While Washington has spent years restricting China’s access to advanced GPUs, U.S. authorities now say another route has allowed Chinese AI developers to tap capabilities embedded in American frontier models. The route runs through APIs, cloud platforms and third-party networks rather than shipments of physical chips.
The National Security Agency (NSA), Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory on Sept. 8 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies allege that the six China-based companies have conducted industrial-scale knowledge distillation against U.S. frontier AI models since at least late 2024.
According to the advisory, the campaigns targeted models including Anthropic’s Claude, OpenAI’s GPT, Google’s Gemini and xAI’s Grok, involving billions of tokens across millions of exchanges. The U.S. agencies said the activity was likely conducted with the awareness of the Chinese government, an allegation Beijing rejects.
The significance extends beyond the six companies. U.S. technology controls have concentrated heavily on restricting the computing power China can obtain. Washington is now confronting a different problem: how to protect capabilities already embedded in frontier AI models when those capabilities can be accessed remotely.
The Route GPU Export Controls Cannot Block
U.S. restrictions on advanced GPUs and semiconductor manufacturing equipment have sought to constrain China’s access to the computing infrastructure required to develop cutting-edge AI. That strategy is built largely around a physical supply chain encompassing chips, manufacturing equipment and data-center hardware.
AI models operate across a different architecture. Developers do not necessarily need to possess the most advanced GPUs to gain access to frontier-model capabilities. APIs can provide remote access to powerful models, while cloud services, aggregators and other intermediaries can create additional routes between users and those systems.
Knowledge distillation itself is a legitimate and widely used machine-learning technique. A more capable “teacher” model can generate outputs that help train a smaller or less expensive “student” model. The technique is commonly used to improve efficiency and reduce development costs.
The current dispute concerns the scale and methods of that activity. U.S. authorities allege that the Chinese companies used distributed accounts and infrastructure to evade access controls and systematically extract proprietary reasoning, coding and other capabilities from American models.
The NSA, FBI and CISA say such operations could reduce the research, computing and electricity required to develop comparable capabilities independently. By linking model extraction to potential military, cyber and economic advantages, Washington has moved the issue beyond a dispute over corporate access rules and into the national security arena.
APIs, Clouds and the Networks in Between
The infrastructure identified by U.S. authorities is central to the policy challenge. According to the joint advisory, the alleged operations were distributed across model providers, cloud platforms and other infrastructure, making them more difficult to detect from any single point.
That changes the nature of enforcement. A GPU is a physical product whose shipment, destination and end user can be subject to export controls. Model access involves accounts, API requests, payment methods, IP addresses, cloud providers and intermediaries that may operate across multiple jurisdictions.
Anthropic’s latest investigation illustrates the scale that AI companies say they are encountering.
In a report released Sept. 10, Anthropic said it attributed more than 151 million Claude exchanges between May and July to activity linked to Alibaba. The company separately attributed more than 23 million exchanges to Moonshot AI during the same period and more than 12.1 million exchanges to DeepSeek over 14 days in July.
Those figures are Anthropic’s findings and have not been independently established by a court or regulator. They nevertheless show why frontier-model companies are moving beyond simply suspending individual accounts.
Anthropic says it is increasingly identifying coordinated account networks, analyzing infrastructure and transaction patterns, and deploying systems designed to detect adversarial extraction. If those measures spread across the industry, access to frontier AI models could become more tightly controlled even without new government sanctions.
From Model Knowledge to Corporate Data
Anthropic’s latest findings raise another issue that could prove important for enterprise AI users.
The company alleges that Moonshot AI and DeepSeek routed some live customer requests through Claude and used resulting exchanges in their model-development processes. Anthropic said some of those requests contained sensitive information, including corporate and government-related data.
These claims remain Anthropic’s allegations. But if the underlying practice is confirmed, it would raise a broader governance problem for companies using third-party AI services.
An enterprise may believe that its data is being processed by one AI provider while an intermediary routes some requests to another model. That would make it increasingly important to establish which underlying model actually processed a request, where the data travelled and whether another provider was involved.
Model provenance and data-routing transparency could therefore become part of enterprise AI procurement alongside performance, security and price. The question would no longer be simply which model a company uses, but what infrastructure sits behind it.
Washington Has Not Yet Played the Sanctions Card
The current policy boundary is important.
The Sept. 8 action is a cybersecurity advisory. It does not itself impose economic sanctions on the six Chinese AI companies, nor does it establish a government-wide prohibition on providing AI model APIs or cloud access to Chinese developers.
For now, the U.S. response centers on detection, mitigation and information-sharing among government agencies, model providers, cloud companies, API aggregators and infrastructure operators.
CISA Acting Director Nick Andersen urged AI companies to take immediate measures to protect their platforms against knowledge-distillation campaigns that Washington believes could narrow the technological advantage of U.S. companies.
The question is what comes next.
If Washington eventually places some of the companies under additional export restrictions, imposes financial sanctions or introduces controls governing access to frontier-model APIs and cloud services, U.S. technology policy would move significantly beyond the semiconductor supply chain.
Such a shift would also create a more difficult enforcement problem. Identifying the destination of a GPU shipment is one task. Determining who ultimately stands behind millions of API requests passing through cloud services, aggregators and proxy networks is another.
China Rejects the U.S. Allegations
Beijing has rejected the U.S. accusations and criticized what it describes as the politicization of technology competition.
China has also emphasized that knowledge distillation is a technically neutral method widely used in AI development. Following Anthropic’s latest report, China’s Foreign Ministry said Beijing supports the development of AI for beneficial purposes and opposes what it described as distortions and smears against China.
That distinction matters. The policy dispute is not over whether knowledge distillation itself should exist. It concerns whether frontier-model providers can distinguish ordinary model use and legitimate research from coordinated attempts to reproduce restricted capabilities at industrial scale.
The issue therefore reaches beyond China. Any rules eventually developed to address model extraction would have to define acceptable access, prohibited behavior and the responsibilities of intermediaries without obstructing legitimate AI research and commercial use.
The Next Signal Will Be Actual Restrictions
The Sept. 8 advisory represents an escalation because three U.S. national security and cybersecurity agencies have formally placed industrial-scale model distillation within the wider U.S.-China technology competition.
But it remains an intermediate step.
The next signals will be concrete policy actions: whether Washington places any of the named Chinese AI companies under additional restrictions because of model extraction, introduces rules governing frontier-model API or cloud access, or requires stronger controls on intermediaries that obscure the identity of end users.
The response of U.S. AI companies may arrive sooner. Stronger identity verification, coordinated intelligence-sharing, network-level detection and restrictions on suspicious intermediaries could create a private-sector layer of access control before Washington introduces formal measures.
For years, the United States has focused on limiting how much advanced computing power China can obtain. The latest confrontation introduces a second challenge: controlling access to capabilities embedded in frontier models that have already been trained.
GPUs can be stopped at an export-control boundary. AI capabilities delivered through APIs and cloud networks are harder to contain.
If Washington begins regulating those digital routes as closely as it regulates advanced chips, the U.S.-China AI contest will have entered a materially different phase.
