The US named six Chinese AI firms for distillation - what it means if your automation runs on their models

What happened

On September 8 the NSA, CISA and FBI published a joint advisory, AA26-251A, naming six China-based AI companies for what they call aggressive and targeted distillation campaigns against US frontier models running since at least late 2024. The named firms are DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI. Distillation here means training a smaller model on the outputs of a larger one. According to the advisory, these firms pulled billions of tokens across millions of requests from Claude, GPT, Gemini and Grok to generate synthetic training data, and DeepSeek's often-quoted $5.6 million training cost for its R1 model leaves out the value of the data it acquired this way.

The advisory is aimed at the US labs, not at their downstream users. Its main recommendation is that providers watch for anomalous account patterns and share detection intelligence with each other. One suggested mitigation, feeding altered responses to suspected malicious accounts instead of banning them outright, is the part worth reading closely.

What is genuinely new

Governments have complained about DeepSeek before. What is new is a formal, numbered advisory with six named companies and an explicit call for US providers to coordinate detection. That moves the issue from commentary into something procurement and security reviewers will cite by number.

The models themselves are not accused of anything, and nothing in the advisory restricts their download or use. Kimi, Qwen, GLM and DeepSeek R1 still run, still benchmark well, still cost a fraction of the US frontier models. What changes is the paper trail. If you deploy one of these models in a business context, you can now be asked where its training data came from, and "it was cheap and it works" is a weaker answer than it was a week ago.

What it means for a business owner

A lot of low-cost agent work quietly runs on Chinese open models. If some of yours does, three practical things follow.

Provenance is now a question you should expect. A client, an insurer, or your own compliance reviewer can reasonably ask which model sits inside a pipeline and what is known about how it was trained. Have that answer written down before someone asks for it.

The silent-degradation suggestion cuts both ways. The advisory encourages US providers to give suspected distillers worse output rather than cut them off. High-volume automated traffic, such as batch jobs, evaluation runs, or a new account that immediately runs at capacity, is exactly the pattern that can look like bulk extraction. If your automation hits an API hard in a way that resembles scraping, you are trusting that the provider's detection is accurate. That is a new operational risk. It is small, but it argues for staying on named business accounts rather than routing through anonymous resale gateways.

This does not mean tear everything out. For most internal automation, such as summarising tickets, drafting replies, or classifying documents, the model's country of origin is not a material risk. The place to be careful is anything customer-facing, regulated, or contractually held to a provenance standard. There, the cost of moving to a US or European model is now easier to justify than it was.

The honest caveat

The advisory is an accusation, not a court finding, and the named companies have not publicly responded. It also gives downstream users no instructions at all. Read on its own, it changes very little for a small business automating back-office work. The risk it raises is mostly reputational and contractual, and it falls hardest on companies that sell AI services to larger clients who have their own compliance teams. If that is not you, noting it and moving on is a defensible response.

There is also no evidence yet that any provider has degraded a real customer's output over this. The concern is forward-looking, not a problem anyone has reported hitting.

What to do about it

Make a short list of which models your automations use and where each one is hosted. For anything customer-facing or regulated, add the training-data provenance you can actually substantiate, and mark the ones where the honest answer is "unknown." That list takes about an hour to build. It is the thing you will be glad to have the next time a client sends a security questionnaire.