The NSA, CISA and the FBI published a joint advisory on Monday naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The six companies, the agencies write, “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” since at least late 2024, likely with Chinese government awareness.

The technique is distillation: query a stronger model at scale, save the answers and train a cheaper model on them.

Accusations of this kind have come from the labs before.

This is the first time the US government has put its name to one, and the first time anyone has published a list of which American models each Chinese company may have copied.

The advisory lists the targets company by company .

  • Claude and GPT appear on all six lists. Gemini appears on three and Grok on two.
  • Moonshot is accused of pulling Claude Fable 5 output to train its Kimi-K3 model and GPT-4o output for Kimi-K2.
  • DeepSeek is accused of drawing on Claude, GPT and Gemini to generate training data for its R1 and V3 models.
  • Z.AI’s list runs to GPT-5.5 and Claude Opus 4.8, models that are months old.

The tactics were fraudulent accounts, bulk premium subscriptions and proxy services that the advisory calls transfer stations, used to hide the origin of the traffic.

The scale matches what the labs had already reported.

In February, Anthropic said it had traced more than 16 million exchanges across about 24,000 fraudulent accounts to DeepSeek, Moonshot and MiniMax. In June it accused Alibaba of running 25,000 fake accounts through 28.8 million exchanges in three months.

A single proxy network managed more than 20,000 accounts at once.

Two labs’ outputs were worth copying to every company on the list, and the list is a better guide to competitive position than any benchmark table.

The DeepSeek Moment, Annotated

On Jan. 27, 2025, Nvidia lost $589 billion of market value in a single session.

The trigger was DeepSeek’s R1, a model that appeared to match American frontier reasoning at a fraction of the training cost. The market read it as proof that frontier capability had become cheap, which would mean less demand for the chips that produce it.

Cheaper models, the thinking went, meant fewer chips.

The advisory describes how that cost was reached: “The company targeted specific knowledge domains to extract proprietary functionality and reasoning capabilities to reduce their compute and research costs.”

That sentence is about DeepSeek, and it covers the period in which R1 was built. The efficiency the market priced that day was real, and part of it was borrowed from the models it was supposed to undercut.

A copy is cheap because someone else paid for the original, and the original still has to be trained on the same chips. The copying continues on schedule.

DeepSeek’s changelog this week records the release of V4.1 Flash, which the company says beats its own V4 Pro on performance, cost and speed. From September 14 it will route all V4 Pro traffic to the new model.

The advisory named DeepSeek on Monday, and DeepSeek shipped on Thursday.

The advisory’s recommendations are aimed at the American labs, and one of them is unusual.

Alongside detection and intelligence sharing, the agencies tell providers to “subtly alter responses for suspected malicious distillation attempts to attenuate payoffs.”

The government is asking the labs to serve degraded answers to accounts they suspect, rather than block them, so that the harvested data is quietly worse.

Anthropic said in February that it had already built classifiers and behavioral fingerprinting for this. It also described “model-level safeguards designed to reduce the efficacy of model outputs for illicit distillation,” with a promise to do it without degrading the experience for legitimate customers.

The advisory turns that lab practice into the recommended national standard.

The cost of that standard lands on the API business.

Every request from an unfamiliar account now carries a judgment about whether to answer it fully, and a wrong judgment either feeds a competitor or shortchanges a paying customer.

Selling intelligence by the token now includes the cost of deciding who deserves the real thing.

Anthropic’s prospectus, expected within weeks, will price an API business that carries that cost and, as of Monday, an official statement that its output is worth stealing.