On 8 September 2026, three United States security agencies published a joint warning about artificial intelligence. Most headlines picked up the big accusation: that Chinese AI firms copied American AI models on a huge scale. But one line inside the document affects ordinary users. The agencies told American AI companies to quietly serve downgraded answers to accounts they suspect of copying — weaker replies, with no warning that anything changed.
That raises a fair question. Can the chatbot you use every day decide to give you a worse answer on purpose?
Here is what the document actually says, and what it means for you.
What did the NSA, CISA and FBI actually say?
On 8 September 2026, the NSA, CISA and the FBI published joint advisory AA26-251A. It accuses six China-based AI companies of copying American AI models at a massive scale since late 2024. It also advises US AI providers to send downgraded answers to accounts they strongly suspect of copying, without telling those accounts anything has changed.
The six companies named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the advisory published by CISA, the targets included Anthropic’s Claude, OpenAI’s GPT models behind ChatGPT, Google’s Gemini and xAI’s Grok.
The scale is the striking part. The agencies describe “billions of tokens across millions of exchanges”. A token is a small piece of text — roughly a short word, or part of a longer one. So this means an enormous volume of questions and answers, collected over months.
The advisory also says DeepSeek’s widely quoted training cost of $5.6 million is misleading, because that figure leaves out the value of data taken from other companies’ models.
China rejected the claims. As reported by NBC News, Chinese embassy spokesperson Liu Chang called the accusations a “deliberate attack on China’s development and progress in the AI industry”. Bloomberg reported that the six named companies did not immediately reply to requests for comment.
What is AI distillation, in plain English?
Distillation is when one AI learns by copying another AI’s answers. A team sends millions of questions to a strong model, saves every reply, then uses those replies to train their own model. The copy picks up much of the skill for a fraction of the cost.
Think of a student who never attends class but photocopies the top student’s notebook all year. They end up knowing most of the same material, without doing the work.
Distillation turns someone else’s finished homework into your training data.
Here is the part that surprises people: distillation is normal and legal when a company does it to its own models. Big labs shrink their own large models this way to make cheaper, faster versions. The problem is doing it to a competitor’s model, which nearly every provider bans in its terms of service. If you want a refresher on how these pieces fit together, our guide to the 10 building blocks of modern AI covers the basics.
Why would an AI company give downgraded answers on purpose?
Because banning an account tells the copier they were caught. A quietly weakened account does not. If a suspected copier keeps receiving replies from a weaker model, the data they collect becomes far less valuable — and they may train on it for months without noticing.
The advisory is blunt about this. It tells providers to “avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model”. The stated reason: telling them would help them dodge detection in future, and would show them exactly when to undo their training.
A ban stops the copying today. A silent downgrade spoils months of the copier’s work.
The document suggests two ways to do this. One is swapping in a weaker model for suspect accounts. The other is adding small amounts of noise to the replies — tiny deliberate imperfections that a human reader would barely notice, but that make the answers messy to train on.
Could a normal user get caught by mistake?
It is possible, but unlikely for everyday users. The warning signs in the advisory are behaviours, not nationalities — and some of those behaviours look similar to ordinary business automation. No American AI company has publicly said it serves downgraded answers to anyone, so there is no proof this is happening to regular customers.
The behaviour patterns the advisory flags include:
- A brand-new account that jumps to maximum usage on day one
- Usage running 24 hours a day with no human rhythm — no sleep, no weekends, no pauses
- One paid subscription shared across a whole team of developers
- Traffic routed through proxy networks that hide which country it came from
- Automatic switching to a backup account the moment one gets limited
Read that list again as a small company. A startup running a nightly batch job through one shared API key, over a VPN, ticks several boxes. So does a research team sharing a single paid seat. That is the honest risk here: the pattern describes bulk automated use, not nationality.
If you are a person typing questions into ChatGPT, Claude or Gemini, you look nothing like this. Your usage has gaps, moods and typos. The exposure sits with heavy automated use through developer accounts — which is also why sharing one login across many people is a bad idea for AI account security generally.
How would you know if your answers were downgraded?
Honestly, you would struggle. AI answers vary from day to day anyway, and no provider puts a label on a reply saying “this came from the smaller model”. The only practical signal is a sharp, lasting drop in quality on prompts that worked well for months.
A few habits make that easier to spot:
- Keep fixed test prompts. Save five prompts you use often, run them once a month, and keep the answers. A real drop shows up against your own record, not your memory.
- Check the model name in the reply. If you use an API, the response usually names the model that answered. Read it instead of assuming.
- Do not share one paid account across a team. Buy proper seats or separate API keys. It is cheaper than being flagged.
- Skip the VPN for routine AI work. Hiding your country is one of the listed warning signs.
- Ask support directly. If quality falls off a cliff, raise a ticket and ask whether your account has any limits applied.
What this means for you
For most readers, nothing changes today. You are very unlikely to be on the receiving end of downgraded answers, and no company has admitted to using the tactic.
The bigger shift is how AI companies now see their own output. For years, the model was the treasure and the answers were just a product. This advisory treats the answers themselves as something worth guarding, because answers are what a copier actually needs.
Expect the practical effects to reach you slowly: tighter rate limits, more identity checks on new developer accounts, and stricter rules about sharing logins.
And there is one uncomfortable detail worth noticing. A government has now formally advised companies to be less than fully honest with a group of their own users. The target is narrow and the reasoning is clear. But it is a new norm, and norms tend to spread.
Frequently Asked Questions
Is ChatGPT or Claude giving me worse answers right now?
There is no evidence of that. No US AI provider has said publicly that it downgrades answers for anyone. The advisory aims the tactic at accounts a provider strongly suspects of bulk copying, not at ordinary paying users.
Is AI distillation illegal?
Not automatically. Companies distil their own models all the time, and that is perfectly legal. Doing it to a rival’s model breaks nearly every provider’s terms of service, and the US agencies describe it as theft of valuable technology. The wider legal position is still unsettled.
Should I stop using DeepSeek because of this advisory?
This advisory is about how DeepSeek was trained, not about what it does with your data. A separate concern already exists: DeepSeek’s own privacy policy says it stores user data on servers in China, and several governments have banned it on official devices. For sensitive work, avoid it. For casual use, that is your call.
What counts as suspicious use of an AI account?
The advisory describes patterns, not people: a new account at maximum usage immediately, non-stop activity with no human breaks, one subscription shared by many developers, and traffic hidden behind proxy networks. Normal human chatting looks nothing like this.
