Six Chinese AI Firms Named, One US Website Missed
Six Firms, One Advisory
On September 8, three US agencies, the NSA, FBI, and CISA (the Cybersecurity and Infrastructure Security Agency), published a joint advisory called AA26-251A. It names six Chinese AI companies, DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun, and Z.AI, and accuses them of pulling billions of tokens across millions of exchanges out of Claude, GPT, Gemini, and Grok since 2024. The technique is called distillation: you feed a rival's model millions of questions, record its answers, and train a cheaper model to imitate them, skipping most of the cost of building one from scratch. That matters because it means a company can get a model that behaves almost as well as, say, GPT, without paying for the years of research and compute that went into building GPT in the first place. The advisory says the six firms ran this through 'transfer station' proxy networks, essentially relay servers that hide where the traffic is really coming from, to dodge the geographic blocks and terms-of-use limits that Anthropic, OpenAI, Google, and xAI put on their own products. The advisory's own words matter here: it calls distillation 'the critical core' of these companies' development strategy, 'not merely a supplement.' That is a specific claim, that the six firms structurally depend on borrowed American model outputs rather than occasionally leaning on them, which is a much harder accusation to walk back than 'they copied some homework.' China's Ministry of Commerce rejected the accusation as 'groundless' the same week and warned Washington against using it to justify tighter export controls. Two governments, two flat denials, zero shared evidence released to the public. That's where the story would have stayed a familiar diplomatic spat, if not for what happened eight days later, on the US government's own infrastructure.
The Website That Answered Back
Around September 16, reporters found that the Federal Register's public search tool, the interface citizens use to look up new federal regulations, was running on Alibaba's Qwen model. Alibaba is one of the six companies the advisory had just named, which means the same government that had accused Alibaba of siphoning American AI output was, at that exact moment, running its own public-facing search tool on Alibaba's model. The National Archives, which runs the Federal Register, pulled the tool offline within roughly a day of the mismatch becoming public. No agency has explained how long Qwen had been running the tool, who approved using it, or whether anyone checked its provenance before deployment. It helps to separate the two failures here. The advisory addresses foreign extraction happening abroad, at the model layer, meaning inside the labs and proxy networks that build and route the AI systems overseas. The Federal Register case is a deployment-layer failure instead, meaning the problem wasn't some foreign lab, it was a US agency's own domestic procurement chain, the ordinary process of buying and installing software, and modern software procurement runs through vendors and sub-vendors many layers deep. Nobody in that chain flagged that a tool the federal government relies on to explain its own regulations was built on a model owned by a company the intelligence community would name as a national security concern within the same month. The Commerce Department had already separately barred DeepSeek from government-issued devices back in March 2025, so the instinct to wall off named Chinese models from federal systems already existed. It just didn't reach the Federal Register's vendor stack, which shows the problem isn't a missing policy, it's a policy that never made it all the way down the supply chain.
An Audit Nobody Ordered
The open question now is whether anyone checks what else runs on borrowed Chinese models inside the federal government, or whether this ends with one tool switched off and one news cycle closed. As of this week, no agency, not Commerce, not CISA, not the National Archives, has announced a government-wide review of which AI models power other federal websites and internal tools. The Federal Register fix took about a day. A systematic audit of every vendor-supplied AI feature across federal agencies would take considerably longer, since it means checking every vendor and sub-vendor contract for what model actually sits underneath, and nobody has scheduled it. It is far easier to unplug one embarrassing tool once a reporter calls than to ask the harder question: how many other agencies are running an AI-powered search or chat widget today, procured through a vendor two or three layers removed from anyone who checked which model sits underneath. No evidence has surfaced identifying such a tool at another agency, which is not the same as evidence that none exists, it just means nobody has looked. The advisory treats distillation as a border problem, something to intercept before it happens, coming from outside the country. The Federal Register case shows the nearer exposure is already inside the building, purchased through the ordinary paperwork of federal procurement, and until an agency actually opens that audit, nobody knows how big the gap really is.
*The advisory named six companies operating outside US jurisdiction. The bigger find sat inside a US government website, unnoticed until a reporter looked. One got fixed in a day; the other question, whether Chinese models are quietly running other federal tools, has no agency review scheduled to answer it. Commerce, CISA, and the National Archives named six foreign firms in an advisory, and none of them has audited its own vendor stack.*