AI Distillation: China’s Latest Insider Attack Angle

China spent decades recruiting scientists to bring expertise into its own institutions. AI distillation offers a faster route through ordinary commercial model access, without recruiting the people who developed the capability.

How China learned to recruit models instead of people

For years, China’s talent programs recruited researchers who held trusted positions in Western institutions. Funding and professional opportunities helped move U.S.-developed knowledge into Chinese organizations, sometimes alongside undisclosed commitments or competing claims to intellectual property. Parts One and Two of our series, China’s Insider Advantage, trace that system from national policy to documented insider risk cases.

Efforts to acquire outside capability continue even now, but the route doesn’t always require a subject matter expert.

When commercial access becomes an extraction pipeline

On September 8, 2026, CISA, the NSA, and the FBI published joint advisory AA26-251A. The agencies named six China-based companies that used industrial-scale distillation campaigns to extract proprietary capabilities from U.S. frontier AI models. The companies turned commercial model access into an extraction pipeline, distributing millions of requests across accounts and outside services.

China doesn’t need the original source code or model weights. Distillation campaigns can collect enough outputs to help other systems reproduce capabilities that U.S. labs had spent years developing.

That’s the insider risk problem at the center of an AI distillation attack. These campaigns abuse commercial access and bypass restrictions to obscure where requests originate.

Part Three of China’s Insider Advantage will examine this shift more closely. Consider this the trailer.

What is an AI distillation attack?

Model distillation is a legitimate and widely used way to build smaller, less expensive AI models. A developer can train a model on the outputs of a more capable one, allowing it to reproduce some of the larger model’s behavior at a lower cost.

A distillation attack applies the technique through deceptive or unauthorized use. Instead of licensing a model or stealing its underlying code, an operator sends large volumes of carefully designed queries through commercial accounts. Those responses become the training data for another system.

The attacker doesn’t need the original model. It needs enough examples to reproduce valuable parts of how the model reasons, writes code, or uses tools. In February 2026, public reporting from a major AI provider described campaigns that generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts.

The resulting model can run locally, beyond the original provider’s controls. Provider research warns that copied capabilities may then spread without the safeguards applied to the original system, creating national security concerns when they support cyber operations or other sensitive uses.

This method differs from China’s traditional talent recruitment system, but the strategic demand is similar. Talent programs work by recruiting people with valuable expertise. Distillation campaigns use model access to acquire capability without recruiting the people who developed it.

Six companies, one pattern

Provider research showed that distillation campaigns were already underway. The federal advisory then expanded the picture from three companies targeting Claude to six companies extracting capabilities from U.S. models. The agencies said the campaigns had collected billions of tokens through millions of exchanges since at least late 2024, “likely with Chinese government awareness.”

Each company pursued capabilities that could improve its own AI models. To collect those outputs without exposing the larger operation, the campaigns spread requests across commercial accounts and intermediary services. Blocking one account or access path didn’t necessarily stop the wider campaign.

One of the advisory’s most consequential findings wasn’t the volume. The agencies concluded that distillation has become “the critical core” of these companies’ model development strategy.

Here are the companies named in the advisory and the capabilities they reportedly sought to reproduce:

These findings come from provider research and a joint federal advisory. Together, they describe commercial AI access being repurposed for systematic capability extraction.

The real prize was the capability

These campaigns try to reproduce the capabilities behind the answers. Reasoning traces are especially valuable because they can show how a model approaches complex work.

CISA’s advisory describes DeepSeek prompts that instructed models to imagine the reasoning behind a finished answer and write it out step by step, harvesting chain-of-thought the provider doesn’t normally expose. Those outputs could help train another model to perform similar analytical and agentic tasks.

The campaigns also targeted coding and other specialized functions that took years of research to develop. This gave competitors a faster route to capabilities they would otherwise have to build independently.

That changes how we should think about the U.S. lead in frontier AI. A competitor doesn’t have to close the research gap alone if it can query the systems ahead of it and turn their outputs into training data. Commercial access made the lead easier to erode.

Built for labs, but relevant to everyone else

CISA’s recommendations are directed largely at frontier model providers. Those companies can see coordinated account behavior and share intelligence that can expose activity spread across services. The advisory also recommends changing responses to suspected distillation attempts, potentially by routing them to less capable models.

Useful guidance, if you operate a frontier model.

Most organizations don’t. They can’t monitor a distillation campaign moving across outside providers or change how those providers respond. Their exposure is different, but it begins with the same problem: access can be used in ways the organization never intended.

Here’s where it stops being someone else’s headline. Employees and AI agents routinely send company information to commercial models. An employee may use an approved AI tool but enter data company policy doesn’t allow. Once that work reaches an external service, the organization’s control depends on the provider’s terms and contractual protections, and the same commercial access these campaigns exploited is the access your own people use every day.

Approving an AI service doesn’t settle what people will put into it. Organizations still need to know when company information reaches the tool and whether policy allows it.

What comes next

Advisory AA26-251A documents what six companies reportedly did. The harder question is where the extracted capability goes next.

This advisory is the clearest confirmation yet of something the field has understood for a while, with a catch most coverage misses: now that the method works, countries that arrived late to frontier AI aren’t building their own research programs from scratch. Chinese open-weight models can give other actors a foundation for developing AI capabilities. If those models benefited from capabilities distilled from U.S. systems, the effects travel well beyond the companies that conducted the original campaigns. Reinforcement learning from simulated data is becoming the preferred way to train the next generation of these systems, which points to another shift in tactics rather than a retreat from this one. Closing the accounts won’t reverse a capability that has already been reproduced and distributed.

This is a forward-looking risk, not a claim that every country using a Chinese model benefited from malicious distillation. The six companies named in the advisory show that industrial-scale extraction is no longer theoretical. Other actors can study the same playbook and adapt it.

China’s talent programs and AI distillation use different channels to satisfy the same demand for expertise. One method recruits a person. The other extracts capability through model access.

China once needed a recruiter to reach outside capability. Now, a commercial account may be enough.

DTEX i³ examines how trusted access can become a channel for capability transfer, whether it begins with a person or an API. Request a threat briefing to understand where your organization may be exposed.