Three of America’s most competitive AI companies are now sharing intelligence with each other — not about their models, but about who is trying to steal them. OpenAIanthropic, and Google Through a technique called distillation, Chinese AI firms have begun quietly coordinating to detect and prevent the extraction of capabilities from their systems. The effort runs through the Frontier Model Forum, an industry nonprofit it founded with Microsoft in 2023, Bloomberg reported. It’s an unusual arrangement – these are companies fighting for the same customers, the same engineers, and increasingly the same government dollars. But apparently the threat has become so great that the rivalry can be sidelined.
What exactly is distillation and why has it become a problem
Distillation is standard practice in AI development. Companies routinely use it to create smaller, cheaper versions of their own models. What is not standard is when a competitor uses the same technology to clone your model’s capabilities – on an industrial scale, through fake accounts and proxy networks, without paying for the R&D behind them.Anthropic has put forward specific numbers for this. In February, the company had named three Chinese labs—DeepSeek, Moonshot and MiniMax—that had conducted a coordinated extraction campaign against the cloud, racking up more than 16 million exchanges through about 24,000 fraudulent accounts. MiniMax alone ran more than 13 million of them. To avoid Anthropic’s ban on commercial access from China, the labs reportedly routed traffic through proxy services running a network of 20,000 fake accounts at a time, mixing extraction traffic with normal requests to avoid detection.OpenAI told the US House Select Committee on China in February that DeepSeek is continuing similar efforts against US laboratories through increasingly obscure methods. Google’s threat intelligence team has flagged an increase in “model extraction attacks” on Gemini – one campaign alone generated more than 100,000 signals apparently designed to replicate the model’s chain-of-thought logic.
Beyond the business case: Why Washington is paying attention
Both Anthropic and OpenAI have taken precautions to keep this beyond lost revenue. Models made through unauthorized distillation circumvent safety guardrails, he says, and US laboratories spend heavily on things like bioweapon synthesis instructions or large-scale cyberattack support. Put those stripped-down models into military or intelligence systems, and the problem grows exponentially.US officials, speaking on condition of anonymity, estimated to Bloomberg that unauthorized distillation generates billions in profits for Silicon Valley laboratories annually. The Trump administration’s AI Action Plan partly calls for a formal information-sharing center to address this—suggesting at least some appetite in Washington to create a structure around a cool, informal arrangement currently in place between rivals.
The battle of distillation is really about who controls the next decade of AI
The effort to share information is a start, but it is based on a structural problem. As long as the proxy network can open 20,000 fake accounts faster than any one company can close them, the math doesn’t work in the defenders’ favor. OpenAI has explicitly called for an “ecosystem security” approach – fortifying not just individual labs but API routers, cloud providers, and payments infrastructure together. One weak link is enough.Meanwhile, attacks are becoming harder to detect. Chinese actors have taken simple output scraping much further, turning it into multi-stage pipelines that blend synthetic data generation with reinforcement learning – essentially automating the process of building rival models on someone else’s foundation. Anthropic caught MiniMax midway through the campaign and watched it roam within 24 hours of the new cloud release, redirecting traffic to capture capabilities from the latest version. Without coordination it is difficult to cope with the kind of operational speed that currently does not exist on a large scale.
