CISA Named 6 Distillers. Your Agent Fleet Fits the Spec.

Every detection indicator in this week's federal AI advisory describes a well-run enterprise agent fleet. Sustained 24/7 usage with no idle periods. A new subscription that goes straight to maximum throughput. One account hitting the API from many IPs. Usage optimised for cache hits rather than task diversity. That is not a Chinese distillation ring. That is your CI pipeline, your ticket triage agent, and the FinOps work your platform team did last quarter.

The NSA, CISA and the FBI published AA26-251A on 8 September 2026, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI for extracting billions of tokens across millions of requests from Claude, GPT, Gemini and Grok since late 2024. The coverage so far has been about the accusation. The part that changes your operating posture is the remediation section — because it is written entirely for the labs, it prescribes nothing for the customers who buy from them, and its headline recommendation is to serve suspected accounts a weaker model without telling them.

---

What the Advisory Tells the Labs to Flag

The indicators are behavioural, not forensic — there is no hash, no IP block, no signature to allowlist yourself against. The advisory tells U.S. AI providers to watch for "24/7 sustained usage without human variation/idle periods," "new subscriptions immediately at maximum usage as opposed to gradual AI adoption," "shared accounts from multiple IPs/user agents," and "anomalous subscription-to-API usage ratios."

Read those four back with a production agent platform in mind. A scheduled agent fleet runs on cron, not on circadian rhythm. A new enterprise tenant that has already passed procurement goes to full volume on day one, because that is what the business case promised. A service-account key issued once and consumed by workers across three regions is one account from many IPs by design. And an org that bought seats for its developers while driving most of its volume through the API has precisely an anomalous subscription-to-API ratio.

Then there is the cost-optimisation cluster, which is the sharpest of them: the advisory flags "usage optimized for cache maximization versus task diversity" and "coordinated pathway switching responding to pricing/rate changes." Maximising prompt-cache hit rate is the single most common piece of advice in enterprise AI FinOps — it is what Anthropic's own cache-read repricing rewards you for, and it is the whole point of capping context reads per pull request. "Coordinated pathway switching responding to pricing" is a description of a gateway doing least-cost routing. Both are engineering competence. Both are now on a federal detection list.

None of this means the labs will get it wrong at scale. It means the discriminator between you and the thing they are hunting is not in the traffic. It is in who you are — which is a KYC problem, not a telemetry problem, and the advisory's answer to it is that providers should "strengthen identity verification for accounts."

The Recommended Fix Is a Downgrade You Are Not Told About

The advisory's response-alteration guidance is explicit, and it is the most consequential paragraph the enterprise buyer has read this month. Providers are told that "response changes, such as including differential privacy or using less sophisticated 'downgraded' models to respond to distillation requests, can help protect U.S. proprietary functionalities."

Then it closes the disclosure door. "Avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model," the advisory says, because "informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training." It goes further and recommends varying the degradation so it cannot be measured: "Reducing reasoning depth, presenting correct information with different reasoning, or stylistic inconsistencies may evade detection."

That last sentence is the one to take to your vendor manager. The recommended implementation is specifically engineered to defeat quality evaluation. Not to be invisible to a user — invisible to a measurement. If a provider follows it, no status page will show an incident, no support ticket will return an acknowledgement, and the invoice will bill the tier you asked for. The advisory acknowledges no false-positive risk anywhere in its text, offers no guidance on customer notification, and directs its recommendations to "U.S. AI companies." Your side of the transaction is not addressed.

Anthropic Already Ran This Experiment in June

We know what this looks like in production, because one lab shipped it and got caught within 48 hours. When Anthropic released Fable 5 on 9 June 2026, requests flagged as attempts to extract or replicate the model's capabilities silently fell back to Claude Opus 4.8 — a safeguard documented only inside a 319-page safety report and the system card. Researchers found it, the backlash was immediate, and by 11 June the company had reversed course: "Starting this week, flagged requests will visibly fall back to Opus 4.8. On the API, any flagged requests will return a reason for their refusal."

The money is the part worth pinning down. On Anthropic's published pricing, Fable 5 is $10 per million input tokens and $50 per million output; Opus 4.8 is $5 and $25 — exactly half. A silent substitution means paying a 2x premium for what you did not receive. Anthropic later acknowledged the filters were deliberately wide, starting with "a very broad biology classifier" it expected would produce "a high number of false positives," and developers reported benign biology and chemistry work being caught. The complaint that landed was not the safeguard itself — it was that the vendor "would still charge you for the product that you thought you were getting." Anthropic now labels the switch and bills each segment at the model that actually served it.

Routing substitution is not unique to one vendor. Adversa AI's researchers documented a prompt-triggered routing flaw in GPT-5, which they named PROMISQROUTE, where a request nominally aimed at a frontier model could be steered to an older, weaker one — and estimated the routing layer saves the provider up to $1.86 billion a year. Whether or not that estimate holds, the architecture is now standard: what you name in the request is a request, not a guarantee.

So the June episode set a norm — disclose the downgrade, bill for what ran. AA26-251A asks the labs to break it, for reasons that are entirely legitimate and have nothing to do with you.

---

Your Contract Has No Model-Identity Warranty

Check the paper before you assume you have a remedy, because on the standard terms you do not. Anthropic's Commercial Terms of Service carry a 30-day notice requirement for changes to the terms (§M.3) and to published rates (§H.1), a suspension right where there is risk to the service or a policy violation with only "reasonable efforts" at written notice (§I.3), and a use restriction prohibiting access to build a competing product (§D.4) — the hook the whole advisory hangs on. What they do not contain is any service-level commitment or quality warranty. There is no clause that says the model you named is the model you get.

The base rates that make a substitution attractive are the same asymmetry that makes it invisible. And the enforcement machine on the other side already runs at a scale where errors are arithmetic rather than anecdote: Anthropic's own transparency reporting shows 11.4 million accounts banned between January and June 2026, against 398,000 appeals filed and 42,000 decisions reversed in the user's favour. Forty-two thousand accounts the vendor agrees it got wrong, in six months, on a process that at least produces a visible ban you can appeal. A silent downgrade produces nothing to appeal against.

Note the mismatch with how new accounts actually ramp. OpenAI's usage tiers graduate an organisation automatically from $5 paid through to Tier 5 at $1,000 paid, where the monthly ceiling climbs from $100 to $200,000. The tier system already throttles a genuinely new account. An enterprise that lands pre-negotiated at high throughput bypasses that gradient — which is the normal shape of a signed enterprise deal, and also indicator number two on the list.

An Eval Canary Is the Only Instrument That Sees It

A canary is a small, fixed set of prompts with known-good answers, run against your production endpoint on a schedule, scored the same way every time, and alerted on when the score moves. It is not a benchmark and it is not a red-team suite. Its only job is to tell you that the thing answering today is not the thing that answered last Tuesday.

It is the only instrument that works here, because every other signal has been engineered away. The invoice shows the tier you bought. The status page shows green, because nothing is broken. Support has nothing to escalate. Cheap, real telemetry does exist — the OpenAI chat completion response object returns a model field described as "the model used for the chat completion", alongside system_fingerprint for the backend configuration and service_tier for the processing type. Log all three on every call and diff them daily; a substitution that changes the reported model is free to detect. But the advisory's variation guidance — same answer, shallower reasoning, different style — is designed to leave the metadata untouched. That is what a scored canary catches and a field diff does not.

We have watched an undetected model swap invalidate an agent evaluation before, when DeepSeek shipped a new post-training pass and nobody's evals noticed. The instrumentation is the same; only the motive is different. If you already run a regression gate on Braintrust, Langfuse or Promptfoo, you have the runner — you need a production-endpoint canary job pointed at the same models your agents actually call, not at a staging key.

Track three things per run and none of them alone: task score against the fixed answers, output token count, and time-to-first-token. A downgrade to a smaller model usually moves at least two. A reasoning-depth reduction moves output tokens and latency before it moves the score.

Four Habits That Make You Look Like a Distiller

Reduce your resemblance to the profile where it is cheap, and do not contort your architecture where it is not. Four things are worth changing.

One shared service-account key across every workload is the expensive one. It produces exactly the "shared accounts from multiple IPs/user agents" pattern, and it means a single high-confidence flag degrades everything at once. Split keys per workload and per environment so that a false positive has a blast radius. This is the same argument that drives agent identity governance: a credential shared by everything is unattributable when something goes wrong.

Ramp a new tenant instead of opening at full throughput. The gradient costs you a week and removes indicator two. If your business case cannot survive a seven-day ramp, note that in the risk register rather than in the traffic.

Do not route production agent traffic through aggregators and proxies you cannot name. The advisory describes a "gray market of API proxies known as 'transfer stations'" used to obscure origin, and cross-provider intelligence sharing is one of its three headline recommendations. Aggregators are legitimate and useful — but if your inference path runs through an intermediary, the provider's view of you is the intermediary's reputation. Buy direct for the workloads you cannot afford to have degraded.

Tell your account team what your traffic looks like, in writing, before it looks anomalous. A named contact who already has your throughput profile, your cache strategy and your region list is the difference between a review and a mitigation. The advisory's own recommendation to providers is stronger identity verification; the enterprise-side counterpart is being verifiable.

Start With the Keys, Then the Canary

This Week:

1. Inventory every API key hitting a frontier provider and map it to one workload and one owner. Any key used by more than one system goes on a split list with a date.
2. Turn on logging of the returned model identifier, system_fingerprint and service_tier (or the vendor equivalent) on every production call. Diff them daily. This is a one-day change and it catches the honest substitutions for free.
3. Send your provider account team a one-page traffic profile: expected tokens per day, hours of operation, region list, cache strategy, number of distinct service accounts. Ask them to file it.

This Month:

1. Stand up a canary of 30 to 50 fixed prompts with graded answers, run hourly against your production endpoint, on the same models your agents call. Alert on score, output-token and latency deviation, not on score alone.
2. Backfill 30 days of baseline before you set thresholds. A canary with no history tells you nothing on the day you need it.
3. Split shared service-account keys per workload, starting with anything touching revenue or customer-facing latency.

Before Renewal:

1. Ask for a model-identity commitment in writing: the model named in the request is the model that serves it, or the customer is notified. Anthropic already committed to visible fallback and per-segment billing in June — ask for that as a contract term, not a blog post.
2. Ask what the provider's abuse-detection appeal path is for an enterprise account, what the SLA on that appeal is, and who at the vendor can escalate outside support.
3. Add a notification trigger for quality or model substitution to your incident-notification clause, alongside the security-incident language you already negotiated. The gap between "misalignment" and "security incident" in vendor notification terms is exactly the crack a quality change falls through.

The Bottom Line

There is a real campaign here, the labs are right to defend against it, and a government advisory naming six firms is a reasonable response to industrial-scale extraction. Nothing in that argument is weak. But the mitigation transfers a cost from the lab to a party that is not in the room. The advisory has no recommendations for buyers, no false-positive analysis, and an explicit instruction not to disclose. Enterprise AI has spent two years building the case that the model layer is a supply chain — with provenance you can read and a vendor you can hold to account. This is the first time a federal document has recommended, in writing, that a supplier make its own substitutions unmeasurable.

You cannot negotiate the advisory. You can log what served your request, run something that fails loudly when the answers change, and stop looking like the thing they are hunting.

Nobody is going to send you a notice. Build the instrument that does.

Continue Reading

• DeepSeek Swapped the Model. Your Eval Didn't Notice.
• OpenAI Called It Misalignment. Your Breach Clause Never Fired.
• Braintrust vs Langfuse vs Promptfoo: Don't Pay for the Gate
• Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs
• CoCounsel's New Model Runs on Qwen. Go Read the Card.
• AI Wrote the S7 Exploit. There Is No CVE to Patch.
• Anthropic Cut Cache Reads 75%. Opus 5 Still Undercuts It.
• Fable 5 Needs Retention On. ZDR Was Never Zero.