The Feds Just Published a List of 'Suspicious' AI Usage Patterns. Your Overnight Agent Job Matches Four of Them.

Note: NSA, CISA, and the FBI published joint advisory AA26-251A on September 8, 2026 — one day old as of this writing. This is current news, not a recap.

Here’s a question worth sitting with for a second: if the company behind the AI model your business runs on decided, quietly, to start giving your account worse answers because your usage pattern looked “suspicious” — would you even know? Would you know why, or would you just notice, weeks later, that the model you’re paying for got worse at your job and assume it was a model update?

That question stopped being hypothetical on September 8, 2026. The National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI published a joint cybersecurity advisory — AA26-251A — naming six China-based AI companies (DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI) as running “aggressive, malicious, and targeted” industrial-scale distillation campaigns against U.S. frontier models since at least late 2024. The advisory doesn’t just name the accused. It tells American AI providers exactly what usage patterns to watch for — and it recommends they respond not by blocking flagged accounts outright, but by quietly degrading their output instead.

That second part is the actual story for anyone running a small operation on top of a commercial AI API. The behavioral fingerprint the advisory describes isn’t exotic. Some of it is what your legitimate overnight agent job looks like from the outside.

What actually got published, and what it accuses

Knowledge distillation — training a smaller, cheaper model on a bigger model’s outputs — is a completely normal, legal machine learning technique. Every major AI lab does versions of it internally. The advisory isn’t accusing anyone of using distillation. It’s accusing six specific companies of running distillation “at an industrial scale” against U.S. frontier models specifically, through methods designed to evade detection and bypass usage restrictions — and, per the advisory’s own framing, doing it as “the critical core” of their model development strategy, not a side activity.

The advisory is specific about method, not just intent. It describes companies using fraudulent accounts, bulk premium subscriptions purchased in volume, and “transfer stations” — gray-market API proxy services that route requests through intermediaries to dodge geographic restrictions and rate limits. It also calls out automated metadata sanitization: stripping organizational identifiers off requests before they hit the target API, specifically to defeat the kind of fingerprinting that would otherwise flag a coordinated campaign.

One detail that undercuts the “scrappy underdog” framing some of these companies use publicly: the advisory states DeepSeek’s widely reported $5.6 million training cost for its R1 model is “misleading” once you account for the cost of the distilled training data it extracted from U.S. frontier models to get there. Anthropic itself had already flagged a version of this in February 2026, disclosing to U.S. senators that it had detected Alibaba running roughly 28.8 million Claude queries through 25,000 fake accounts — the largest single distillation campaign the company had disclosed at the time. This advisory is the government formalizing and generalizing what individual vendors were already seeing.

The advisory also gets specific about which company did what, which matters because the six named firms aren’t accused of running one identical playbook — each allegedly leaned on the same underlying “transfer station” proxy infrastructure but pointed it at different targets. Moonshot AI is named as running a distillation campaign since at least mid-2025 specifically against Claude, extracting output at scale to train its Kimi-K3 model. StepFun and Z.AI are called out for targeting the advanced coding and reasoning capabilities of newer U.S. model generations specifically — not general-purpose chat output, but the harder, more expensive-to-produce reasoning traces. DeepSeek’s technique gets its own callout: prompts engineered to get the target model to “imagine and articulate” the internal reasoning behind a response it had already given, effectively asking the model to hand over its own chain-of-thought after the fact, which is a more sophisticated extraction method than simply logging raw outputs. The common thread across all six is that the “transfer station” proxy layer — the gray-market API intermediaries the advisory names as the connective infrastructure — is what let them obscure which requests belonged to which operation, which is also why the advisory’s recommended detection method leans on behavioral pattern-matching rather than simply blocking known bad IPs: the proxies make IP-based blocking close to useless on its own.

The four behavioral indicators, and why your automation might trip them

This is the part that matters if you run anything more automated than manually typing prompts into a chat window. The advisory gives providers a specific list of red flags to watch for on their own platforms. Read them as a small-shop operator, not as a nation-state analyst, and a few of them get uncomfortable:

None of this means your account is going to get flagged tomorrow. Vendors aren’t going to treat a five-person shop running an overnight sync job the same way they treat 25,000 fake accounts routing through a proxy farm — scale and context matter enormously to any real detection system, and the advisory itself is written for enterprise-scale providers building this into fraud-detection pipelines, not a blunt trigger on any single indicator. But it’s worth being honest about the mechanism: the advisory recommends that when a provider does flag an account with “high confidence,” the response isn’t necessarily a ban notice you can appeal. It’s quiet degradation — the model gets subtly worse for that account, on purpose, with no announcement. That’s the exact failure mode from the opening question. If your agent’s output quality drifts and you assume it’s a model update, a rate limit, or bad luck, you may have no way to distinguish that from your account getting caught in a dragnet built for someone else.

Why “quiet degradation” as policy is the actual small-shop risk here

Blocking an account outright is loud — you get an error, you notice, you can email support and sort it out. Quiet degradation is designed specifically not to tip off a sophisticated bad actor that they’ve been caught, so they don’t just spin up a new proxy and keep going. That’s a reasonable anti-evasion tactic against the six companies actually named in the advisory. It’s a much worse experience if you’re a small shop that got caught in the same net by accident, because the entire mechanism depends on you never knowing it happened.

This isn’t a hypothetical overreach risk invented for this piece — it’s the literal recommended mitigation in a joint federal advisory, aimed at providers who serve millions of API customers with automated fraud systems that, by necessity, work on statistical patterns rather than individual human review of every flagged account. Automated systems built to catch industrial-scale abuse at that volume are not going to be perfectly precise, and the false-positive cost falls on whoever the system flags, correctly or not, with no notification requirement attached.

What this actually means if you run automation on a commercial AI API

Don’t panic and don’t stop automating. Nothing here suggests small-shop automation is a widespread target of enforcement, and the entire advisory is aimed at industrial-scale, evasion-engineered campaigns, not a five-person team running a nightly inventory sync. But three practical habits get more valuable given this:

1. Keep your usage boring and identifiable. Use your real business email and payment method on the account, avoid routing your legitimate traffic through third-party API aggregators or proxy services if you can call the vendor’s API directly, and don’t share one account’s credentials across unrelated projects in a way that would look, from the outside, like multiple actors hiding behind one login. None of this is exotic advice — it’s the difference between “obviously one small business’s automation” and “unclear, could be anything.”

2. Log your own usage independently of the vendor’s dashboard. If a provider ever does silently degrade your account’s output quality, the only way you’ll notice quickly is if you have your own before/after record to compare against — the same discipline covered in the piece on tracking your own AI spend applies just as well to tracking output quality over time, not just cost.

3. Have a real fallback that doesn’t depend on any single vendor’s account-health decisions. The two-tier model router pattern — abstracting your automation behind an interface so swapping providers is a config change, not a rewrite — was originally framed around cost and vendor churn. This advisory is a second, independent reason it’s worth having: if one provider’s fraud system ever decides your account looks wrong, you want switching providers to be a five-minute change, not a crisis.

4. Consider how much of your routine, high-volume work actually needs to hit someone else’s API at all. Two 30B-class open-weight models built specifically for always-on local agent work shipped a few weeks ago, aimed at exactly the “high-volume execution layer” tasks — batch processing, validation, tool calls — that look most like the flagged usage pattern when run against a cloud API. Moving that specific slice of work onto hardware you own doesn’t just save money; it removes the entire “is my account being watched” question for that workload, because there’s no account to watch.

A worked example: the four-person dev shop that trips three of the four flags without doing anything wrong

Picture a small software shop: four developers, a shared OpenAI or Anthropic API key on the team’s billing plan, and a nightly CI pipeline that runs an agent to review pull requests, regenerate documentation, and flag failing tests before the team’s morning standup. Now check that setup against the advisory’s own indicator list:

• 24/7 usage without idle periods — the CI pipeline runs every night, unattended, whether or not a human is awake. Check.
• Shared accounts from multiple IPs/user agents — four developers’ laptops, plus the CI server’s IP, all hitting the same API key. Check.
• New subscription immediately at maximum usage — if the team upgraded from a free trial to a paid tier specifically because the automation was already built and ready to run at full volume, that’s the exact pattern the advisory flags as suspicious rather than gradual, “normal” adoption. Check.

Three out of four, and this is a completely ordinary, legitimate small dev shop that has done nothing wrong. This isn’t a reason to panic or to dismantle the CI pipeline — it’s a reason to do the boring things that make an account look obviously legitimate rather than obviously ambiguous: one named account holder tied to a real business identity and payment method, usage that scales up visibly over weeks rather than appearing at full volume overnight, and a paper trail (invoices, a business domain email, a real support ticket history) that a human reviewer — if it ever gets to a human reviewer — can resolve quickly instead of leaving the account in an automated degradation queue indefinitely.

A second, smaller example makes the same point from a different angle. A solo bookkeeper running a one-person practice sets up a scheduled agent that pulls client invoices out of a shared inbox every night at 2am, categorizes them, and drops a summary into a spreadsheet before she wakes up. One account, one IP most nights, well under any volume threshold that would matter to a fraud team looking for industrial-scale extraction. On paper this looks nothing like the six companies named in the advisory — and it isn’t. But it still technically satisfies the first indicator (24/7 usage, no idle periods, human never present while it runs) and, if she signed up for a paid tier specifically because the automation was already built and tested, the third indicator too (new subscription immediately at meaningful usage). The difference between her and the four-person dev shop isn’t the pattern — it’s scale, and scale is exactly the variable a statistical detection system is built to weigh, which is also exactly why the advisory itself is aimed at enterprise-scale fraud pipelines rather than a blunt rule anyone could trip by accident. She’s not a likely target for review. But “not a likely target” and “structurally invisible to the detection system” are different claims, and only one of them is actually true here.

When this genuinely doesn’t apply to you

If your actual AI usage is a handful of manual chat sessions a day, none of this advisory’s detection surface applies to you — the indicators are specifically about automated, high-volume, round-the-clock patterns, and a person typing questions during business hours looks nothing like that. Don’t restructure your workflow around a threat model that isn’t yours. This matters specifically for shops running unattended automation, scheduled agent jobs, or shared API keys across a small team — if that’s not your setup, file this under “worth knowing exists,” not “worth changing anything about today.”

Quick answers

Will I get an email if my account gets flagged? Not necessarily, and that’s the entire point of this piece. The advisory’s recommended response — quiet output degradation rather than an outright block — is explicitly designed to avoid tipping off a sophisticated bad actor. A notification requirement would defeat that purpose, which means there’s no guarantee a legitimate account swept up by mistake gets told either.

Does this apply to consumer AI subscriptions like a personal ChatGPT Plus account? The indicators are built around automated, high-volume, API-style usage patterns — a person using a chat app manually, even heavily, doesn’t produce the 24/7-no-idle-periods signature the advisory describes. This is squarely about programmatic API usage, not consumer chat habits.

Is switching to a Chinese AI model’s API a way to avoid this problem entirely? That trades one risk for a different one. The advisory itself is about the security and provenance concerns around exactly those providers, separate from any usage-pattern flagging question. It’s not a workaround worth taking on for this specific reason.

How would I actually notice quiet degradation if it happened to my account? Only by comparison against your own record. If you don’t already log representative outputs for the same recurring task over time, there’s nothing to compare a suspected quality drop against — which is exactly why the logging habit in this piece matters more than any single defensive step.

Sources

5 refs

All facts and figures accessed September 9, 2026.

1. Full advisory text, named companies, behavioral indicators, and recommended mitigations — CISA, “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies,” AA26-251Acisa.gov
2. Context on DeepSeek’s disputed training cost claim and prior February 2026 Anthropic disclosure to U.S. senators (28.8M Claude queries via 25,000 fake Alibaba accounts) — Defense One, “China is trying to steal US AI models’ secrets, intel agencies warn”defenseone.com
3. Practical breakdown of the advisory’s usage-pattern indicators for AI model buyers — Digital Applied, “US Distillation Advisory: What AI Model Buyers Should Do”digitalapplied.com
4. Additional reporting on named companies and targeted models — Engadget, “US authorities accuse Chinese AI companies of industrial-scale campaigns to copy American models”engadget.com
5. Company-specific method details — Moonshot AI’s Kimi-K3 training via Claude extraction, StepFun/Z.AI targeting coding and reasoning capabilities, DeepSeek’s “imagine and articulate” reasoning-extraction prompts, and the “transfer station” proxy infrastructure — GBHackers, “DeepSeek, Alibaba and Chinese AI Firms Extract Billions of Tokens From U.S. AI Models”gbhackers.com

Bottom line

The advisory is aimed at six companies running proxy farms and fake accounts at a scale no small shop is anywhere close to. But the detection method it recommends — quiet, unannounced output degradation based on statistical usage patterns — doesn’t come with a guarantee that only the intended targets get caught in it. If your business runs unattended automation on someone else’s API, this is a good week to make sure you’d actually notice if the model started quietly getting worse, and to make sure switching providers wouldn’t be a crisis if it did.