# You Don't Need to Steal the Model If You Can Just Drain It
Six Chinese AI companies spent at least a year systematically querying American frontier AI models at industrial scale, extracting billions of tokens of output to train their own competing systems — and they did it through the front door, using commercial API access that any developer can purchase for pocket change per million tokens.
That's the picture U.S. cybersecurity and intelligence agencies are now laying out: a coordinated campaign of model distillation attacks targeting American AI labs, conducted by firms operating with the resources and intent of state-backed industrial espionage programs.
The attack vector isn't a zero-day. There's no CVE. The "exploit" is a credit card and a lot of compute.
## How Distillation Becomes a Weapon
Model distillation is a legitimate machine learning technique. The idea: you take a large, expensive "teacher" model and use its outputs as training data for a smaller, cheaper "student" model. The student learns to mimic the teacher's behavior without ever seeing the teacher's weights. Every major AI lab uses some form of this internally.
The malicious version is the same process, applied to someone else's model without authorization. You query GPT-4 or Claude or Gemini millions of times, collect the responses, and use that corpus to train your own model — effectively transferring capabilities developed at enormous cost to yourself, at a fraction of that cost.
At small scale, this is annoying and a terms-of-service violation. At the scale now being described — billions of tokens across six companies — it's something closer to a systematic capability transfer program. The goal isn't to answer questions. The goal is to build a training dataset that encodes how frontier American models reason.
The timing is not subtle. DeepSeek's R1 model, released in January 2025, shocked the AI industry with reasoning capabilities that rivaled OpenAI's o1 series at a fraction of the compute cost. OpenAI flagged at the time that DeepSeek's training data showed signs of distillation from their models. What U.S. agencies are now describing sounds like the infrastructure behind that kind of capability leap — not one company catching a shortcut, but an organized pipeline.
## The Scale Problem
"Billions of tokens" is the number that deserves a moment of attention.
To put it in context: the average English word is roughly 1.3 tokens. A billion tokens is approximately 770 million words — more than the entire English Wikipedia, twice over. Extracting that volume through normal API usage requires either an enormous number of accounts, query patterns that should have triggered anomaly detection long ago, or both.
API usage monitoring at the major labs has historically been optimized to catch spam, misuse, and content policy violations — not systematic distillation campaigns. Rate limits are designed for fairness, not for preventing a well-funded actor from distributing queries across thousands of accounts over months. The signal is there in the aggregate; the question is whether anyone was looking for it.
Export controls are the other layer. American export law has spent years tightening restrictions on advanced chips going to China. The logic is that compute is a strategic resource. But if a Chinese firm can purchase API access to a frontier model — effectively renting the intelligence that chip investment produced — the chip controls are partially circumvented. The model's outputs are crossing the border with every API response, and no export control framework has caught up to that reality.
## What Was Actually Taken
This is worth being precise about, because "billions of tokens" is abstract.
Distillation attacks aren't random. Attackers query models specifically to elicit capabilities they want to replicate: complex reasoning chains, code generation, scientific analysis, math problem-solving, instruction-following under adversarial conditions. The output corpus is curated. You're not downloading Wikipedia; you're systematically probing for exactly the behaviors that make frontier models strategically valuable.
That means what was extracted is not just text. It's a compressed record of how American frontier models approach hard problems — the kind of reasoning capabilities that took hundreds of millions of dollars and years of alignment research to develop.
## What Defenders Actually Have Left to Do
For AI companies, the immediate response is detection: query pattern analysis at a level of sophistication that goes beyond simple rate limiting. Correlated accounts, non-human query distributions, systematic coverage of capability domains — these are detectable with the right analytics. The fact that this campaign ran for at least a year before government agencies flagged it suggests the detection infrastructure wasn't there, or wasn't prioritized.
Export control reformers have a cleaner argument now: if frontier model API access is functionally equivalent to exporting the model's capabilities, it needs to be treated accordingly. That's a politically uncomfortable position for AI companies that have built business models around open API access, but the alternative — watching capability gaps close through authorized-but-weaponized commercial access — isn't a winning strategy either.
For security teams outside the AI sector: the pattern matters. Industrial-scale abuse of commercial access to extract proprietary capabilities is not a technique that stays in one domain. Any organization whose competitive advantage lives in a queryable system — search engines, recommendation systems, specialized analytics tools — is looking at a version of this threat.
---
## HackWire Analysis
The framing of this story as a "cyberattack" is technically accurate but slightly misleading, and that framing matters because it shapes the defenses people will consider.
This wasn't intrusion. No systems were compromised. The attackers operated within the exact access model the AI companies designed and sold. That makes the accountability picture murky — it's a ToS violation, it's arguably commercial espionage, it may implicate export law, but it doesn't fit the existing mental model of "China hacked American AI companies."
The deeper issue is that the frontier AI business model has an embedded vulnerability: the product's intelligence is queryable by anyone with a payment method. Every other strategic technology — advanced chips, secure communications systems, specialized materials — has export controls that track physical transfer. Frontier AI outputs have no equivalent gate.
The six companies named by U.S. agencies are likely not unique. They're the ones that got caught at scale. The technique is well-documented in academic literature; any well-funded team with AI researchers knows how to execute it. What we're seeing is the first high-profile government acknowledgment that the API surface of American frontier AI is a national security exposure — not because someone found a vulnerability, but because the feature worked exactly as intended, at a scale nobody was watching for.
The chip war and the API war are the same conflict. Washington is only now catching up to that.
— HackWire Editorial
---
## Related Coverage