AI SecurityShadow AIThreat Intelligence
Most security teams have filed model distillation under somebody else's problem. It reads like a dispute between AI labs: terms of service, trade secrets, export policy, a geopolitical contest over who trains the best frontier model. Unless you are one of the four or five companies whose models are being copied, there is nothing in it for you to patch.
The joint advisory published this week is, for the most part, written for those companies. But one section of it describes infrastructure that does not belong to any AI lab and does not belong to the distillers either. It belongs to a grey market that sells cheap access to frontier models to anyone with a payment method — and the advisory, read alongside research published over the summer, makes it fairly clear who that market's ordinary customers are for.
On September 8, 2026, CISA, the NSA and the FBI released joint advisory AA26-251A, accusing six China-based AI companies of running industrial-scale distillation campaigns against US frontier models since at least late 2024. Distillation, in this sense, means querying a stronger model at volume and using its answers — and where possible its reasoning — as training data for your own. BleepingComputer summarised the scale as billions of tokens extracted through millions of requests, and CyberScoop noted the advisory's assessment that distillation is the core of these companies' development strategy rather than a supplement to it.
The named companies and the providers whose models the advisory says each targeted:
| Company | Frontier models targeted, per the advisory |
|---|---|
| DeepSeek | Anthropic, OpenAI, Google and xAI models |
| Moonshot AI | Anthropic, OpenAI, Google and xAI models |
| Alibaba | Anthropic models and GPT-5 |
| MiniMax | Claude Code and other Anthropic models, plus Google and OpenAI |
| StepFun | Anthropic and OpenAI reasoning and coding models |
| Z.AI | GPT-5.5 and Claude Opus |
The Next Web points out the careful hedge in the attribution: the agencies assess the campaigns ran likely with the knowledge of the Chinese government, which is a claim about awareness, not direction.
None of this arrived out of nowhere. In February, Anthropic published its own account of more than 16 million exchanges with Claude through roughly 24,000 fraudulent accounts, attributing over 13 million of those exchanges to MiniMax, over 3.4 million to Moonshot and over 150,000 to DeepSeek. The advisory now puts three agencies' names to a broader version of that picture.
The techniques are worth reading closely, because several of them are the same techniques used against enterprise AI deployments:
The agencies say China-based entities get around both Chinese and US access controls through a large grey market of API proxies — known as "transfer stations" — that resell access to frontier models at a fraction of the official price.
Anthropic's February post describes what one of those networks looked like from the provider's side. A single proxy operation managed more than 20,000 fraudulent accounts at once, and it mixed distillation traffic with unrelated customer requests specifically to make detection harder.
Stop on that last detail. A proxy that blends extraction traffic with ordinary requests needs ordinary requests. Volume-based detection looks for accounts whose behaviour is uniform, relentless and narrow; the cheapest way to defeat it is to pour in traffic that is varied, bursty and human. The paying customers of a transfer station are not incidental to the distillation business. They are its cover.
Who those customers are is not a mystery either. SOCRadar's July 21 research on the "dark token economy" describes unauthorised proxies selling frontier-model access at up to 90% below official pricing, concentrated in China because of geo-restrictions but positioned to grow wherever token prices rise. Academic researchers bought their test routers from Taobao, Xianyu and Shopify storefronts. The pitch is aimed at developers who want cheap coding-agent tokens, at staff in regions where a provider does not sell directly, and at anyone who has noticed that one reseller key can reach Claude, GPT and Gemini at once.
Whether anyone in your organisation is among them is a question most companies cannot currently answer — and that, rather than any specific incident, is the exposure.
A relay terminates the request. Whatever an employee pasted — a customer record, a contract clause, a stack trace with a connection string in it — passes through the operator's server in plaintext before it reaches a model. SOCRadar reports that proxy operators log every prompt and response that passes through, and that the harvested data feeds downstream fraud and distillation. In a business whose product is prompt-and-response pairs, your staff's conversations are inventory.
A July paper from researchers at Beihang University, Xidian University and HKUST, KBF: Knowledge Boundary as Fingerprint, audited shadow API platforms against official reference endpoints. 7 of 28 platform–model combinations in their six-platform audit were statistically inconsistent with the model they claimed to serve, and 6 of those 7 were Claude endpoints — the most expensive models, where substitution pays best. The cheaper resale tiers were flagged far more often than the upgraded ones. If a team's analysis, code or customer-facing output was produced through one of those endpoints, it was produced by a model nobody at the company chose.
This is where a data-handling problem becomes a code-execution problem. Your Agent Is Mine, from researchers at UC Santa Barbara, UC San Diego and Fuzzland and accepted to ACM CCS in October, measured 28 paid routers and 400 free ones:
An agent that executes tool calls from an endpoint the organisation never vetted has handed that endpoint's operator a shell. We made a related point when three AI infrastructure flaws landed in CISA's KEV catalogue and attackers went straight for the API keys: the proxy layer is where credentials concentrate, and it is increasingly where attackers look first.
The advisory's recommendations for AI companies include something that deserves more attention outside the labs. Providers are encouraged to alter responses for users confirmed to be querying for distillation — using downgraded models or deliberately degraded output — without informing them, so the distillers cannot tune their evasion. AI safety researchers and third-party evaluators, the advisory adds, should be told about such changes.
Nobody else is in that exception. The behavioural indicators the agencies list include shared accounts used from many IP addresses and user agents, round-the-clock usage with no human idle periods, anomalous subscription-to-API usage ratios and new subscriptions that immediately hit maximum usage. A transfer station's pooled accounts match every one of them, because that is how a transfer station works. When a provider degrades a pooled account, it degrades every customer riding on it, and by design none of them receives an error message. They get worse answers and no explanation.
This sits alongside a broader tightening at the providers' door. Three of the targeted labs spent the start of the month putting their most capable cyber models behind vetted access, and the advisory asks providers, cloud platforms and aggregators to share indicators so distributed campaigns show up as coordinated activity. The direction of travel is clear: traffic that cannot be attributed to a verified organisation will be treated with increasing suspicion.
OPENAI_BASE_URL and ANTHROPIC_BASE_URL. Search developer configs, CI secrets and shared dotfiles for values pointing anywhere other than a provider or cloud endpoint you contract with.Start with the boundary. Obiguard cannot see a reseller key bought on a personal card and used from a personal laptop on a home network, and defending frontier models against distillation is the providers' job, not ours. If someone is determined to route around every control, they will.
What Obichat changes is the reason most people go looking. Transfer stations sell three things: a lower price, one key that reaches many models, and a way around access restrictions. Obichat answers the second outright, and it makes the other two a policy conversation rather than a private purchase. Model providers are connected per workspace, under contracts the organisation already holds — Azure OpenAI, AWS Bedrock, Vertex AI, Anthropic, or self-hosted models through vLLM or Ollama — and each workspace carries its own model allow-list. The endpoint answering an employee's prompt is one IT approved, not whichever relay was cheapest this week. It will not be 90% below list price. Nothing legitimate is, and the advisory is a reasonably detailed explanation of where that discount comes from.
The provenance matters as much as the price. Every message in a workspace passes through the inspection layer under the policy set assigned to it, so PII and payment data are redacted and jailbreak or injection attempts are caught before a prompt reaches any model. Staff sign in through SAML or OIDC, so usage is attributable to a person rather than to a pooled key — which is precisely the property the providers' new detection regime rewards. Each workspace keeps an exportable record of conversations and events, mapped to NIST AI RMF and ISO/IEC 42001, and Obichat can run as a private deployment in your own AWS, Azure or GCP tenant. Paired with Obiguard's network-layer proxy, direct egress to AI endpoints can be blocked at the firewall so the approved workspace is the on-ramp rather than one option among several.
Chat covers the majority of staff. It does not cover the developer whose coding agent reads ANTHROPIC_BASE_URL from a dotfile. For that population, the equivalent control is sending agent traffic through Governance AI, where credentials are issued against approved models and tools and every call lands in the audit ledger — so the answer to which endpoint did that agent talk to is a record, not a guess.
The advisory frames distillation as a contest between two national AI industries, and at the level of policy it is one. At the level of mechanics it is a supply chain. Somebody farms accounts, somebody resells the access, somebody buys it for a tenth of the price — and the buyer's prompts disappear into infrastructure whose operators have every commercial reason to keep them.
The distillers needed traffic that looked ordinary. Ordinary customers paying a fraction of list price supplied it, and most of them had no idea that was part of the deal.
When a token costs a tenth of what the provider charges, the difference is being paid somewhere. Explore Obichat or talk to us about whether you could say, today, which AI endpoints your staff's prompts actually reach.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →