Washington Names Six Chinese AI Champions in an
Unprecedented “Industrial-Scale Distillation” Advisory

On September 8, 2026, the NSA, FBI, and CISA published a joint advisory accusing six Chinese AI companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, of running systematic, industrial-scale distillation campaigns against US frontier models since late 2024, collectively extracting billions of tokens across millions of distributed queries from Anthropic's Claude, OpenAI's GPT family, Google's Gemini, and xAI's Grok.

Moonshot AI's case is treated with unusual specificity: the advisory states the company used outputs from Claude to train its Kimi K3 model, and outputs from GPT-4o for the earlier Kimi K2, a level of detail that turns a general accusation into a potentially actionable case file for export-control authorities.

Model distillation is an engineering method whereby a smaller or cheaper model is trained to reproduce the behavior of a larger one, using the larger model's outputs as the learning signal. It is a practice as old as it is widespread across the AI industry, many labs, including American ones, use it internally to compress their own models. The legal difficulty lies in the fact that the line between legitimate distillation (using a public model for benchmarking or academic research) and illicit distillation (systematic, concealed extraction for commercial appropriation of intellectual property) is technical, porous, and largely a matter of interpretation.

US agencies chose to resolve that ambiguity by focusing not on the technique itself but on three behavioral traits: the scale of the queries (billions of tokens), the systematic coverage of knowledge domains, suggesting an organized operation rather than scattered, ad hoc use, and an active effort to evade detection through distributed query campaigns, a design that, per the advisory, can only reasonably be explained by a program facilitated, if not directly orchestrated, by the Chinese state apparatus.

This advisory fits a methodical escalation dating back to February 2026, when Anthropic first accused three Chinese companies, including Moonshot, of violating its usage policies. By July, the White House had formally accused Moonshot of distilling Claude and of illegally using export-banned Nvidia GB300 chips via Thailand-based servers, and Treasury Secretary Scott Bessent warned that sanctions and Entity List designations were on the table, posting that “open source is not open season on American IP.” In early August, DeepSeek was placed on the US Entity List, its servers unreachable from US-based connections since. The September 8 advisory widens the scope of that threat to five other companies, in a move that looks less like an isolated case than the construction of a durable enforcement framework.

None of the six named companies responded publicly to requests for comment before the advisory's release. China has, in the past, rejected similar designations as security pretexts aimed at curbing its technological competitiveness. On the technical side, researchers cited by MIT Technology Review note that the line between legitimate model improvement and illicit distillation remains technically blurry, researchers worldwide routinely use one model's outputs to benchmark or train another, a practice that, at individual scale, is in no way an infringement.

Notably, roughly 200 Silicon Valley startups sent a letter to the White House and the Commerce Department, in parallel with this escalation, arguing against blocking US access to Chinese open-weight models from Moonshot and Alibaba, on the grounds that doing so would push hundreds of American startups dependent on this cheaper infrastructure into a survival crisis, an internal tension between national security and competitiveness that runs through the American ecosystem itself.

For any investment committee holding, or considering, exposure to one of the six named companies, this advisory changes the nature of the risk from a diffuse, theoretical concern into a named, documented one with a clearly identifiable escalation path: security-agency advisory, then a Bureau of Industry and Security investigation, then a possible Entity List designation and de facto ban on US semiconductors, cloud services, and software. DeepSeek's case, already on the Entity List, is a live template for what could await the other five.

The timing also matters. This advisory landed days before the first high-level US-China AI talks scheduled this same month, suggesting Washington may be positioning for negotiation as much as acting on new evidence, which means the regulatory fate of the remaining named companies could be settled, at least in part, at the diplomatic table rather than through the technical BIS process alone, a variable that is difficult to price with standard due-diligence tools.

Three checkpoints are worth tracking. First, whether other Five Eyes agencies issue their own advisories on the same distillation topic, a move that would turn a bilateral US-China case into a harder-to-defuse multilateral front. Second, the concrete outcome of the Bureau of Industry and Security's investigation into Moonshot's alleged use of Nvidia GB300 chips via Thai-based servers, a decision that will set a structuring precedent for the other five named companies. Third, whether the high-level US-China AI talks scheduled for this September actually take place, and their outcome, which could produce a negotiated compromise or a further hardening if the talks fail.