Six Chinese AI firms named in a US advisory that lists which American models each one targeted

Three US agencies have jointly published an advisory naming six Chinese AI companies as having systematically extracted capabilities from American frontier models since late 2024. The document is unusually specific for this kind of public notice: it identifies which US model each firm targeted and how the extraction requests were structured, according to The Next Web.

That level of detail is the story. Government advisories about foreign AI capability usually stay at the level of “adversaries are trying to catch up.” This one names companies, names targets, and describes method. Whatever you think of the underlying policy, that’s a different category of disclosure.

What the advisory actually says

The advisory comes from three US agencies acting together, and it covers activity dating back to late 2024. The core allegation is systematic capability extraction — the practice of querying a frontier model at scale to harvest its outputs, then using those outputs to train or improve a competing model. The advisory lists, per firm, which American model was targeted and how the requests were designed.

Six companies are named. The advisory does not, based on what’s been reported, allege that any of them broke into anything. It alleges they used the front door, repeatedly, in a pattern the agencies consider extraction rather than legitimate use.

Why distillation is the hard problem, not the scandal

Model distillation is not a hack. It’s a technique. You generate a large volume of outputs from a strong model, filter them, and train a smaller or cheaper model to imitate the behavior. It’s used legitimately inside labs all the time. The reason it’s hard to police is that at the API level, a distillation run and a heavy production workload look similar for a while. Both are just a lot of requests.

What the advisory appears to describe is the pattern-recognition layer on top: request structures that don’t look like a real application, volume that doesn’t match a plausible customer, and targeting that lines up with a competitor’s roadmap. That’s the kind of signal you can only see if you’re logging and analyzing traffic centrally. Most API providers do. The question is whether they act on it, and how fast.

For anyone building on frontier model APIs, the practical implication is that usage policies around bulk output generation are about to get more actively enforced, not just written down. If your product does something that resembles distillation — synthetic data generation, model evaluation harnesses, red-teaming pipelines — expect more scrutiny and possibly more friction. That’s not a prediction about policy. It’s what happens when an advisory like this lands: providers tighten first and ask questions later.

What this means if you’re building or marketing on top of these models

The immediate risk for a normal website owner or marketer is close to zero. You are not running distillation pipelines. But there are two second-order effects worth tracking.

First, model access terms are likely to get more granular. Providers that previously treated rate limits as a billing question may start treating them as a compliance question. That could mean new verification steps for high-volume accounts, or new restrictions on what you’re allowed to do with outputs. If your product depends on generating large volumes of synthetic text or code from a frontier model, read the terms again before your next big feature ships.

Second, the cost curve. If frontier labs respond by making extraction harder, the cheapest path to a capable model gets narrower. That pushes more teams toward open-weight models, fine-tuning, or smaller models that are good enough for a specific task. For a lot of marketing and content workloads, that’s already the right call — you don’t need a frontier model to draft product descriptions. This advisory doesn’t change that math, but it does add a reason to stop treating frontier API access as a permanent assumption.

What to watch next

The advisory names firms and targets. The next question is what the named providers do about it. Watch for changes to acceptable use policies, new account verification thresholds, and any shift in how output-generation limits are described. Those are the concrete artifacts that will tell you whether this advisory changes behavior or just gets filed.

Also watch whether the named companies respond with technical detail or with denial. A firm that publishes its own training methodology in response is making a different kind of statement than one that issues a press release. Neither proves anything on its own, but the pattern across six companies will be informative.

The broader point: the era where you could assume frontier model access is a commodity with no strings attached is ending. Not because of this advisory alone, but because this advisory is the kind of thing that gets written when the assumption has already stopped being true.