The U.S. National Security Agency, Federal Bureau of Investigation, and Cybersecurity and Infrastructure Security Agency jointly accused six Chinese artificial intelligence companies of conducting "aggressive, industrial-scale distillation" campaigns against American frontier models, signaling that the AI competition has moved far beyond chip control into protecting model outputs themselves. The accusation, issued on September 9, 2026, specifically names companies including Moonshot AI and DeepSeek, alleging that model extraction has become the "core" of how these laboratories actually build their systems rather than a supplementary technique.

What Is Model Distillation, and Why Should You Care?

Model distillation is a technique where one artificial intelligence system is repeatedly queried to generate outputs, and those outputs are then used to train a smaller, cheaper model that mimics the original's behavior. Think of it like reverse-engineering a recipe by tasting a dish many times and trying to recreate it in your own kitchen. The problem, according to U.S. officials, is that Chinese laboratories have weaponized this approach at scale, systematically extracting functional capability from American frontier models like OpenAI's systems without authorization or compensation.

For years, American policymakers believed the solution was simple: control who could buy advanced computer chips. If China couldn't access the graphics processing units (GPUs) needed to train powerful models, the logic went, American technological leadership would remain secure. But the distillation advisory issued this week demolishes that assumption. A determined competitor can now extract much of a frontier model's functional value simply by querying it repeatedly, bypassing chip restrictions entirely.

The timing matters enormously. The accusation arrives only weeks before President Donald Trump is scheduled to host Chinese President Xi Jinping in Washington, signaling that the U.S. government views this issue as a core strategic problem requiring high-level diplomatic attention.

How Has This Problem Evolved Over the Past Year?

Concerns about Chinese laboratories extracting capability from American frontier models are not new. As early as February 2026, Reuters reported on a State Department cable warning diplomatic posts worldwide about the risks associated with AI models "distilled" from unauthorized access to American systems, specifically naming DeepSeek, Moonshot AI, and MiniMax. Throughout the spring and summer of 2026, tension around this issue continued to build, with Treasury Secretary Scott Bessent publicly stating in July that the administration "supports open-source models" but does not "support IP theft," signaling openness to sanctions against offending companies.

In early 2026, OpenAI reportedly warned members of Congress that DeepSeek was systematically targeting its systems to replicate model behavior for use in DeepSeek's own training pipelines. These warnings went largely unheeded at the policy level until this week's joint advisory, which represents the first formal, multi-agency accusation of industrial-scale distillation.

What Seven Developments Reveal About the Emerging "Intelligence Stack"?

The distillation advisory did not arrive in isolation. Within the same 48-hour window, seven major developments announced by American technology companies and government agencies collectively describe a fundamental redefinition of what must be defended to preserve technological leadership. According to analysis from the Foreign Affairs Forum, these developments sketch the outline of what experts call the "intelligence stack".

• Semiconductor Partnerships: OpenAI disclosed that it is deepening its semiconductor partnership with Samsung Electronics, building on the custom Jalapeño inference chip it developed with Broadcom in a reported nine months, and disclosed that it had used its own frontier models to accelerate the design of the chip itself.
• Autonomous Agents: Meta launched Muse, an autonomous personal agent capable of sending emails, booking travel, and completing purchases on a user's behalf, accompanied by internal reports of reliability and security shortcomings.
• Inference Infrastructure: Qualcomm and Amazon Web Services entered a partnership potentially worth $60 billion, centered on custom inference silicon and ultra-fast optical networking to run AI models at scale.
• Coding Automation Valuations: Cognition, the developer of the autonomous coding agent Devin, raised $2 billion at a $48 billion valuation, very nearly doubling its worth from four months earlier.
• International Access Restrictions: Anthropic reportedly declined to grant the United Kingdom's AI Security Institute pre-release access to its latest specialized model, Claude Mythos 5.1, a departure from its prior practice that has generated concern within the British government about a broader "protectionist" trend among American AI developers.

These developments collectively signal that American technology companies are restructuring themselves around a far broader conception of what constitutes strategic advantage. The old framework focused narrowly on protecting chips. The emerging framework requires protecting the chip, the model itself, the data used to train and query it, the outputs the model generates, and now the autonomous agents that act on those outputs in the physical and financial world.

How Should Policymakers and Companies Respond to Model Distillation?

The U.S. government's distillation advisory this week amounts to an admission that at least one critical layer of defense has been leaking for years with very little effective protection in place. Each layer of the intelligence stack represents a potential point of leakage, and Washington is now scrambling to close those gaps.

• Output Monitoring: Companies must implement systems to detect and limit repeated queries designed to extract model behavior, distinguishing between legitimate use and systematic extraction campaigns.
• Model Architecture Protection: Developers should invest in custom semiconductor design and inference optimization to reduce the transferability of distilled models, making extracted outputs less useful to competitors.
• International Access Controls: American AI developers are increasingly restricting pre-release access to frontier models for international partners, prioritizing national security over collaborative research relationships.
• Autonomous Agent Safeguards: As AI systems gain the ability to transact and communicate on users' behalf, companies must implement stronger reliability and security measures to prevent misuse or unauthorized actions.

The trajectory of American AI policy over the coming eighteen to twenty-four months will likely involve tighter restrictions on model access, more aggressive enforcement against distillation, and deeper integration between government agencies and private technology companies in defining what constitutes strategic advantage.

What makes this moment historically significant is that the competition has expanded well beyond the question of which laboratory builds the most capable foundation model. It now encompasses custom semiconductor design, the defensibility of model outputs against extraction, the emergence of autonomous agents empowered to transact and communicate on a person's behalf, extraordinary venture-capital valuations for coding automation, and the increasingly explicit treatment of frontier models as strategic national assets rather than ordinary commercial software. The intelligence stack framework suggests that future American AI leadership will depend not on any single layer of protection, but on the integration and defense of all layers simultaneously.