What happened with AI distillation attacks in 2026? Distillation attacks, the unauthorized harvesting of a model's outputs through its API to train a competing model, went from an accusation to a documented, attributed threat. OpenAI, Google and Anthropic each published accounts in February; the White House issued a memorandum in April; CISA, NSA and FBI published a joint advisory in September; and by October stolen customer API keys were part of the story. This timeline lists the public disclosures we could source, with what each one said.
If the term is new, start with what a distillation attack is.
The timeline at a glance
| Date (2026) | Who | What was disclosed |
|---|---|---|
| 12 Feb | OpenAI | Memo to a House committee: DeepSeek pursuing adversarial distillation through obfuscated third-party routers |
| 13 Feb | Google Threat Intelligence Group | Model extraction attempts against Gemini, one of more than 100,000 prompts |
| 23 Feb | Anthropic | Campaigns by DeepSeek, Moonshot and MiniMax: about 24,000 fraudulent accounts, more than 16 million exchanges |
| 23 Apr | White House OSTP | NSTM-4: industrial-scale distillation campaigns using tens of thousands of proxy accounts |
| 23 Aug | The Decoder (reporting) | The gray market of "transfer stations" selling Claude access in China |
| 8 Sep | CISA, NSA, FBI | Advisory AA26-251A names six China-based companies, with indicators and mitigations |
| 10 Sep | Anthropic | Threat report: campaigns from seven China-based labs; stolen API credentials named as a source of access |
| 30 Sep | OpenAI | A coordinated campaign to extract protected reasoning, core cluster attributed to Moonshot AI |
| 12 Oct | Anthropic | New defenses: classifiers, faster bans, charges for blocked requests |
| 17 Oct | OpenCode | Console breach "related to a large-scale distillation attack"; stored provider keys may have been exposed |
February: three providers go public
12 February: OpenAI's memo to the House Select Committee. In a memo to the House Select Committee on the Chinese Communist Party, OpenAI said its review found DeepSeek continuing activity consistent with adversarial distillation against OpenAI and other US labs, including accounts associated with DeepSeek employees reaching models through obfuscated third-party routers and code written to collect outputs programmatically1. It said most of the adversarial distillation it observes appears to originate from China, occasionally Russia, and that Chinese companies relied on networks of unauthorized resellers of OpenAI's services to evade its controls1. Among its policy asks: addressing API router loopholes.
13 February: Google's AI Threat Tracker. Google Threat Intelligence Group described model extraction attacks, which it also calls distillation attacks, as intellectual property theft, and reported one campaign of more than 100,000 prompts that tried to make Gemini reveal its full reasoning in non-English languages2. Google attributed the attempts to private companies and researchers around the world and said it had not observed direct attacks on frontier models by the state-backed groups it tracks in 20252.
23 February: Anthropic names three labs. Anthropic said DeepSeek, Moonshot and MiniMax ran industrial-scale campaigns totalling more than 16 million exchanges through roughly 24,000 fraudulent accounts3. It described proxy "hydra cluster" networks, one managing more than 20,000 accounts at once and mixing distillation traffic with ordinary customer requests, prompts designed to elicit chain-of-thought reasoning, and one lab moving nearly half its traffic to a new model within 24 hours of its release3.
April to August: policy and the gray market
23 April: NSTM-4. A memorandum from the White House Office of Science and Technology Policy said foreign entities, principally based in China, were running deliberate, industrial-scale campaigns to distill US frontier systems, using tens of thousands of proxy accounts and jailbreaking techniques4. It committed the administration to share information with US AI companies, help them coordinate, develop best practices with industry, and explore ways to hold foreign actors accountable4.
23 August: the transfer-station market, as reported. The Decoder, drawing on research by Zilan Qian and a CISPA study of API proxies, described API proxies hosted outside China that relay requests to Claude, take payment in yuan and sell tokens at a fraction of the official price, with account brokers registering accounts in bulk5. This is reporting, not a provider disclosure; it matters because the September advisory used the same term. AI API proxy risks covers that market from a buyer's side.
September: the advisory and the attribution reports
8 September: CISA, NSA and FBI publish AA26-251A. The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI distilled US frontier models, including Claude, GPT, Gemini and Grok, since at least late 2024, likely with Chinese government awareness6. It describes fraudulent accounts, shared premium subscriptions, transfer stations, centralized routing across pathways and automated metadata sanitization, and lists detection indicators and three immediate actions for US AI companies6. Our guide to AA26-251A walks through it.
10 September: Anthropic's threat report. Anthropic's September report, dated 10 September by TechCrunch's coverage7, says it has disrupted distillation attacks from seven labs based in China since February8. The largest it attributes to Alibaba: more than 151 million exchanges from May to July 2026, peaking near 3 million a day from more than 3,500 fraudulent accounts. It also describes campaigns attributed to Moonshot, DeepSeek, Zhipu and Xiaomi, and says some labs silently relayed their own customers' requests to Claude8. The detail with the widest reach: the proxy services behind these campaigns create accounts with fake or stolen cards and stolen API keys, and often use stolen API credentials belonging to legitimate companies or individuals8.
30 September: OpenAI disrupts a reasoning-extraction campaign. OpenAI described a campaign starting on 1 July that tried to extract protected reasoning, including by replaying encrypted reasoning from one conversation in another and asking the model to transcribe it. It peaked on 24 and 25 July at 16,000 requests from more than 4,000 users, and a related cluster of more than 15,000 users was disrupted by 28 July9. OpenAI attributed a core cluster to individuals associated with Moonshot AI and shared the technique through the Frontier Model Forum9.
October: defenses and a breach
12 October: Anthropic's defenses. Anthropic said it now limits where reasoning can be reused, runs a two-stage classifier, bans accounts often within two hours of a campaign starting, and charges for requests blocked before Claude responds. It reported early evidence of a 90 to 99% cut in the data distillers harvest, and said some legitimate users have had to update their integrations10. It also described proxy networks controlling hundreds of thousands of fraudulent accounts created with false identities and stolen payment details10.
17 October: OpenCode. OpenCode said it had a security breach "related to a large-scale distillation attack" that affected 1.4% of OpenCode Console users, those with external providers linked, as quoted by BleepingComputer11. Infosecurity Magazine reported OpenCode's email saying provider keys saved in workspaces may have been exposed and that OpenCode had notified OpenAI, Anthropic and Google12. BleepingComputer reported user accounts of unexpected charges and of Google suspending projects11. No root cause had been published at the time of writing; see the OpenCode incident write-up.
What changed for API-key holders
None of these disclosures is addressed to a company that simply uses AI APIs. Read together, they still change how such a company should treat its keys.
- Stolen keys are named supply. Before September, the public story was fraudulent accounts. Anthropic's report put stolen API credentials of legitimate companies on the list of what proxy services use8. An AI key now has a buyer. Stolen API keys and distillation campaigns explains the economics.
- Enforcement is faster, and it lands on the account. Bans within hours are good for providers and bad for the owner of a hijacked key, whose production traffic stops with the attacker's. See what to do when a provider suspends your account.
- Blocked abuse may still be billed. Anthropic says requests its classifiers block are now charged10. If those requests ride on your key, our inference is that they land on your invoice.
- Intermediaries are in scope. OpenAI asked for API router loopholes to be addressed1, and the advisory asks cloud providers and API aggregators to share indicators6. Expect more identity checks wherever keys are pooled or relayed.
- Tools that store keys are targets. The OpenCode disclosure shows that a platform holding many customers' provider keys is worth attacking, whatever the eventual root cause. Ask every such tool how it stores and scopes them; third-party AI tools and key storage has the questions.
How INFRO handles keys in this threat model
INFRO is one of those tools: it stores the provider keys customers connect, encrypted with AES-256-GCM under a key held outside the database, bound to the organization and connection, and never shown again after saving. Applications use INFRO gateway keys that can be restricted by provider, environment and IP range, expire and rotate with an overlap window, and budgets refuse a request with 402 before the provider is called. Spend alerts flag a day that departs from a scope's usual pattern, and on the Business plan reconciliation can show traffic on your OpenAI or Anthropic account that did not go through INFRO, when usage access is on.
Those controls govern traffic that goes through INFRO. A provider key stolen from anywhere, including from a platform like INFRO, can be used directly against the provider and bypasses all of them. The backstops for that case are provider-side: scoped keys, provider spend limits, revocation at the provider and the provider's usage reports.
Summary
2026 is the year AI distillation became a named threat with dates, attributions and a government advisory. Most of it is a fight between model providers and the labs copying them. The part that reaches everyone else is access: campaigns consume accounts and keys, some of them stolen from ordinary companies, and providers now act on those accounts quickly. Treat each AI key as a production credential and cap it at the provider.