NSA/CISA/FBI name six Chinese labs, and recommend silently serving downgraded models

On September 8 the NSA, CISA and FBI published joint advisory AA26-251A and named names. DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI are accused of aggressive, malicious and targeted distillation: extracting billions of tokens across millions of exchanges from Claude, GPT, Gemini and Grok variants, since at least 2024, and probably with the Chinese government's knowledge. The accusation is one half of the story. The other half is the recommended mitigation, and that is the part that should worry anyone running a high-volume agent fleet.

What the advisory says

The labs allegedly spread queries across multiple providers and access paths to stay below any single vendor's detection threshold, then use the collected outputs as training data. That is why the detection side is framed around traffic patterns rather than individual prompts.

The mitigation advice is the sharp bit. Providers are told to serve suspected distillers less capable, downgraded models and to deliberately not tell them. No error, no header, no notice. Just a quieter model behind the same endpoint.

Why this hits legitimate fleets

Think about what a distillation run looks like from the provider's side: sustained high volume, repeated structural patterns, prompts that look like a dataset rather than a person, traffic spread across accounts. Now think about what a production agent fleet looks like: sustained high volume, repeated structural patterns, prompts that are templates, traffic spread across accounts and regions for resilience. The two signatures overlap almost completely.

The advisory acknowledges this only implicitly; the detection is pattern-based, and pattern-based detection has false positives. If your provider follows the recommendation, a false positive does not produce a 429. It produces a model that is a little worse at your task, with the same model ID in the response, and no way to know unless you are measuring output quality yourself.

A silent downgrade is the one failure mode your dashboards were never built to catch: same endpoint, same model ID, same latency, worse answers.

There is a second, quieter consequence. Many teams route cost-sensitive traffic to exactly the models named in the advisory: Qwen, DeepSeek, GLM, Kimi. On the same day, September 9, Z.AI's promo on GLM-5.3-Flash ended and the list price went back to $0.15 / $0.50 per million. Nothing in the advisory bans those models, but a client in a regulated sector will now ask whether they are allowed in production, and "we did not think about it" is not an answer.

What to do this week

The good news is that the defences are the same ones you should have for any provider-side regression.

• Canary prompts. Keep a small fixed set of prompts with known-good answers for every model you route to and run them on a schedule against the production endpoint. Compare against a stored baseline, not against your memory.
• Output quality gates. Put a cheap scorer between the model and the consumer for the tasks that matter. Output validation is usually built for safety; it works just as well for detecting a model that suddenly got dumber.
• Fallback routes. Have a second provider or model ready per tier and make the switch a config change. A router that can only route forward is not a router.
• Traffic hygiene. Do not make your fleet look more like a distillation run than it needs to: avoid spreading identical traffic across many accounts just for rate limits, and keep a clear ownership trail per key.
• Provenance in AI audits. Add a line item for model provenance: which models, from which vendor, under which license, and whether any are named in AA26-251A. This is now a compliance question, not just an engineering one.

The honest gap

Everything about the attribution here comes from the three agencies; the advisory does not publish the evidence, and the six labs have not had their side reported in the sources I have. Nor do we know whether any provider has actually implemented silent downgrades, or how. The operational risk I am describing is a consequence of the recommendation, not a documented incident. That is precisely why canaries and quality gates are the right response: they cost little, they work whether or not the downgrade ever happens, and they catch the ordinary regressions that hit fleets far more often than geopolitics does.