CISA Names Six Chinese AI Firms in Billion-Token Model Theft Advisory
What happened
CISA, NSA, and the FBI issued a joint advisory identifying six Chinese AI companies, specifically DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, as responsible for industrial-scale model distillation attacks on frontier AI systems from Anthropic, OpenAI, Google, and xAI. The agencies assess that these firms have been operating since at least late 2024, using fraudulent account networks, proxy infrastructure, and automated failover routing to evade detection while extracting billions of tokens from commercial model APIs. The advisory characterizes the activity as likely conducted with awareness, if not active support, of the Chinese government, framing it as a national-level economic and technology transfer threat. Enterprise teams are specifically instructed to implement behavioral anomaly detection, watch for indicators such as sustained non-human usage patterns and coordinated switching between access routes, and to modify API responses when distillation is suspected. This advisory follows earlier research on distillation risk and is consistent with the broader pattern of AI model theft targeting documented in Google Mandiant's report on extortion crews targeting proprietary AI models.
Why it matters
- ·Any enterprise that exposes AI model capabilities through an API is now squarely within the scope of a named federal threat advisory, creating a direct obligation to assess whether API access controls, usage monitoring, and anomaly detection are adequate to detect and interrupt distillation-style extraction attempts.
- ·The explicit naming of DeepSeek, Moonshot AI, Alibaba, and MiniMax in a joint CISA-NSA-FBI advisory fundamentally changes vendor risk calculus: procurement teams must now evaluate whether use of these vendors' models creates secondary exposure, including the possibility that those models were built in part on unlawfully extracted knowledge from the same frontier systems their own organization relies on.
- ·The advisory signals that API behavioral monitoring is no longer a best practice but an expected control; organizations that have deployed frontier model APIs without usage-pattern analysis, rate-limit governance, or automated anomaly flagging now face a documented gap that regulators and auditors can point to directly.
Governance controls affected
What to do now
- ☐Review all API access policies for frontier model integrations and verify that behavioral anomaly detection is in place to flag continuous non-human usage patterns and coordinated access-route switching.
- ☐Assess whether any vendor relationships involve DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, or Z.AI, and escalate those relationships through your AI vendor risk process given their explicit naming in the federal advisory.
- ☐Update AI vendor due diligence questionnaires to include questions about the source of training data and whether the vendor has been named in any government security advisories related to model theft.
- ☐Brief your API security and SOC teams on the specific indicators described in the advisory, including sustained high-volume non-human access patterns and rapid switching between proxy routes, and confirm detection rules are active.
- ☐Engage legal counsel to assess whether the advisory creates any reporting obligations, contractual notification duties to frontier model providers, or documentation requirements under existing information security policies.
What to watch next
Compliance teams should monitor whether CISA or the FBI issue follow-on enforcement actions or sanctions designations targeting the six named firms, which would immediately trigger supply chain termination obligations for any organization with active vendor relationships. The advisory may also accelerate legislative momentum behind proposals such as the America's AI Action Plan, which has flagged technology transfer as a priority concern, as well as export control expansions that could affect how enterprises procure and deploy models originating from named jurisdictions. Teams operating under the NIST Artificial Intelligence Risk Management Framework Playbook should evaluate whether the advisory warrants an update to their threat model and vendor risk register, particularly for any use case where proprietary data or model outputs flow through third-party API infrastructure.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.