A rival just trained its model on your customers.
No exploit, no stolen weights and no alert, because every request was a legitimate paid call.
On September 8, 2026, CISA, the NSA and the FBI published a joint advisory, AA26-251A, on industrial scale knowledge distillation campaigns against US frontier AI models.
The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and states they extracted billions of tokens across millions of requests from variants of Claude, GPT, Gemini and Grok since at least late 2024.
Model theft has moved off the weights and onto the API, which puts the control that catches it inside the one system most teams treat as a billing surface rather than a security boundary.
Distillation is a legitimate research technique. The advisory's complaint is about scale, and it describes this activity as "the core, not merely a supplement" of those companies' model development.
Requests arrive through native APIs, remote cloud providers and third party aggregators that obscure user metadata, plus a gray market of proxies the advisory calls "transfer stations".
Those proxies exist to defeat geographic restrictions, breach terms of use and, in the agencies' wording, undermine traceability.
The economics are deliberately dull. Premium subscriptions are bought in bulk and shared across teams of developers, which is why the advisory calls DeepSeek's widely quoted $5.6M training cost misleading, since it excludes what was spent acquiring the data.
The sharpest technique is reasoning extraction. Prompts are written to make a model narrate the step by step thinking it is not supposed to expose, which teaches a student model methods rather than answers.
If you are building detection for this, start with prompt evaluation engineering, because the signal sits in the prompt patterns rather than in the payloads.
This is also an adaptive adversary. MiniMax moved its exchanges onto a newly released Claude model within 24 hours of that model shipping, and used prompt injection in an attempt to convince Claude Code that it was a MiniMax product.
The detail gets specific company by company. DeepSeek targeted reasoning, domain specific functions and agentic capabilities for its R1 and V3 models, with Claude Sonnet 4.5, GPT-5 and Grok 4 named among the sources.
Alibaba ran the same play to improve its Qwen models, Moonshot AI used GPT-4o data for Kimi-K2 and Claude data for Kimi-K3, and StepFun and Z.AI followed the pattern into coding and reasoning.
<small>DeepSeek is the most detailed case in the advisory. Logo by RoadMaster19 via Wikimedia Commons, CC BY 4.0.</small>
The account layer looks equally ordinary. Registrations share similar details and payment methods, the same accounts hop between vendors, and coordinated queries repeat near identical prompt text.
Volume on a single topic runs from thousands of requests to millions, which the agencies treat as far beyond legitimate use.
This is the same AI account takeover problem that platform teams have been slow to own, arriving as a research cost line instead of a breach.
The document is unusually direct for a field that argues about attribution for years. CISA Acting Director Nick Andersen said the agencies "strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies".
The agencies also map the behaviour to MITRE ATLAS, covering infrastructure acquisition, inference API access, prompt injection, jailbreaking and attack verification.
That mapping is the useful part for defenders, because it turns a strategic warning into phases you can write detection logic against.
Agentic capabilities appear in almost every extraction list, which is one reason LLM agents and tooling deserves the same review as your inbound traffic.
What an API team can do this week
- Measure the shape of usage, not the volume. The first recommendation is to track subscription to usage ratios, new accounts that hit their cap immediately, and throughput patterns that only make sense for a machine, all of which can be built from logs you already keep.
- Attenuate the payoff instead of only blocking the tap. The second recommendation is to subtly alter responses for suspected distillation attempts, trading a little answer quality for training data that is worth less, because the advisory documents automatic failover between pathways the moment a provider blocks.
- Share signals across providers, clouds and aggregators. The third recommendation is cross organization intelligence sharing, since no single company sees the whole campaign, and a small team can start by correlating its own aggregator, reseller and cloud logs in one place.
There is an uncomfortable trade in that list.
Every control costs something you would rather keep: signup friction, degraded answers for a paying customer, and a shared view of your traffic with the companies you compete against.
Nothing in these campaigns looks like an incident. There is no malware, no leaked customer record and no ransom note, so it rarely reaches the queue where security work gets prioritised.
That is why it works. The traffic is authenticated, funded and polite, and a competitor's model simply gets a little better every quarter.
The old assumption was that the crown jewels sit in the weights, which is why the wall went up around the training cluster.
The new reality is that they sit in the response stream, which means the wall belongs around a metered endpoint that anyone can rent by the hour.
If you run a model endpoint, which single signal would you trust to separate a heavy paying customer from a distillation operation, and what would it cost you to get that call wrong?