This is not a data breach. This is the systematic theft of how our most advanced AI systems think.
On September 8, 2026, the NSA, CISA, and FBI issued joint advisory AA26-251A — formally accusing six Chinese AI companies of running an industrial-scale operation to reverse-engineer the reasoning capabilities of America's most powerful AI models. Not by stealing weights or source code, but by methodically extracting the knowledge and chain-of-thought logic embedded within them through millions of coordinated API queries.
The activity has been running since at least late 2024. And the agencies assess it was likely conducted with the awareness of the Chinese government.
What Happened
The advisory describes coordinated campaigns to distill the reasoning architectures of four frontier AI systems: Anthropic Claude, OpenAI GPT, Google Gemini, and xAI Grok. This isn't researchers poking at an API — it's a mature, resourced industrial operation with shared infrastructure, automated failover, and quality evaluation frameworks designed to detect when providers start fighting back.
The scope is staggering. Across six accused companies, virtually every major Western frontier model was targeted. And the techniques described reveal an operational playbook that goes far beyond simple prompt-and-collect extraction.
The Accused
The advisory maps specific extraction campaigns to each company with unusual specificity:
- DeepSeek — Targeted reasoning capabilities for its R1 and V3 models. The advisory essentially provides a framework for understanding how DeepSeek shipped competitive reasoning models at a fraction of Western development costs.
- Moonshot AI — Extracted Claude Fable 5 data to build Kimi-K3, and targeted GPT-4o for Kimi-K2. Two frontier models, two extraction campaigns, one company.
- Alibaba — Distilled from Claude-4, Claude Opus, Claude Sonnet, and GPT-5. Four frontier models across two providers — the broadest extraction portfolio in the advisory.
- MiniMax — Distilled from Claude Code, Claude Sonnet 4, and the Gemini series for its M2 model. Notably, Claude Code — Anthropic's agentic coding system — was specifically targeted.
- StepFun — Targeted Claude Opus 4.1, Claude Opus 4.5, and the GPT-5 series for Step 4.
- Z.AI — Extracted GPT-5.5 and Claude Opus 4.8 specifically for chain-of-thought reasoning. They weren't copying outputs — they were reverse-engineering the thinking process itself.
The pattern: every major Western frontier model in someone's crosshairs, with surgical focus on reasoning architectures rather than surface-level outputs.
How They Did It
The extraction infrastructure is where this advisory gets genuinely alarming:
- Bulk premium subscriptions shared across developer teams — buy premium API access at scale, distribute across teams, generate millions of carefully crafted prompts. Individual queries look normal. The aggregate tells a different story.
- API abuse through remote cloud providers and third-party aggregators — route requests through intermediary services to obscure user metadata and geographic origins. The provider sees legitimate traffic. The reality is an extraction pipeline.
- Transfer stations — gray market proxy networks designed to bypass geographic restrictions. Requests get laundered through multiple hops and arrive at the API endpoint looking like they came from somewhere else entirely.
- Automated failover between pathways — when one route gets blocked, the system shifts to another. This is operational resilience applied to theft.
- Chain-of-thought extraction — campaigns specifically target the intermediate reasoning steps models produce during complex problem-solving. This is the difference between copying someone's homework and copying their brain.
- Quality evaluation frameworks — extraction teams built systems to detect when providers alter responses to poison distillation data. When defenses are detected, the campaign adapts. It's an arms race.
Why This Changes AI Security
The advisory reframes the entire AI security conversation. For two years, the focus has been on prompt injection, jailbreaking, and data leakage. AA26-251A reveals a different attack surface: the reasoning architecture itself.
Here's the uncomfortable truth — every API call is a potential extraction vector. Every response the model generates is a window into its capabilities. At industrial scale, those windows become wide enough to reverse-engineer the entire building.
This isn't a software vulnerability you can patch with a CVE. It's a structural feature of how AI-as-a-service works. The way we've been building and deploying models leaves the doors open to systematic extraction of the most valuable IP in technology — reasoning capabilities that took billions of dollars and years of research to develop.
What CISA Recommends
The advisory lays out three primary defenses:
- Comprehensive detection and mitigation of anomalous prompts, accounts, and network patterns. Build AI-specific threat detection — coordinated prompt patterns, shared account usage, and traffic through known proxy infrastructure.
- Subtly alter responses for suspected distillation. Don't just block — poison. Modify outputs so extracted data doesn't faithfully represent the model's true capabilities. The adversary doesn't know they're getting degraded data.
- Cross-organization intelligence sharing. No single provider sees the full picture. Detection signatures, proxy indicators, and campaign profiles need to flow across the ecosystem. The adversary is coordinating across six companies; the defense must match that coordination.
The Bigger Picture
The advisory notes 35,853 CVEs published in H1 2026 — a 49% increase over H1 2025. AI model distillation isn't an isolated issue but part of a broader landscape of escalating threats.
But distillation operates in a gray zone. A CVE exploit breaks a system. An extraction campaign learns from a system — extracting value without technically breaking rules that current security models recognize. It's the most sophisticated IP theft in technology history, operating in the gap between what's legal and what's possible.
The economic implications are enormous. Training frontier models costs billions. Successful distillation compresses development from years to months and costs from billions to millions. That's not competitive advantage — it's a fundamental reshaping of AI economics, subsidized by someone else's R&D investment.
What This Means for Your Organization
- Audit your AI supply chain. Understand where your data flows through third-party APIs, cloud providers, and aggregators. Know who else is using the same pipes.
- Implement distillation detection. Monitor for the systematic, high-volume prompting patterns that characterize extraction campaigns. This is new territory — invest in it.
- Prepare for the arms race. If you're a provider, response perturbation is now a defensive tool. If you're a consumer, assume the models you build on may be compromised at the reasoning level.
- Share intelligence. Cross-organization information sharing isn't optional — it's existential. If one provider detects a campaign, every provider needs to know.
- Reassess your competitive landscape. If you're competing against models from any named company, their development timelines and costs may not reflect genuine independent capability.
The age of open API access without consequences is over. The thinking itself is the asset — and assets this valuable need protection.
At aratech, we help organizations navigate the evolving AI security landscape. If this advisory raised questions about your strategy, let's talk.