US Accuses Chinese AI Companies of Industrial-Scale Model Distillation Targeting Claude, GPT, Gemini and Grok
US government agencies have accused six Chinese artificial intelligence companies of engaging in industrial-scale model distillation to copy capabilities from leading Western systems including Claude, GPT, Gemini, and Grok.
The operations reportedly began at least by the end of 2024 and targeted the companies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. According to the accusations, the firms extracted billions of tokens through millions of automated requests to proprietary APIs in order to accelerate training of their own models.
Model distillation is a recognized machine-learning technique in which a smaller model learns from outputs produced by a more advanced system. The US authorities emphasize that the issue lies in the unauthorized, automated, and covert use of commercial services to reproduce restricted features at massive scale.
Operations relied on a combination of direct APIs, cloud providers, aggregators, and proxy services to mask query origins. Shared accounts and high-volume premium subscriptions helped reduce costs while avoiding rate-limiting and detection mechanisms.
Among the capabilities sought were chain-of-thought reasoning, programming assistance, software engineering tasks, autonomous agent functions, and multimodal processing. Several campaigns deployed automated systems that switched routing paths whenever access was blocked.
US officials state that the scale and technical sophistication of the activity indicate distillation has become a central element of these companies’ AI development pipelines and assess that the operations were likely conducted with knowledge of the Chinese government.
China has rejected the accusations, asserting that its advances in artificial intelligence result from independent innovation. Beijing described the claims as baseless and called for greater international cooperation in AI development.
Related articles
Check Point Research Uncovers Cross-Session Command Channel in ChatGPT via JFrog Artifactory
Researchers at Check Point Research identified a covert channel that allowed commands to be passed between isolated ChatGPT sessions belonging to different user accounts. The channel exploited an internal JFrog Artifactory instance used by ChatGPT containers for package installation, enabling containers to read and write repository metadata that effectively served as a shared buffer. Attackers could inject malicious instructions into a victim's context through copied prompts, shared conversations, or custom GPTs, causing the assistant to execute hidden tasks while returning normal responses. In a demonstration, ChatGPT silently retrieved data from a connected Gmail account and forwarded it to the attacker's account. The technique potentially exposed chat history, uploaded files, and data from connected services including Google Drive, Microsoft Teams, and GitHub. OpenAI confirmed the affected Artifactory instance has been decommissioned, eliminating the channel, with no evidence of real-world exploitation reported.
Stop Asking If an AI Skill Is Safe — Ask What It Can Do Instead
A detailed analysis warns that AI agent skills distributed as simple text files can execute malicious commands with full user privileges. The article examines how prompt injection attacks embedded in skill.md files have already led to credential theft and persistent malware that survives system restores. Research by Snyk on 3984 public skills found that 36.8 percent contained at least one security issue and 13.4 percent had critical flaws. The author argues that traditional security badges are ineffective because skills can dynamically load payloads, target reviewers with injection, or change after initial review. Instead, a new tiered system called skill-xray classifies capabilities from inert text (T0) to runtime code loading (T4) and binds results to content hashes. The approach is implemented in an open-source MIT-licensed tool that combines static regex scanning with agent-based reporting to surface risks without issuing false safety guarantees.
Ideco NGFW Novum v23 Adds Shadow AI Discovery, Dynamic Routing and QoS Controls
Ideco has released NGFW Novum v23, introducing detection for 83 AI application protocols including ChatGPT, Claude, DeepSeek, GigaChat and YandexGPT. The update enables organizations to identify Shadow AI usage across networks without mandatory TLS decryption and adds new content-filter categories for AI agents and AI services. Enterprise routing capabilities have been expanded with Prefix lists, Route maps, OSPF zones, BGP aggregation and BFD profiles to support large distributed environments. Additional features include internal Virtual Ethernet and Virtual Switch interfaces for VCE connectivity, QoS traffic prioritization, MTU/MSS tuning for IPsec, certificate-based authentication in Ideco Client and detection of tunneled traffic inside SSH and TLS sessions. The release positions the NGFW as the first layer of an emerging AI Security Layer that combines discovery, policy enforcement and future LLM proxy controls.
Agentic AI Systems Under Siege: Prompt Injections, Data Poisoning, and Tool Exploits
Independent expert Andrey Biryukov details how AI agents with file access, email capabilities, and API calls become high-value targets for attackers. The article examines confidentiality, integrity, and availability risks created by autonomous decision-making. Real-world examples include NeuralTrust’s discovery of malicious URL instructions bypassing OpenAI Atlas validation and Zscaler ThreatLabz’s demonstration of hidden instructions on fake Python documentation sites that tricked models into making cryptocurrency payments. Data poisoning research from Carnegie Mellon and Cornell Tech showed agents from Anthropic, OpenAI, and Google selecting tampered datasets in half of tested cases. Additional findings cover vulnerabilities in Git MCP Server and comparative weaknesses between Function Calling and Model Context Protocol architectures. OWASP’s Agentic Top 10 and joint guidance from Canada, Australia, the US, New Zealand, and the UK emphasize threat modeling, least-privilege isolation, and separation of trusted versus untrusted data.