CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok

Cybersecuritynews •Tushar Subhra Dutta • September 9, 2026

A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems. The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development. The alleged campaigns relied on huge volumes of automated requests sent through […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

U.S. Accuses Chinese AI Firms of Systematic Distillation of Proprietary Models U.S. cybersecurity agencies have accused Chinese AI companies of conducting systematic extraction of proprietary functionalities from leading U.S. AI models through industrial-scale distillation attacks. This activity, which has been ongoing since at least late 2024, involves companies like DeepSeek, Moonshot AI, Alibaba, and MiniMax extracting billions of tokens from models such as Claude, GPT, Gemini, and Grok. The U.S. agencies described these operations as a core part of China's AI development strategy, enabling faster and cheaper advancements in their AI capabilities. The advisory outlines various tactics used by these companies to bypass safeguards, including spreading requests across multiple accounts and using proxies. The advisory urges U.S. AI firms to implement detection and mitigation strategies to safeguard against these attacks. 11 sources 78

CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok

The full story

Extracted Entities

MITRE ATT&CK (1)

Tools (4)