US national security agencies accused six Chinese artificial intelligence companies in September 2026 of conducting large-scale campaigns to extract capabilities from leading American AI models. The September 8 joint cybersecurity advisory from the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) described what the agencies characterised as aggressive and potentially malicious model-distillation activity.

The companies named in the advisory were DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The allegations have been rejected by China’s government. They should be understood as claims made by US agencies, not as judicial findings establishing that each named company committed an offence.

The issue has developed since the original advisory. Anthropic published a broader threat-intelligence report in September and another update on its defensive measures on October 12. These later statements contain Anthropic’s own findings and should not be confused with the scope of the US agencies’ September 8 advisory.

## What the US agencies alleged

The [joint cybersecurity advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a) described campaigns intended to extract the capabilities of American frontier AI models at industrial scale. According to the agencies, the activity involved large volumes of model interactions, fraudulent accounts and methods intended to circumvent access controls.

The advisory identified models associated with Anthropic, OpenAI, Google and xAI among the systems targeted. It described the activity as extending back to at least late 2024 and assessed that the campaigns were likely conducted with the Chinese government’s awareness.

These statements reflect the agencies’ assessment. The advisory is cybersecurity guidance and does not itself establish criminal liability, resolve every disputed factual question or announce that every company named has been sanctioned.

## What is model distillation?

Model distillation is a technique in which outputs from a more capable model are used to train or improve another model. It can help developers create smaller, less expensive or more efficient systems.

Distillation is not inherently improper. AI developers use it for legitimate research and product development, including to build smaller models from larger systems they control or are authorised to use.

The issue raised by US agencies and AI companies is the alleged unauthorised extraction of capabilities at scale, particularly where the activity involves deceptive accounts, proxy networks or violations of access restrictions and service terms. Whether particular conduct amounts to a breach of contract, misuse of intellectual property or a legal offence depends on the evidence and applicable law.

The distinction matters because ordinary model training and unlawful conduct should not be treated as interchangeable simply because both involve learning from another model’s outputs.

## Which companies were named?

The September 8 US advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It alleged that the companies had used interactions with American AI systems to improve their own models, with activity involving reasoning, coding and other capabilities.

The agencies described the use of methods such as fraudulent accounts and proxy routing to circumvent restrictions. The advisory also recommended defensive measures that AI providers could use to identify and mitigate high-confidence attempts at unauthorised capability extraction.

The companies named should not all be assumed to have engaged in identical conduct. An agency advisory may describe different methods, model targets and evidence across its examples. Readers should consult the underlying advisory for those distinctions rather than assume that every statement applies equally to every company.

## China’s response

China’s Ministry of Commerce rejected the US allegations on September 9, arguing that they lacked a factual and legal basis. The ministry described distillation as a normal technical and commercial practice in the AI industry and accused Washington of politicising the issue to restrict competition.

China also warned that it would take countermeasures if the United States used the allegations to justify actions against Chinese AI companies.

The [ministry’s published response](https://english.mofcom.gov.cn/News/SpokesmansRemarks/art/2026/art_9b97b0c7213742c9946830e5aa6c923d.html) is an official statement of China’s position. It is not independent verification of the underlying allegations, just as the US advisory is not a judicial determination of every claim it contains.

The dispute therefore has two distinct elements: the US agencies’ assessment of alleged unauthorised extraction and the Chinese government’s rejection of that assessment.

## What Anthropic reported after the advisory

Anthropic published its report, [Detecting and countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026), on September 10. It said that, since its first disclosure in February, it had identified and disrupted additional distillation campaigns involving seven China-based labs.

Anthropic’s report describes its own investigations into activity targeting Claude. It discusses the use of fraudulent accounts and proxy services, attempts to obtain detailed model reasoning, and cases in which requests from other AI services were allegedly routed through Claude. The report also raises concerns about user information that may have been passed through third-party services.

The seven-lab figure belongs to Anthropic’s broader reporting. It should not be added to the six-company count in the US agencies’ advisory as though the two reports used identical definitions, evidence or time periods. The reports overlap in topic, but their scopes are not necessarily the same.

Anthropic’s report is a company’s account of its own investigation. It supplies additional detail about alleged activity on its systems, but the claims should remain attributed to Anthropic unless independently established.

## What changed on October 12?

In its [October 12 update](https://www.anthropic.com/news/distillation-defenses), Anthropic said it had strengthened its defences against distillation attempts. The company reported that early evidence suggested its methods had reduced the amount of data harvested by distillers by approximately 90–99%.

Anthropic described a combination of measures aimed at detecting suspicious request patterns, blocking high-confidence extraction attempts, restricting abusive accounts and making internal reasoning less useful for unauthorised model training.

The company’s percentage is an estimate based on its own early evidence, not a universal or independently verified measure of all distillation attempts across the AI industry. The reported improvement does not mean that every attempted campaign has been prevented or that the broader dispute has been resolved.

The October update is nevertheless relevant because it shows that the response has moved beyond the initial public accusations toward technical measures intended to reduce the effectiveness of unauthorised extraction.

## What does this mean for AI developers?

The dispute highlights the difficulty of distinguishing legitimate model research from unauthorised capability extraction. Distillation can be useful and lawful, but large-scale extraction that uses deceptive access methods may raise questions involving service terms, intellectual property, security and data protection.

AI providers can respond through access controls, account verification, traffic analysis and technical safeguards. Those measures can also affect legitimate researchers and users, so providers must balance abuse prevention against fair access and reliable service.

Companies using third-party model-routing services should also understand where requests are sent and how the service handles prompts, responses and sensitive information. Users may not realise that a service is forwarding their inputs to a different model provider or retaining exchanges that could later be used for other purposes.

The allegations in this dispute make those questions important, but they do not establish that every third-party AI service or every distillation workflow is unsafe or unlawful.

## The diplomatic context

The September 8 US advisory was issued ahead of the September 23–25 state visit by Chinese President Xi Jinping to Washington. The visit has since concluded. The [White House’s September 25 statement](https://www.whitehouse.gov/releases/2026/09/president-trump-first-lady-conclude-historic-china-state-visit/) confirms the end of the visit.

The AI dispute formed part of a broader relationship that also includes trade, technology restrictions and national-security concerns. The timing of the advisory was politically relevant, but timing alone does not establish that the allegations were made for a particular diplomatic purpose.

US officials said that sanctions or Entity List designations could be considered if conduct crossed the relevant legal thresholds. That warning should not be described as proof that sanctions were imposed as a result of the September advisory. Any later designation or enforcement action must be verified against the specific official notice.

## What remains unresolved?

Several questions remain separate from one another:

- Whether each allegation in the US advisory can be independently established.
- Whether the conduct attributed to each company violated applicable laws, contracts or access restrictions.
- How the US agencies’ findings compare with Anthropic’s separate investigations.
- How effective the latest technical safeguards will remain as suspected actors adapt their methods.
- Whether any later sanctions, legal proceedings or other formal measures have been announced.

The evidence should be assessed claim by claim, with the agency or company making each allegation clearly identified. Distillation itself is a recognised technical method; the dispute concerns the specific alleged conduct, scale, authorisation and methods used in particular cases.

**Current status as of October 28, 2026:** The September 8 US advisory remains the basis for the allegations against the six named firms. China has rejected those allegations. Anthropic has since published broader findings involving additional China-based labs and reported technical measures intended to reduce unauthorised data extraction. These developments do not, by themselves, amount to a judicial determination of the claims against the named companies.

**Sources:** [NSA, CISA and FBI joint cybersecurity advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a); [Reuters, September 9, 2026](https://www.investing.com/news/economy-news/us-accuses-chinese-ai-firms-of-industrialscale-theft-of-ai-technology-4892191); [China’s Ministry of Commerce, September 9, 2026](https://english.mofcom.gov.cn/News/SpokesmansRemarks/art/2026/art_9b97b0c7213742c9946830e5aa6c923d.html); [Anthropic, September 10, 2026](https://www.anthropic.com/threat-intelligence-report-september-2026); [Anthropic, October 12, 2026](https://www.anthropic.com/news/distillation-defenses); [White House, September 25, 2026](https://www.whitehouse.gov/releases/2026/09/president-trump-first-lady-conclude-historic-china-state-visit/).