Can You Defend This Access Decision?
In September, NSA, CISA and the FBI alleged restricted-capability extraction by China-based AI companies through APIs, clouds, aggregators, account pools and proxies since late 2024.
China rejected the allegations as groundless and called for cooperation. On 9 September, AP reported no immediate comment from the companies it contacted.
That leaves attribution contested. BlackTree’s operational analysis does not depend on resolving it.
Distillation is not inherently malicious. Authorised access and evidence of coordination are separate questions.
Related reading: BlackTree’s model-lineage analysis.
Update, 12 October 2026: Anthropic reports 90 to 99 per cent less harvested data and 10 to 100+ times fewer reasoning tokens. Model-specific controls prevent prior-context edits by API accounts created on or after 31 August, and restrict reasoning from crossing organisations or entering earlier weaker models. Two-stage classifiers, limits and bans curb repeated attempts. The vendor reports below 0.1 per cent false positives on the generally available models covered. Pre-response blocks meeting that threshold have been charged since 24 September. The findings lack independent validation; highly sophisticated persistent evasion remains untested. Legitimate integrations needed updates, and benign requests can still be blocked and charged.
Before merging two cases
Compare identity, payment, timing and usage before joining cases.
Correlation still needs limits. Record why two events belong in one case, minimise unrelated customer content and restrict who can join evidence across products or partners. A review should be able to reconstruct both the link and the decision that followed it.
Make every response reviewable
Detection confidence and response severity are separate decisions. Observation, a temporary limit, identity review, suspension and removal should have named thresholds, owners and expiry conditions. Commercial pressure should not decide which step follows a weak signal.
- Assign an owner before a decision needs escalation.
- Preserve the evidence sequence that supports a case.
- Keep unrelated customer content outside the review record.
- Require a second reviewer for consequential or persistent action.
- Provide a documented channel for affected users to request review.
- Measure reversals, delays and operational harm alongside successful interventions.
Sources
- CISA joint advisory AA26-251A, 8 September 2026.
- Associated Press, 9 September 2026.
- Anthropic distillation defences, 12 October 2026; revised 13 October.
