US AI providers may mistake normal agent traffic for model theft
A federal advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI in an alleged campaign that extracted billions of tokens from Claude, GPT, Gemini, and Grok since late 2024, putting model providers on notice to police customers more aggressively. The listed signals are ordinary enterprise patterns: 24/7 agents, instant full-volume subscriptions, shared keys across regions, and cache-optimised requests. Providers may respond by weakening suspected accounts without telling them, creating a false-positive risk for legitimate teams.