IA · 10 September 2026 · 4 min read
Operation Distillation: US Intelligence Accuses Chinese Labs of Cloning Frontier AI Models
In brief: A joint security advisory from the NSA, CISA, and the FBI has formally accused six leading Chinese artificial intelligence companies of systematically cloning the capabilities of US frontier models through industrial-scale distillation. Relying on proxy networks, millions of fake accounts, and advanced prompt injection to uncover hidden chain-of-thought reasoning, Chinese labs reportedly saved billions in training costs. Washington is now urging AI providers to implement aggressive defenses, including the silent downgrading of outputs served to suspicious accounts.
by Team Mocchi's
The geopolitical battle over artificial intelligence has moved beyond trade disputes and squarely into the realm of national security. In an unprecedented joint advisory, the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the FBI have formally accused six Chinese tech companies of conducting sustained, coordinated operations to siphon proprietary capabilities and intellectual property from leading American AI models. The federal agencies explicitly named several major players in China's AI ecosystem: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI.
As reported by Ars Technica, the campaigns date back to at least late 2024 and were likely carried out with the awareness of the Chinese government. The core of the operation was not direct source code or weight theft, but industrial-scale model distillation: querying leading US foundation models across millions of scenarios to extract their reasoning capabilities and train domestic models at a fraction of the original research budget.
Anatomy of Distillation: Proxies, Swarms, and Prompt Injections
The intelligence dossier outlines a sophisticated operational infrastructure designed to evade geographic restrictions and automated bot protections. To obscure their origins, the Chinese entities allegedly routed queries through expansive gray-market residential proxy networks, distributing their traffic across tens of thousands of seemingly unrelated endpoints.
These account swarms—often fueled by bulk purchases of enterprise-tier subscriptions shared across entire engineering teams—executed repetitive query templates focusing on complex domains. Federal agencies documented query volumes ranging from thousands to millions of requests over periods of weeks or months, systematically querying frontier systems from Anthropic, OpenAI, Google, and xAI.
Crucially, the attackers developed tailored prompt injection techniques aimed at bypassing guardrails and forcing models to reveal their internal chain-of-thought (CoT) reasoning. In one prominent example highlighted by investigators, DeepSeek allegedly engineered prompts that instructed target models to imagine, reconstruct, and articulate the granular intermediate logic behind their final outputs. By capturing this underlying synthetic reasoning, Chinese researchers were able to train highly performant models without incurring the massive capital expenditures associated with foundational pre-training.
Washington's Countermeasure: The Silent Downgrade
Faced with an asymmetric tactic that directly threatens the US lead in the AI sector, the joint advisory does more than sound the alarm; it prescribes novel defensive protocols for cloud providers and model operators. Beyond enhanced heuristic tracking of proxy infrastructure and repetitive prompt patterns, federal agencies are recommending a subtle honeypot tactic: silent downgrading.
Instead of banning flagged accounts—which immediately signals detection and prompts attackers to cycle proxies and identities—providers are encouraged to surreptitiously switch suspicious queries to older, less capable, or degraded models without notifying the user. Under this scheme, illicit distillation pipelines continue to burn developer resources and API credits while harvesting inferior or poisoned synthetic data, systematically undermining the performance of the derivative models being trained.
Collateral Friction for Enterprise Developers
While designed to counter state-sponsored industrial espionage, these defensive measures could trigger significant friction across the broader software development landscape. To catch sophisticated distillation rings, AI providers are already stepping up anomaly detection, lowering rate limits, and implementing stricter identity verification across inference APIs.
For enterprise software teams and developers utilizing high-throughput API pipelines for lawful workflows—such as synthetic data generation, document processing, or large-scale automation—the risk of false positives is rising. The broader tech community is increasingly concerned that aggressive behavioral filtering and stealth model switching could introduce unpredictable latency and degrade service reliability without clear recourse for affected developers.
Mocchi's take
This confrontation puts an end to the era of friction-free, naive access to frontier AI APIs. For software engineering teams and European companies building production-grade intelligence, the takeaway is stark: machine reasoning and synthetic thinking trajectories are now closely guarded intellectual property defended with counterintelligence playbooks. When architecting enterprise AI solutions, we can no longer treat cloud endpoints as infallible commodities; we must incorporate continuous validation benchmarks to verify that output quality has not been silently compromised by aggressive anti-scraping filters. Ensuring robust application authentication, maintaining verifiable transparency with infrastructure vendors, and auditing inference consistency will be vital to keeping enterprise automation resilient in an increasingly contested AI landscape.