Washington names six Chinese AI labs in 'industrial-scale' theft advisory, with a Trump-Xi summit expected this month

A joint FBI, NSA and CISA advisory made public September 8 accuses six Chinese AI labs, including DeepSeek and Alibaba, of running "industrial-scale" extraction campaigns that it calls the core, not a supplement, of China's AI development strategy, pulling billions of tokens from OpenAI, Anthropic, Google and xAI models since at least late 2024 1. It is the widest accusation yet in an escalation that has run since February, and it lands in the run-up to a meeting between President Donald Trump and Chinese leader Xi Jinping expected this month, with AI among the topics Trump has said will come up 2.

The uncomfortable part for Washington: the levers named this week aim at the labs, not at the buyers who choose them on price, and distillation itself is theft US policing cannot reach. Beijing answered within a day. Foreign ministry spokesperson Mao Ning said the US should refrain from "unfounded accusations against or smearing China," and a Chinese embassy spokesperson in Washington rejected the distillation framing as an attack on China's AI progress 32.

Mao Ning's fuller briefing is a preview of the summit's hardest problem. Saying she had not seen the specific US report, she credited China's AI progress to "high-level self-reliance and strength in science and technology" 3. The advisory's attribution section gives the same industry the opposite history: the Chinese AI sector "has turned to a comprehensive distillation strategy in an attempt to bridge the technological and performance gaps" against US frontier models 1. One day apart, the two governments offered rival creation stories for Chinese AI, and any summit bargain on distillation has to be struck across that disagreement.

From a company blog post to three federal agencies in half a year

The September advisory is the fourth beat of an escalation in which the accuser changed every time:

• February 2026: US AI firm Anthropic posts that DeepSeek, MiniMax and Moonshot AI distilled its Claude model through over 24,000 fraudulent accounts and more than 16 million exchanges; OpenAI had told a House committee earlier that month that DeepSeek and other Chinese firms were distilling its ChatGPT models 4. The accuser was a company; the venue, a blog post.
• April 2026: the US government takes over. A White House science office memo alleges "deliberate, industrial-scale campaigns," and the State Department cables embassies to warn foreign governments, naming the same three labs 5. The day the cable was reported, Hangzhou-based DeepSeek released V4, the first major frontier release optimized for Huawei's Ascend AI processors rather than Nvidia hardware.
• July 2026: Beijing flips the charge, accusing US AI firms of training on Chinese examples, while dozens of startups urge the administration to limit any ban on foreign-made models to government use 3. The resistance is now two-sided: the accused state and American buyers.
• September 8, 2026: three agencies name six labs, double the February count, in an advisory rather than a lawsuit or a sanction 1.

Six and a half months separate the blog post from the advisory; the named-lab count doubled, and the accuser moved from one company's security team to the FBI.

Inside the advisory: 17 victim models for one lab, and a disputed $5.6 million

The advisory's attribution table runs past the quoted lines. By our count, Moonshot AI, the lab behind the Kimi models, distilled 17 distinct US models and model variants, from GPT-3 to Claude Fable 5, across all four alleged victims: Anthropic, OpenAI, Google and xAI 1. DeepSeek's campaign, running since at least late 2024, drew on 14 US models to train R1 and V3, and the advisory calls DeepSeek's publicly quoted $5.6 million training cost "misleading" for leaving out the cost of the extracted data 1. The tradecraft the agencies describe is entirely remote: fraudulent accounts, API aggregators, a gray market of proxies known as "transfer stations" reselling frontier-model access at a fraction of the official price, and prompts crafted to force out the chain-of-thought reasoning providers hide 1. MiniMax, the document notes, redirected extraction to a newly released Claude model within 24 hours 1.

The rest of the document describes the duel those numbers imply. Providers are told to watch subscription-to-usage ratios, flag new accounts that hit maximum usage immediately, and monitor enterprise-scale throughput 1. The offense it describes is built for that scrutiny: automated failover between pathways when blocking starts, premium subscriptions bought in bulk and shared across developer teams, and what the advisory calls "sophisticated quality evaluation frameworks to detect defensive countermeasures" 1.

The named levers aim at supply, but buyers choose on price

Treasury Secretary Scott Bessent said sanctions and Entity List designations "will be on the table" when Chinese distillation crosses into IP theft 2. Both instruments restrict what the named labs can buy and where they can bank; neither touches the purchase decision. At V4's April launch, DeepSeek's flagship cost $3.48 per million output tokens against $30 for OpenAI's GPT-5.4 and $25 for Anthropic's Claude Opus 4.6, roughly a seven-to-nine-fold gap 5. The advisory itself supplies the mechanism behind that gap, saying labs that adopt the strategy see significantly shorter development timelines and lower training expenditures 1. The extraction Washington calls theft is the same act that produces the price advantage, and buyers answer price: many companies now prefer Chinese models to the "more powerful, but pricier" US versions, in AFP's phrasing 3. The advisory's three recommended actions are addressed to the victim companies, not to any regulator or court: detect anomalous accounts, share intelligence across providers, and "subtly alter responses" to suspected distillation 1. Quiet self-help is the official prescription.

Run over a year, the April prices become a migration argument. Counting output tokens only, an application generating a billion tokens a month pays roughly $42,000 a year on DeepSeek's V4 at its launch price, against $300,000 on Anthropic's Claude Opus 4.6 and $360,000 on OpenAI's GPT-5.4 5. Sanctions and Entity List designations raise the risk of that choice; they do not touch the roughly $258,000-to-$318,000 annual difference, the arithmetic that pushed dozens of US startups to ask in July that any ban on foreign models stop at government use 3.

What the summit can and cannot change

Trump has said AI will come up when he hosts Xi in Washington this month 2. A summit can change the diplomacy: a norm on distillation, enforcement against named firms, or a bargain that shelves the dispute. What it cannot change is the arithmetic: as long as extraction cuts training costs, the incentive survives, and a government document prescribing private detection and quiet degradation reads as an admission that Washington knows it 1. Since February the arc has used a blog post, a memo, a cable, a counter-accusation and an advisory; every instrument so far has been words. The pattern breaks only with a dated enforcement action or a signed agreement, and this month's meeting is the first venue where either could appear.