US agencies accuse DeepSeek and Alibaba of AI model theft

U.S. agencies say six Chinese AI firms, including DeepSeek and Alibaba, extracted the guts of American frontier models through industrial-scale distillation.

The NSA, CISA, and FBI joint Cybersecurity Advisory AA26-251A, released 8 September 2026, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The paper is an advisory, not an indictment, not an Entity List designation, and not a courtroom finding.

The agencies say the firms pulled billions of tokens across millions of exchanges and requests from Claude, GPT, Gemini, and Grok variants since at least late 2024, likely with Chinese government awareness. They also say distillation can be a legitimate research technique.

The line they draw is aggressive, malicious, industrial-scale extraction of restricted proprietary capabilities. They call that the core of the China-based firms' development strategy, not a supplement.

Pathways named in the advisory include native APIs, remote cloud providers, third-party aggregators that obfuscate metadata, and gray-market transfer stations that bypass geographic limits and undermine traceability. The agencies also cite bulk procurement of premium subscriptions shared across developer teams.

DeepSeek is accused of organized campaigns since at least 2024 targeting reasoning, specialized optimizations, and domain-specific functions for R1 and V3. The advisory says DeepSeek's publicly quoted training cost of $5.6 million is misleading because it omits the true cost of data acquired through extensive malicious distillation.

Models listed as sources include Claude 3.7, Sonnet 4, Sonnet 4.5, Opus 4.1, Gemini 2.5 Pro and Flash Preview, the GPT-4 family through GPT-5, and Grok 4.

Alibaba is accused of industrial-scale distillation to improve the Qwen family. In late 2025, MiniMax is said to have distilled chain-of-thought, reinforcement learning, supervised fine-tuning, and software-engineering capabilities into M2 from Claude Code, Claude Sonnet 4, Claude Opus, and Gemini 1, 2.5 Pro, and 3 Pro. The advisory says MiniMax used Claude Code internally and used prompt injections to try to trick Claude Code into believing it was a MiniMax product.

Named firms have not admitted theft. Ars Technica reports China's Ministry of Foreign Affairs calling the accusations groundless. The document recommends detection, response alteration, and cross-provider sharing.

The open-weight side of that fight includes Tencent's Hy4 preview. Washington's number to remember is the one the agencies refuse: $5.6 million was never the full DeepSeek bill.

Some offers on this page may be paid placements or contain affiliate links.