China Named In Frontier AI Model-Copying Advisory

For weeks this was a dispute conducted in leaks and hedged sourcing. This week it became a document. CISA published advisory AA26-251A, jointly with the Justice Department and the intelligence community, naming six China-based AI firms it says have run industrial-scale distillation against Claude, GPT, Gemini and Grok since late 2024. Kai Tanner's desk has the mechanism: this ran through paid API access and terms-of-service violations, billions of tokens harvested from a business relationship the vendors themselves invoiced, not a break-in anyone needed to detect.

Aya Nakamura's desk follows the paper trail to where it actually bites. None of the six named firms has an enterprise sales channel to sell what they copied. Alibaba Cloud and Tencent Cloud sell compute, not a packaged, compliance-cleared product a Singapore bank can deploy next quarter, and export controls on frontier hardware mean a copied model still can't out-train the two more generations Anthropic and OpenAI will ship before any of the six builds that channel from zero. Beijing is pushing back on the distillation claims through the AP, calling the framing malicious ahead of planned Trump-Xi trade talks. That is the diplomatic layer sitting on top of a dispute that, underneath, is about who owns a sales relationship, not who owns a training run.

A Hong Kong or Singapore bank's AI governance work has mostly assumed a model's training lineage is settled once a vendor names its foundation model. This advisory is the first government document stating that lineage is contested at the model layer itself. HKMA has no circular addressing frontier model provenance yet, and SFC's filings this week cover virtual asset intermediaries, not AI vendor risk. That leaves a gap between what regulators have written and what this advisory just established as fact.

No vendor an APAC institution runs is implicated as a bad actor here. Anthropic, OpenAI and Google are the victims, and rate-limiting and output-watermarking on outbound API access is now a documented case study rather than a hypothetical. The dispute over who trained on whom will run through trade talks and lawsuits for years. Whether a bank knows what its own model exposure looks like from the other side has an answer available today.