The National Security Agency, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency issued a joint warning on September 8, 2026, about campaigns attributed to China-based artificial intelligence companies. According to the alert, the operations use model distillation to extract capabilities and functions from advanced AI systems developed by companies in the United States.
The warning places AI model security at the center of a growing technology and national security concern. The agencies said the activity could allow organizations to reproduce proprietary capabilities without making the same level of investment in research, computing infrastructure, energy and technical development.
The National Security Agency published the joint announcement and described the activity as a coordinated effort involving advanced models developed in the United States. The alert also provides information intended to help technology companies and infrastructure operators identify and mitigate the reported campaigns.
What model distillation means
Model distillation is a legitimate artificial intelligence research technique. It can be used to transfer knowledge or capabilities from a larger, more complex system into a smaller model that is less expensive or more efficient to operate. This approach can support the development of systems that require fewer computing resources while retaining selected functions of the original model.
The concern described by the agencies is not the existence of distillation itself. The issue is the alleged use of the technique at an industrial scale to extract proprietary capabilities from frontier models without authorization. In that context, distillation becomes part of a broader effort to obtain the results of costly research and development without bearing the full expense of creating comparable systems.
Advanced AI models demand significant investments in specialized hardware, data infrastructure, electricity, engineering and research. If external organizations can systematically reproduce important capabilities through access to other systems, developers may face additional risks involving intellectual property, competitive advantage and control over the use of their technology.
How the reported campaigns are organized
The joint alert says the operations distribute activity among different model providers, cloud platforms and infrastructure companies. Using multiple services can make it more difficult for investigators and providers to identify a single source behind a campaign, particularly when requests and computing activity are spread across several parts of the technology ecosystem.
The agencies’ guidance outlines possible tactics, techniques and procedures associated with the campaigns. It also offers recommendations for developers, cloud providers, application programming interface aggregators and infrastructure operators. The objective is to improve detection and reduce the ability of unauthorized actors to use commercial AI services to extract capabilities from advanced models.
That distribution creates a challenge for companies that may see only one portion of the activity. A model developer may observe unusual usage, while a cloud provider sees infrastructure demand and an API aggregator sees a pattern of requests. Coordinated monitoring and information sharing can help connect those signals, although the alert itself does not establish that every unusual interaction represents an extraction campaign.
Why the warning matters for U.S. organizations
The agencies’ concerns extend beyond the companies that build frontier AI systems. The alert identifies potential implications for technology businesses, government agencies, defense systems, critical infrastructure and organizations that rely on artificial intelligence tools. These groups may be affected if the security, ownership or reliability of the models supporting their operations is compromised.
For developers, the warning reinforces the importance of monitoring access to advanced models and reviewing how services are used through cloud platforms and APIs. For infrastructure providers, it highlights the need to detect activity that may be distributed across accounts, applications or hosting environments. The guidance is therefore relevant to several layers of the AI supply chain rather than only to model creators.
The FBI maintains an institutional focus on artificial intelligence and emerging technologies as areas connected to risks involving U.S. interests. The NSA’s frontier models news archive also reflects the agencies’ broader attention to advanced AI systems.
A strategic issue in the U.S.-China technology competition
The warning links AI model security with the wider competition between the United States and China over advanced technology. Frontier models are increasingly treated as strategic assets because they can support research, software development, analysis and other high-value applications. Protecting the capabilities built into those systems has consequently become a matter of both commercial security and national resilience.
The joint alert does not characterize ordinary research into model distillation as illicit. Instead, it focuses on campaigns that allegedly seek to extract proprietary capabilities from U.S. models without permission. For developers and infrastructure operators, the message is clear: security controls must address not only unauthorized access, but also patterns of use that may reveal an attempt to reproduce the behavior of an advanced system.
