WHAT WAS ISSUED
● A joint advisory from the NSA, CISA and FBI, reported by Reuters.
● The allegation: Chinese AI companies including DeepSeek are conducting industrial-scale distillation campaigns.
● What it is not: a ban, a sanction, or a restriction on using these models.
● What it is: a formal government position that changes the risk calculation for enterprise buyers.
What distillation actually means here
Distillation is training a smaller model on the outputs of a larger one. Done with permission it is standard practice. Done at scale against a competitor's API, it is a way of transferring capability you did not pay to develop — and it generally violates the terms of service of every major provider.
The word industrial-scale is doing the work in this advisory. It implies systematic, sustained extraction rather than incidental use, which is a different claim from any individual company having done it once.
WHY THIS IS NOT NEW, AND WHY IT STILL MATTERS
Distillation allegations against Chinese labs have circulated since early 2026. Moonshot faced them in July alongside a sanctions threat. What has changed is who is saying it.
An accusation from a competitor is a commercial claim. A joint advisory from three US agencies is something a procurement team has to write down.
What it does and does not do
| Question |
Answer |
| Are these models now banned? | No. An advisory is guidance, not a prohibition |
| Do I have to stop using Kimi K3 or GLM-5.3? | Nothing requires it. Your procurement policy might |
| Does it affect self-hosted weights? | Weights you have downloaded are on your hardware. The advisory concerns how they were built |
| Could this become a restriction? | Advisories often precede action. That is worth planning for rather than assuming |
| Does it say the models are unsafe to run? | The allegation is about how capability was acquired, not about the models attacking you |
The awkward position it creates
Several of the most capable open-weight models this year came from Chinese labs. Kimi K3 leads on agentic coding benchmarks. GLM-5.3-Flash ships genuinely permissive MIT weights. Qwen previews the architecture others will copy. Tencent just released a 770B flagship under Apache 2.0.
For a team that chose open weights specifically to reduce dependency on a single US vendor, this advisory reintroduces exactly the geopolitical exposure they were avoiding — from the other direction.
There is no clean answer to that. The honest framing is that it is now a documented factor in the decision rather than a rumour, and different organisations will weigh it differently and reasonably.
What to actually do
- Write down which models you depend on and where they came from. If a procurement question lands next month, that list is what you will be asked for.
- Keep a fallback configured. This is the third reason this year a model you rely on might become unavailable, after licensing terms and capability gating.
- Distinguish self-hosted from API. Weights on your own hardware have a different exposure profile from calls to a hosted endpoint.
- Do not overreact. An advisory is not a ban, and nothing about model quality changed yesterday.
- Do not underreact either. If you sell into government or regulated sectors, expect this to appear in a questionnaire.
Sources
FAQ
What did the NSA, CISA and FBI warn about?
A joint advisory alleging that Chinese AI companies, including DeepSeek, are conducting industrial-scale distillation campaigns — systematically training on the outputs of Western models.
Is DeepSeek banned in the US?
No. An advisory is guidance rather than a prohibition, and nothing announced restricts use.
Should I stop using Chinese open-weight models?
Nothing requires it. Whether your organisation should is a procurement question, and it will be answered differently by a startup than by a government contractor.
Does this affect models I have already downloaded?
Weights on your own hardware are unaffected operationally. The allegation concerns how the models were built rather than what they do when you run them.
What is distillation?
Training a model on the outputs of another model. With permission it is routine; done systematically against a competitor's API it typically violates terms of service.
Could this become a restriction later?
Advisories sometimes precede formal action. Keeping a fallback configured is a reasonable precaution rather than an alarmed one.