Skip to content
U.S. Accuses Chinese Firms of AI Token Extraction Campaign

U.S. Accuses Chinese Firms of AI Token Extraction Campaign

First seen 14 Sep 2026, 15:18 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster September 14, 2026 at 17:19 UTC
  • Six Chinese AI firms are accused of mass token extraction from U.S. models.
  • The operations are believed to be state-sponsored and systematic, not opportunistic.
  • Anthropic blocked similar extraction attempts from seven Chinese labs, including Alibaba and DeepSeek.

The U.S. government has accused six Chinese AI companies of conducting large-scale token extraction campaigns against American AI models since late 2024. The companies named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The NSA, CISA, and FBI issued a joint advisory detailing that these operations were systematic and likely state-sponsored, aimed at capturing advanced capabilities from models like Claude, GPT, Gemini, and Grok. Anthropic also reported blocking illicit extraction attempts from seven Chinese labs, including some of the same companies. The extraction methods involved sending millions of requests through APIs, utilizing a sophisticated infrastructure designed to evade detection. This activity represents a significant threat to U.S. AI development and raises concerns about intellectual property theft.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-12-01
Token extraction campaigns reportedly began
U.S. agencies state that extraction efforts started targeting U.S. AI models in late 2024.
Ciberseguridadlatam
2026-09-10
U.S. agencies issue advisory
NSA, CISA, and FBI released a joint advisory accusing six Chinese firms of systematic extraction.
Ciberseguridadlatam
2026-09-12
Anthropic blocks extraction attempts
Anthropic reported halting large-scale unauthorized extraction attempts against its model Claude.
Ciberseguridadlatam

More articles in this cluster (2)

Following this threat?

Track AMD in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed