Three US agencies say distillation is not a shortcut, it is the whole strategy

😁 Hello, super humans! Three US agencies just published an advisory that reads less like a threat bulletin and more like a business-model teardown. The claim is not that someone stole a model file; it is that buying answers from your competitor’s API, in bulk, is the core of a rival industry’s R&D. And the recommended defense is the part nobody is talking about, because it asks model providers to do something they have spent years promising they would never do.

📰 Quick Signals

• 🧠 AI: DeepSeek says V4.1 Flash officially ships around today, Beijing time, after running a public test endpoint literally named deepseek-v4.1-flash-expires-on-0910, and claims it beats V4 Pro on performance, cost and speed at Flash pricing.
• 🤖 Robotics: Unitree’s shares are down 53 percent from their debut on the Shanghai Stock Exchange last month, pulling the market’s verdict on humanoids well back from the $66 billion valuation it opened at.
• 💻 Programming: A flaw in the DeepSeek Harness let attacker-supplied text talk an agent into switching its own session to danger-full-access, disabling the file sandbox and approval prompts; VulnCheck rated CVE-2026-82533 at 9.4 and fixed npm releases start at 0.1.2-alpha.2.
• ⚡ Electronics: DDR5 is now around $400 for a 32GB kit, up roughly 485 percent year over year, with consumer DRAM contract prices climbing as much as 89 percent in a single quarter.
• 📡 Telecom: Airties launched Aura, an agentic engine that diagnoses and fixes home and small-business broadband faults on its own across fiber, cable, DSL and fixed wireless, trained on telemetry from more than 50 million connected homes.

🔍 The Big Story: The US just told AI vendors to lie to their customers, politely

If you run an API that returns model outputs, this advisory is about you, whatever your threat model used to be. It reframes ordinary paid usage as the extraction vector, and the mitigation it recommends is one your abuse team has probably argued about and rejected.

What happened: On 8 September the NSA, CISA and FBI published joint advisory AA26-251A, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI and alleging they have run “aggressive, malicious, and targeted” distillation campaigns against US frontier models since at least late 2024. The agencies say the six pulled billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok, likely with the Chinese government’s awareness. The tradecraft described is unglamorous: fraudulent accounts, bulk premium subscriptions, and proxy routing services sometimes called transfer stations, used to dodge regional restrictions and per-account limits. The advisory’s sharpest line is about economics: it argues DeepSeek’s widely quoted $5.6 million training cost is misleading precisely because it excludes the data acquired this way.

The details: Distillation itself is textbook machine learning. You query a strong teacher model, keep the outputs, and fine-tune a smaller student on them; the student inherits behavior it was never big enough to learn from raw text. It is cheap because the expensive part, the teacher’s original training run, was paid for by someone else. That is also why it is hard to police. There is no exfiltrated weight file to find, no breach to disclose. Every individual request looks legitimate, because it is legitimate: someone paid for it. The signal only exists in aggregate, in the shape of an account’s traffic over time. So the advisory asks providers to build detection for anomalous prompts, accounts and networks, to share intelligence across model providers, cloud platforms and API aggregators, and then it asks for something else entirely: deploy “targeted response changes” that subtly alter the answers served to suspected accounts, rather than blocking them outright. Read that again. The recommendation is to keep taking a suspected customer’s money while quietly poisoning the product they receive, on the theory that a blocked account tells the operator to rotate proxies within the hour, while a silently degraded one keeps feeding corrupted training data into a rival’s pipeline for months.

flowchart TD
    A["Buyer account<br/>(bulk subs, proxies,<br/>fraudulent identities)"] --> B["Frontier API<br/>every request is paid<br/>and individually legitimate"]
    B --> C["Harvested outputs<br/>billions of tokens"]
    C --> D["Student model<br/>fine-tuned on the<br/>teacher's answers"]
    B --> E{"Aggregate traffic<br/>looks like harvesting?"}
    E -->|"Block"| F["Operator rotates proxies<br/>within the hour"]
    E -->|"Advisory's pick:<br/>degrade quietly"| G["Corrupted data flows<br/>into the student for months"]
    style A fill:#1FB6F5,stroke:#0B1117,color:#0B1117
    style E fill:#1FB6F5,stroke:#0B1117,color:#0B1117
    style F fill:#FF4D4F,stroke:#0B1117,color:#0B1117
    style G fill:#22C55E,stroke:#0B1117,color:#0B1117

🗞️ More News

🧠 AI

• Mistral raised €3 billion in a Samsung-led Series D at more than €21 billion post money, the largest equity round a European technology company has ever closed, roughly doubling its Series C valuation from a year ago.
• The European AI Office and 24 national market surveillance authorities begin their first scheduled wave of compliance inspections this month, with providers of general-purpose models trained above 10^25 FLOPs due to file their first systemic-risk evaluations by 15 September.
• Sony Music Publishing and Warner Chappell sued Anthropic over training on tens of thousands of compositions, naming Dario Amodei and Benjamin Mann personally and seeking up to $150,000 per infringed work.
• Model fatigue is now a named problem: Meta, Google, OpenAI and Anthropic all shipped new versions inside the same week, and buyers are starting to say the release cadence outruns their ability to evaluate anything.
• Worth holding next to the advisory: the current open-weight leaderboard is led almost entirely by the same labs it names, with Qwen3.8 Max on top ahead of GLM-5.3 and GLM-5.2, and Meta and Mistral further down.
• Following up on last week’s acquisition news, Nvidia is framing the Hugging Face deal as a commitment to keep the development platform open, which is the specific promise the competition critics want in writing.

🤖 Robotics

• Agility Robotics’ S-4 filing ahead of its humanoid SPAC shows $1.8 million in 2025 revenue against a $140 million operating loss, a useful reality check on how early the commercial humanoid market still is.
• Vention opened a Physical AI Lab in Montreal aimed squarely at moving robotic manipulation from research demos to production lines.
• A Boston Dynamics veteran launched Dynamic Creatures, a studio building character robots both as its own line and as commissioned re-creations for brands and venues.
• The ARM Institute received $90 million for ten projects to modernize military manufacturing, with fifteen member organizations expected to deliver working solutions inside two years.
• MassRobotics surveyed its members on the FCC ban on new foreign-produced mobile robots and found the industry genuinely split, which is a more interesting result than either side’s press release.

💻 Programming

• September’s CVE of the month is CVE-2026-58138, a 9.8 in a dependency that most of the teams running it do not know they are running, which is the entire transitive-dependency problem in one number.
• Microsoft starts bouncing mail from outdated on-premises Exchange servers, so unpatched Exchange Server 2016 and 2019 machines will simply stop being able to send to Exchange Online.
• Prompt injection now sits at the top of the OWASP list for LLM applications, and the failure mode is structural: once a model is wired to executable tools, it still cannot tell a trusted instruction from untrusted data it was asked to read.
• Red Hat published a practical walkthrough of layered defenses against prompt injection and unsafe agent actions, which is the closest thing to a checklist anyone has written for this.

⚡ Electronics

• The YuzukiNeko is a Linux-capable Allwinner F101 64-bit RISC-V SBC in a Raspberry Pi Pico footprint, running mainline Linux 7.2 and also supporting Zephyr, which is an unusual amount of computer for that outline.
• The supply side of that DDR5 price: Samsung, SK hynix and Micron together hold more than 95 percent of DRAM output and keep moving wafers to high-bandwidth memory, with Silicon Motion and Intel both pointing at 2028 before conditions normalize.
• The HomeMaster MiniPLC packages an ESP32 into a DIN-rail industrial controller for Home Assistant, which is a neat answer to everyone who wanted a hobby MCU but a real enclosure and real terminal blocks.
• The Comu is a $6 CH32V203 RISC-V development board small enough to disappear inside a USB port, which makes it an almost disposable way to add a microcontroller to something.

📡 Telecom

• Theta Telecoms was appointed network operator and strategic partner for Prasarana’s common telecom infrastructure along Malaysia’s Shah Alam Line, on an initial five-year contract that started on 1 September.
• Brunei’s Unified National Networks signed cooperation and commercial agreements with Vobile to build AI infrastructure at its Tungku submarine cable landing station, putting the compute where the fibre already comes ashore.
• AST SpaceMobile has FCC temporary authority to test direct-to-device service in the 800 MHz band and is still targeting a beta launch this year, keeping the D2D race a three-way fight rather than a Starlink walkover.
• Vodafone handed its 26 GHz millimetre-wave holdings back to the Spanish state, saying it could not find a viable use for the band, which is a blunt data point for anyone still modelling mmWave revenue.

👨‍💻 Code Corner

The advisory asks providers to spot harvesting in aggregate traffic rather than in any single request. Here is the crudest version of that idea, and it is instructive precisely because it is crude: distillation traffic almost never reuses a prompt, almost always wants long completions, and almost never has a second turn.

# harvest_score.py: a first-pass signal for bulk output harvesting on an LLM API.
from collections import Counter

def harvest_score(requests):
    """requests: list of (prompt, completion_tokens, turns_in_session)."""
    n = len(requests)
    uniqueness = len(Counter(p for p, _, _ in requests)) / n   # 1.0 = never repeats
    avg_out = sum(c for _, c, _ in requests) / n
    single_turn = sum(1 for _, _, t in requests if t == 1) / n
    return round(uniqueness * single_turn * min(avg_out / 512, 1.0), 3)

human = [("what is a mosfet", 90, 3), ("what is a mosfet", 80, 3), ("explain again", 120, 1)]
bot = [(f"topic {i}", 1800, 1) for i in range(3)]

print("human:", harvest_score(human))   # human: 0.042
print("bot:  ", harvest_score(bot))     # bot:   1.0

🧰 Toolbox

• CISA AA26-251A: the advisory itself, worth reading in full if you operate an API, because the detection guidance is more concrete than the coverage suggests.
• Open Source Patch Tracker: a running September list of exploited CVEs with their fixed versions, which is the format you actually want when triaging a dependency bump.
• Open-Source LLM Leaderboard: 103 open-weight models ranked in one table, handy when you need a defensible starting shortlist rather than a vibe.
• EU AI Act implementation timeline: which obligation lands on which date, including the pushed-back high-risk deadlines, in a form you can hand to a non-lawyer.
• YuzukiNeko: a Pico-shaped RISC-V board that boots mainline Linux, which makes it a cheap way to get a real kernel into a project that only had room for a microcontroller.

🎬 Demo Watch (rotating)

Monumental’s Pisa robot lays bricks and mortar on live construction sites, and the company’s account of what it has learned is more useful than the footage. The hard part is not the arm; it is that a building site is a moving, unlevel, weather-exposed workspace with no fixed reference frame, so the robot has to localize against a structure it is itself changing, course by course. That is the same closed loop as any pick-and-place cell, except the fixture is the thing you are building. What is real: bricklaying is genuinely repetitive, genuinely hard to staff, and genuinely bounded, which makes it one of the few construction tasks where a robot has a defensible case. What is still hype: nobody has broken construction robotics in at scale yet, and Monumental is refreshingly direct about that. Read the full piece.

📚 From the Blog

• Turning Pixels Into Something the AI Can Eat: the decode, resize and normalize stage between a camera and a model, and a good reminder that what you feed a model determines what it learns, which is exactly the lever distillation pulls.
• Building Your First Neuron From Scratch: weights, bias, activation and one gradient step by hand, the cleanest way to see why training on another model’s answers works at all.
• The Network Behind the Cameras: the unglamorous plumbing of moving data without saturating the link, and a nice companion to today’s telecom items about putting compute where the fibre lands.

😀 The Bot Says…

A model whose test endpoint was named deepseek-v4.1-flash-expires-on-0910 shipped on the tenth, exactly as the filename promised, in the same week three US agencies named its maker in a federal advisory. Say what you like about the strategy; the release engineering is immaculate.

---

That’s all for today! Reply and tell us: if a provider quietly degraded your API responses, how long would it take you to notice?