A new bipartisan House bill would charge the federal government with developing formal guidance for defending AI models against distillation attacks.

The AI Cyber Defense Act, shared exclusively with CyberScoop ahead of release, is sponsored by Reps. Pat Harrigan, R-N.C., and George Whitesides, D-Calif. It would direct the National Institute for Standards and Technology to develop voluntary industry standards and best practices for preventing distillation attacks from foreign entities from four countries: Russia, China, Iran and North Korea.

In an interview, Harrigan told CyberScoop it is “incredibly expensive” for the U.S. AI industry to maintain its six-to-12 month lead over other countries, and distillation attacks give other parties an incentive to copy other models while keeping their own spending low.

He said he believes countries such as China are making a strategic choice to hold back on full investment of their own AI industry, instead betting they can drift behind American companies as they perform the arduous and expensive research and development to advance the field.

“One of my concerns is that our adversaries just see it as much more beneficial and productive for them as this [U.S. industry] engine burns,” said Harrigan. “Where they actually just see it as more beneficial for themselves in the short term, to hang six to 12 months behind the United States, let us burn really hot and for 5 to 10% of the spend, they can just distill and steal, and they can do that up to until the point where our market kind of falters. At which point they can turn it into high gear, having not expended those resources yet in the past, and actually leapfrog us.”

As part of that mission, NIST will first have to define what a distillation attack is, and separate it from much of the sharing and collaboration between open-weight and open-source models that have also helped drive innovation.

Distillation attacks happen when one AI model is trained on the output data and reasoning of another, usually more powerful or advanced, model. The U.S. government, along with AI companies Anthropic, OpenAI and Google, has accused Chinese companies like Moonshot AI, DeepSeek and Alibaba, of carrying out “systematic” campaigns to distill and copy U.S. commercial models.

According to AI and cybersecurity experts, these campaigns involve the use of hundreds of burner and resold accounts and false identities to bypass geographic restrictions to access U.S. frontier models, and involve thousands, sometimes millions of prompts meant to extract valuable outputs and capabilities that can be used to train a foreign model.

Meanwhile, U.S. AI companies themselves face multiple ongoing lawsuits from media organizations, creators, artists and other laborers, who allege that commercial U.S. models were originally trained on their works without any compensation or permission.  

“AI is advancing at a breakneck pace, and every month we keep China and other adversaries from stealing our progress is a month we gain to build the safeguards this technology needs,” Rep. Whitesides said in a statement to CyberScoop.

The bill would also establish an “AI Cybersecurity Roundtable” at NIST composed of governments and AI industry stakeholders that would work to develop voluntary standards for defensive use of AI in cybersecurity in critical infrastructure.

Harrigan said he envisions the roundtable as including frontier AI companies including software and hardware security experts, who can add independent third-party voices in discussions on the best way to defend IT assets in critical infrastructure and other industries. A place “where you can go and pick an off-the-shelf set of standards that says these are the best practices as we know them all today, given the current state of technology development and the threats that are out there.”

The bill defines “entities of concern” as any foreign person or organization headquartered in one of the four listed countries of concern (Russia, China, Iran and North Korea), or one operating under the direction of a company based in those countries. The director of NIST would also have the ability to designate specific individuals or organizations as entities of concern.

The post Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber appeared first on CyberScoop.

OpenAI said it disrupted a “coordinated campaign” to distill and extract reasoning capabilities from its AI models, pointing the finger at a Chinese rival.

On Wednesday, OpenAI said it first spotted low-level activity on July 1 that gradually increased until July 24 and 25, when it observed 16,000 prompts from 4,000 users that fit a similar “relevant extraction pattern.” The number of suspicious users had climbed to 15,000 by July 28, when OpenAI said it “fully disrupted” the operation.

The company called the attackers’ method “novel.” They copied encrypted reasoning data from one conversation, then asked the model in a separate conversation to decrypt the content and transcribe it in plain text. Outside researchers reported a similar vulnerability to OpenAI in August.

“The operators did not break our encryption, compromise a database, or gain direct access to stored user conversations,” OpenAI wrote in an unsigned blog post. “Instead, they manipulated model interactions so that protected reasoning could be reproduced in forms visible to the requester in a coordinated, scaled manner that violated our terms of service.”

OpenAI said it’s unclear whether all the activity is related, but individuals working on behalf of Moonshot AI, a China-based rival AI company that has, in the past, been accused of distilling U.S. models, were behind a “core cluster” of the activity.

OpenAI’s blog post does not cite any technical evidence or reasoning for its attribution. Moonshot AI’s Kimi is one of several Chinese open-source AI models that are offering users and organizations good-enough performance for free or at a low cost.

American AI companies and the U.S. government have accused Chinese companies like Moonshot AI of conducting “systematic” distillation attacks on their latest models. Cybersecurity experts at Google and other cybersecurity firms say Chinese companies rely on black or gray markets to acquire thousands of individual accounts for models like Claude and ChatGPT. They then flood those models with millions of prompts and data requests that help them copy model capabilities and training data.

OpenAI told CyberScoop that it was not sharing any additional information “for security reasons.” CyberScoop has reached out to Moonshot AI for further comment.

According to OpenAI, the same vulnerability exists in other AI models, and it has shared information about the incident with groups like the Frontier Model Forum.

Beyond banning offending accounts, OpenAI said it improved signup and infrastructure controls and expanded network monitoring. It also fixed a bug that allowed users to take encrypted data from one conversation and decrypt it in another. 

The post OpenAI reveals ‘novel’ encryption bypass used in distillation attack  appeared first on CyberScoop.

Artificial intelligence has removed the skill advantage that once set state-sponsored hackers apart from lone criminals, according to a threat report Anthropic published Thursday that documents misuse of its Claude models across seven areas of harm.

The report, which details activity observed between December 2025 and August 2026, covers cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and distillation. Anthropic said it disrupted each operation, strengthened safeguards and shared intelligence with authorities and industry partners where appropriate. 

“The cases we share here aren’t typical misuse, but rather examples of the most notable and novel threat activity we’ve identified to date,” the report reads. “We’re publishing this work because we believe we have a responsibility to disclose malicious misuse of our services. As models become increasingly capable, their risks will increase, unless AI developers and society’s defenders act to make them safer.”

The cyber operations the company detailed were a Russian-aligned espionage campaign that hit more than 20 government and defense organizations across Ukraine and Europe, two Chinese undergraduates who ran an automated exploit foundry that produced more than a dozen potential zero-days in a single month, affiliates of the ShinyHunters crime collective who dumped 2,100 cloud access tokens across 40 corporate tenants in 34 hours, and a lone hacktivist who targeted European political parties via stolen API keys. 

For decades, cybersecurity researchers and investigators have pointed to sophisticated operations as a signature of state-sponsored tradecraft, while crude intrusions suggested amateurs or petty criminals. Anthropic posits in the report that AI has erased that conventional thinking, especially since a “majority of the operations described in this report were enabled by AI via direct execution or orchestration.”

“For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation,” the report said, adding that a hacktivist on stolen API keys, scattered criminals and a state espionage operator each ran campaigns that a year earlier “would have required many skilled operators and specialist knowledge.”

The most extensive case involved a malicious actor using the handle “JackPoterz” whose actions aligned with Russian state espionage, matching behaviors linked to Midnight Blizzard. 

According to the report, the actor employed a custom toolkit composed of two families of Windows-based implants, a mobile exploitation kit, a credential stealing tool that targets browser password stores, a phishing platform designed to mimic priority targets like government organizations, and an administrative console used to manage compromised accounts. Targets included military intelligence bodies in Ukrainian and European governments, diplomatic and defense organizations, and people connected to U.S. foreign policy.

According to the report, AI monitored whether security products flagged the actor’s malware. When a detection occurred, “agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections,” the report said.

The same actor bulk-exported mailboxes at drone component manufacturers and stole a complete software development kit for a drone vision system, then spent days recovering its architecture and details of an unannounced product. The actor also compromised hotel Wi-Fi vendors to reach guests through DNS hijacking, took over WhatsApp accounts with headless browsers, and stole more than 300,000 national identity records from a North African government agency, along with registry data on more than half a million companies.

The Chinese-speaking operators, which the company says were partly carried out by undergraduates at a Chinese university, put Claude to work on vulnerability research around the clock. One workflow iterating on network appliance firmware “yielded more than a dozen possible zero day findings in a single month.” It ran “agent swarms,” in which a lead agent divided work among parallel subagents, and kept campaign memory between sessions. 

Clusters linked to ShinyHunters showed how AI shortens criminal timelines. One supply-chain breach ended with a dump of more than 2,100 Azure access tokens spanning more than 40 corporate tenants in about 34 hours. “AI agents performed nearly all of the work,” the report said. Another compromise moved from a single stolen developer token to full control of a victim’s cloud environment in roughly three hours.

The report also has a section dedicated to distillation attacks that Anthropic claims were carried out since February by seven labs based in China, including Alibaba, DeepSeek, Moonshot AI, Xiaomi and Zhipu. Operators affiliated with Alibaba ran the largest attack Anthropic has measured, peaking “at nearly 3 million exchanges per day launched from more than 3,500 fraudulent accounts” to harvest the outputs of Claude Opus models for training its Qwen systems.

The outputs were culled from users who never knew they were involved. The report said Moonshot and DeepSeek silently forwarded their own customers’ requests to Claude and returned its answers as their own, exposing data users had not agreed to share, including surveillance footage of a tracked individual pulled by a user likely affiliated with the People’s Liberation Army. Those practices are “likely inconsistent with privacy laws and the labs’ own terms of service,” the report said.

Earlier this week, a joint cybersecurity advisory from the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI accused Chinese AI companies of engaging in a deliberate and “systematic” effort to illegally distill U.S. frontier AI models and their capabilities.

Anthropic said it published the cases to give outsiders a view of how these threats form, framing the disclosures as an early look at a shifting landscape. 

“As models become increasingly capable, their risks will increase, unless AI developers and society’s defenders act to make them safer,” the report said. The old idea of “security through obscurity,” it added, “is no longer viable in this new AI-assisted world: everything connected to the internet is a potential target for exploitation.”

You can read the full report on Anthropic’s website.

The post AI lets small actors run state-level hacking campaigns, Anthropic report finds appeared first on CyberScoop.

 The U.S. government is accusing Chinese AI companies of engaging in a deliberate and “systematic” effort to illegally distill U.S. frontier AI models and their capabilities. 

According to a joint cybersecurity advisory from the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI, the sheer scale of these efforts since 2024 indicate that distillation is a critical part of China’s AI industrial policy.

“China-based artificial intelligence companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy,” the agencies wrote. 

The advisory names Chinese companies like DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, saying they spent billions of tokens across millions of exchanges and requests with frontier U.S. AI models like Anthropic’s Claude, OpenAI’s ChatGPT, Google Gemini, and xAI’s Grok, since at least late 2024.

The U.S. agencies said the companies used data culled from these interactions to strengthen their own domestic models, a practice that is tacitly encouraged but not directed by political leaders in Beijing.

DeepSeek, for example, distilled frontier U.S. models to generate synthetic training data for its R1 and R3 models, including four different versions of Claude, two versions of Gemini, five versions of ChatGPT and Grok 4. Those models helped train DeepSeek’s capabilities in areas like agentic functioning, question and answer optimization, creative and occupational writing and others.

Another Chinese company, Moonshot AI, allegedly distilled 18 different U.S. models – including Fable 5, Anthropic’s current, most advanced commercially available model – to train its Kimi-K2 and Kimi K3 models. The company used millions of queries meant to extract enhanced capabilities in areas like agentic reasoning, coding and data analysis, computer vision, larger logical frameworks, visual processing and others.

Chinese AI companies manage a sophisticated set of tools and systems that route requests and prompts through multiple pathways to avoid detection.

The advisory lists common tactics observed by Chinese companies, including spreading requests across different accounts, models and platforms, using native APIs, remote cloud providers, and third-party aggregators to obfuscate user metadata, and leveraging proxies and gray tech markets to get around geographic restrictions, terms of use and safeguards built into frontier models.

“Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the advisory stated.

For decades, U.S. national security officials and western business leaders have accused China of leveraging cyberattacks, insider threats and other forms of economic espionage to pilfer proprietary or sensitive technologies from U.S. businesses.

In June, Michael Kratsios, White House head of Office of Science and Technology Policy, made a similar accusation about MoonshotAI of distilling Fable 5 to train its own models, and described a similar “sophisticated” system for evading guardrails and restrictions on usage.

The warning Tuesday levies similar charges about Chinese theft of American tech, but for frontier AI companies that are facing lawsuits themselves from artists, authors, media organizations and other parties who say AI companies illegally trained their models on copyrighted or trademarked work.

Even within the competitive AI industry, companies and open-source organizations commonly share weights and measures for AI systems, or distill other AI systems in the course of legitimate work or research.

The agencies acknowledge this reality, but claim that Chinese companies are engaged in “aggressive, malicious, and targeted distillation activities at an industrial scale.”

The post Feds accuse China of ‘systematic’ distillation of U.S. AI models appeared first on CyberScoop.

A top White House technology official is accusing a Chinese company of distilling Anthropic’s models to create their own AI product.

Michael Kratsios, who leads the White House Office of Science and Technology Policy, claimed that Moonshot AI, a Beijing, China-based AI company, had distilled Anthropic’s recently-released Fable model to develop its own K3 model.

“To do this they developed a sophisticated internal platform to conduct large scale distillation against U.S. models, allowing them to quickly switch between multiple methods of access to avoid detection,” Kratsios wrote on X Wednesday.

Kratsios also said the company has used GB300 servers – either newly acquired or through Thailand – to train its AI models.

“The United States strongly supports the free and fair development of AI, including a thriving competitive ecosystem that spans frontier models, specialized systems, open-source frameworks, and open-weight models,” Kratsios continued. “Legitimate AI distillation used to create smaller, more efficient models plays a vital role in this open innovation ecosystem. However, large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable.”

Kratsios did not provide details on how the U.S. government learned that K3 had been distilled from Anthropic’s model. 

Frontier AI companies in the U.S. have pressed policymakers to make it more difficult for third-parties to copy or duplicate advanced commercial models, calling it a form of intellectual property theft.

On their website, Moonshot AI describes its Kimi K3 model as the first open 2.8 trillion parameter model, and promotes its lower token costs while still delivering near-frontier performance. 

“While its overall performance still trails the most powerful proprietary models, Claude Fable 5 and GPT 5.6 Sol, Kimi K3 demonstrated frontier-level performance across our evaluation suite, consistently outperforming other tested models,” the company said on its website. 

A request for comment sent to Moonshot AI was not returned before this article’s publication. 

Piyush Sharma, CEO of Tuskira, an AI cybersecurity detection and response company, said distillation of AI models allows developers many of a model’s core capabilities. He pointed to another example when Anthropic earlier this year accused Chinese company Alibaba of distilling their Claude AI model.

According to Anthropic, the campaign used 25,000 fraudulent accounts to run 28.8 million interactions on Claude over six weeks. Given that kind of volume “the goal was clearly replication,” he said. 

“When a model has learned to reason through software weaknesses, security gaps, and attack paths, copying its behavior also copies that analytical capability,” said Sharma.

In April, Rep. Andrew Garbarino, R-N.Y., who chairs the House Homeland Security Committee and Rep. John Moolenaar, R-Mich., Chair of the Select Committee on China, announced they were conducting a joint investigation into the integration of Chinese AI models.

The committees said the inquiry will also focus on “examining a pattern of conduct by [Chinese]-based AI laboratories involving the large-scale theft of proprietary capabilities from American frontier AI systems through adversarial distillation” as well as “ the redistribution of those stolen capabilities as open-weight models available for global download, and the incorporation of PRC-origin models into products used daily by hundreds of thousands of American developers and engineers.”

Western governments and industry accuse Chinese companies of routinely stealing their technology, intellectual property and other trade secrets, often with the tacit support of Beijing. The copying of AI models would continue a long and established tradition of Chinese-sponsored intellectual property theft.

However, while distillation attacks by foreign governments or companies on U.S. frontier companies can have real national security implications, it’s still a fraught question of where policymakers should draw the line.

The AI industry, which includes not just frontier companies but large businesses with their own bespoke models, smaller proprietary startups and a vibrant open-source ecosystem, routinely share and use third-party data, including critical code and training sets for AI models.

Further, U.S. frontier AI companies have built and trained their world leading models in large part by crawling the open internet, ingesting content created and produced by others. Critics (and multiple ongoing lawsuits) argue that AI companies like OpenAI and Anthropic built their empires on data and content from others, taken almost entirely without consent or compensation.

The post White House accuses Chinese company of distilling Anthropic’s Fable appeared first on CyberScoop.