CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok

A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems.

The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development.

The alleged campaigns relied on huge volumes of automated requests sent through application programming interfaces, cloud services, aggregators, and proxy networks.

CISA said in a report shared with Cyber Security News (CSN) that by collecting responses from advanced AI models, operators could create synthetic datasets designed to teach other systems how to perform similar tasks.

Analysts from the Cybersecurity and Infrastructure Security Agency, alongside the NSA and FBI, said China-based AI companies likely extracted billions of tokens across millions of exchanges from U.S. frontier models since late 2024.

The advisory describes the activity as malicious industrial-scale knowledge distillation rather than routine AI research. The reported impact reaches beyond unauthorized access to a single platform.

CISA warned that extracting reasoning, coding, agentic, and domain-specific capabilities can cut both the cost and time required to develop competitive models, creating economic and national-security concerns for the wider AI ecosystem.

CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as companies involved in campaigns targeting variants of Claude, GPT, Gemini, and Grok.

The agency said the operations appeared likely to have occurred with Chinese government awareness, although the advisory did not claim direct government control. Knowledge distillation is normally a legitimate method in which a smaller model learns from a larger one.

The concern arises when companies allegedly obtain restricted outputs from competitors at scale, then use those results to imitate protected capabilities without authorization, as seen in previous reporting on large-scale AI distillation attacks.

DeepSeek allegedly ran organized collection activity from at least late 2024 through mid-2025, seeking reasoning abilities, specialized optimization, legal functions, and writing support for its R1 and V3 models.

CISA said its public training-cost claims did not reflect the full value of data gained through alleged distillation. Moonshot AI was linked to widespread activity from at least mid-2025, including the alleged extraction of Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2.

Other reported targets included programming, mathematics, reinforcement-learning, and software-engineering functions. The advisory also said Alibaba used distillation to improve software engineering, customer service, character creation, and training workflows.

Separate reporting had already examined allegations of unauthorized Claude model extraction, illustrating how model-output collection has become a major concern for AI providers.

Proxies and Prompt Attacks

According to CISA, the operations used “transfer stations,” a gray market of API proxies that can mask user metadata and help users bypass geographic restrictions.

These intermediaries can also obscure the organization making requests, making isolated accounts look less connected than they really are.

The advisory described account pools, bulk premium subscriptions, and automated routing systems that could switch among providers when access controls changed.

It also highlighted behavior such as sustained activity around the clock, repeated use from multiple locations, immediate maximum use by new accounts, and coordinated timing across separate pathways.

Some operators allegedly used prompt injection and jailbreak-style requests to force models to disclose hidden chain-of-thought reasoning.

This is distinct from ordinary prompts because the goal is to manipulate a model into exposing protected internal processes, a risk also explored in coverage of prompt injection attack techniques.

CISA urged AI providers to strengthen identity checks, monitor unusual subscription-to-usage ratios, apply rate limits, and log requests for investigation.

Providers should also share infrastructure and behavioral signals with cloud platforms and API aggregators, since a distributed campaign may not be visible from one service alone.

The agencies further recommended targeted response changes for high-confidence malicious requests, such as reducing response fidelity or varying outputs, without alerting suspected operators.

Differential privacy, adversarial testing, stricter API controls, and measures to limit prompt injection can add layers of protection against extraction attempts.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.