1. Find out whether anyone at your company buys model access through a reseller or aggregator, and stop it. The unusually low price is the tell, and a proxy that anonymises the buyer necessarily reads the prompts, which for most teams means source code and customer records passing through an intermediary nobody has assessed.
2. Ask your AI providers in writing under what conditions they alter or downgrade responses, and whether they notify you. Undisclosed degradation is now a recommended control, so it belongs in a contract clause rather than in a support ticket six months from now when your evaluation scores drift and nobody can explain why.
3. Check your own API usage against the indicators in the advisory before somebody else does. If legitimate traffic matches the profile, write down why now, because the alternative is arguing the point after your throughput has already been throttled.

Bottom line

The uncomfortable detail is that this campaign ran through the front door, at list price minus a discount, using a technique taught in graduate courses. There was nothing to patch, which is why the response had to be commercial and diplomatic instead of technical. Take one question from it into your next vendor review: when your AI provider decides a customer looks suspicious, what happens to that customer's responses, and how would they ever know?