Theft

I hunted out the source of fire, and stole it.

— Prometheus

Why build it, when you can steal it? GPT-6 Astra is only a few terabytes. Anthropic’s Mythos is roughly the same. We’re spending trillions on compute, electricity, and data to produce a simple set of files: the model weights. But these files can be stolen, and for the world’s most sophisticated intelligence services, stealing them offers a shortcut to superintelligence.

What could someone do with a stolen frontier model?

With sufficient compute, whoever controls a frontier model could use it to accelerate scientific discovery, solve mathematical problems that have remained open for decades, and automate software development at enormous scale. Such a model could dramatically increase the controlling nation’s productivity, GDP, and economic advantage. The most consequential use, however, may be accelerating AI research itself. Whoever controls a stolen model capable of recursive self-improvement (RSI) could use it to automate AI research and engineering, accelerate their own AI program, and develop more capable successor models.

The same model could also have its guardrails removed and subsequently provide recipes for developing chemical, biological, radiological, nuclear, and explosive (CBRNE) weapons, power massive cyberswarms, and give intelligence agencies an unprecedented strategic advantage. Major threat actors may not have the compute to train a frontier AI model, but they certainly have the compute to run a stolen one.

However, frontier AI labs are not the only targets for model theft. For thousands of other companies and model developers, their model is their product and their competitive advantage. Even a non-frontier model can be valuable for what it knows. Models can memorize and reveal training data: researchers used Meta’s Llama 3.1 70B to reconstruct the first Harry Potter book almost verbatim. Now consider a private model fine-tuned on classified intelligence, patient records, or corporate secrets. Stealing its weights could expose some of that information, turning an ordinary model into a high-value intelligence target.

How to Steal a Model #

For obvious reasons, we will not provide a blueprint for stealing an AI model. But many of the broad attack paths are already public. A threat actor can steal a model using two main approaches: (1) by directly exfiltrating its weights, giving it maximum flexibility to remove guardrails and run the model on its own infrastructure, or (2) by copying the model’s capabilities into its own model through distillation.

Weight Exfiltration

Once an attacker has stolen the model weights, they can freely finetune the model, create new versions for offensive use, and distribute unlimited copies. Preventing weight theft is therefore essential, but securing the weights is an immense technical challenge: there are thousands of copies of the model running across thousands of compute nodes, and if just one node is compromised, the model may be stolen.

You may be thinking: aren’t data centers secure? Haven’t they existed for decades? Yes, but the AI infrastructure boom is new. The race to bring massive GPU clusters online has put enormous pressure on providers to prioritize speed before the security discipline needed to resist sophisticated attackers. Recent security evaluations by SemiAnalysis and Cisco suggest that large parts of the AI neocloud market lack basic attestations and foundational security controls. Even if a lab or other model developer secures its own network, it can still lose its model through the weakest cloud provider in its stack.

Conceptually, the simplest path to stealing model weights is through a human insider. This could be an employee, contractor, or data-center operator who uses legitimate access to copy the weights or create a path for someone else to do so. For example, an engineer with access to a model repository could copy a checkpoint to an unauthorized, external server. Or similarly, a data center employee at a neocloud which is hosting a customer’s model could bypass network monitoring entirely by copying the weights onto physical storage and carrying them out. These basic attacks are well understood, and the more secure frontier AI labs have hardened their systems against such standard methods; but at some AI companies, individual engineers or data center operators can still access and move complete model files as part of their ordinary work.

The second path to stealing model weights is cyber intrusion. An outside attacker could compromise an employee account, cloud control plane, or software dependency, then move laterally through the network until it reaches a system that stores or loads the weights. From there, the attacker would need to transfer the files outside the company without detection. This would be difficult in a frontier AI lab, but it is exactly the kind of patient, multi-stage operation that sophisticated intelligence services are built to conduct.

When Anthropic released Claude Opus 4, it introduced bandwidth limits on data leaving its data centers in order to detect and block the large transfers required to quickly move a multi-terabyte model. Yet, a sophisticated attacker could try to evade such egress controls by “slow-dripping” the weights over days or weeks; by breaking them into small fragments and hiding those fragments inside routine outbound traffic such as API calls or telemetry data. These split data transfers could also be routed to many destination servers (making each individual transfer less suspicious).

There are also more advanced covert methods. One that has been discussed publicly is steganography: manipulating the way tokens are sampled from a model so that hidden information is encoded inside of outputs that appear completely normal. These outputs could be used to leak information, including portions of the model’s weights, without triggering alerts for a large file transfer. There are other, even more advanced techniques that we will not discuss here.

The scariest part of weight theft is that it may leave no obvious trace. Copying a model does not remove or damage the original, disrupt service, or alter its behavior. The lab or cloud can continue operating normally while an attacker walks away with an exact copy. Models may already have been stolen, and we may be unaware.

Distillation

Most people have now heard of distillation by now. The process is simple:

1. A developer sends millions of prompts to a powerful AI model, saves its responses, and uses them as training data for another model.
2. The new model learns to copy some of the stronger model’s reasoning, coding, and other capabilities without its developer having to build those capabilities from scratch.

Distillation is a normal and useful technique when done with permission. It becomes theft when a competitor collects those outputs at scale without authorization.

In February 2026, Anthropic reported that DeepSeek, Moonshot AI, and MiniMax had generated more than 16 million exchanges through approximately 24,000 fraudulent accounts. OpenAI separately reported activity linked to DeepSeek employees, including efforts to conceal their identities and automate the collection of model outputs. In September 2026, the NSA, CISA, and FBI issued a joint advisory stating that six Chinese AI companies had used millions of requests to extract billions of tokens from American frontier models. The agencies called for stronger detection and intelligence sharing across providers.

The incentive to distill is simple. At a fraction of the time and cost, you can acquire AI capabilities that another company developed through hundreds of billions of dollars of investment. Chinese AI labs are already highly capable even without distillation, but distillation allows them to acquire additional capabilities and move even faster.

There is currently no way to prevent all unauthorized distillation while keeping frontier models completely available. Distillation is difficult to stop because attackers use the same systems as legitimate customers. Providers can detect suspicious activity, block accounts, and disrupt known campaigns, but eliminating distillation entirely also requires restricting legitimate access to frontier models.

Safety guardrails have become a common defense because they can limit access to sensitive cyber and biological capabilities. For example, if Anthropic or OpenAI detect that a prompt requests assistance with a cyberattack or the development of a chemical weapon, the model will refuse to respond. But the problem is that these guardrails can also block legitimate defenders and researchers from doing their work. As AI-powered attacks increase, defenders will need access to advanced models to find and patch vulnerabilities. Programs like OpenAI’s Trusted Access for Cyber and Anthropic’s Cyber Verification Program are excellent steps toward verifying legitimate users and granting them greater access to sensitive capabilities, but they still create a substantial barrier to entry.

We need ways to preserve legitimate access while stopping large-scale extraction of American AI capabilities.

The Worst-Case Theft: Recursive Self-Improvement (RSI) #

We cannot allow an adversary to steal the weights of a model that can self-improve. With sufficient compute, a single theft could trigger an intelligence explosion and rapidly lead to superintelligence. An adversary that could not build such a model itself could steal from the US and use it to reach superintelligence.

Recursive self-improvement (RSI) is the most significant milestone in a nation’s AI program. It is the point at which a model can automate AI research and improve its own capabilities. RSI is an AI model that self-improves. By producing a more capable successor, which can then produce an even more capable successor, RSI could trigger an intelligence explosion directly to ASI: years of AI progress compressed into months, weeks, or even days. That makes an RSI-capable model the most valuable set of weights in the world, only surpassed in value by the weights of ASI. If an adversary steals those weights, what could they do? If they have sufficient compute, they could let RSI run in their own datacenters and quickly achieve ASI. A nation that was months or years behind the US could leapfrog to the frontier if they steal RSI.

Consider the Chinese AI labs. Today, they trail the U.S. frontier largely because they must spend months reproducing breakthroughs made by the American labs and because export controls constrain their access to advanced compute. Stolen RSI-capable weights would compress that time-delay. If an insider or cyber intrusion transferred such a model to a Chinese lab, they would instantly possess a digital copy of the world’s most capable AI researcher. The bottleneck would shift almost entirely to how much compute could be placed behind the stolen model, allowing it to rapidly close the gap, leapfrog the American labs in capability, and potentially pull ahead.

The United States could build the model that triggers the intelligence explosion, only for China to steal it and reach superintelligence first. Preventing that theft may be the most important national security mission of the AI age.

Call to action

We must protect frontier model weights and RSI as strategic national assets

Apply nation-state-grade security to frontier model weights, training clusters, and RSI systems. Labs and compute operators must assume that the world’s most sophisticated intelligence services will target these systems. These protections must protect weights across every environment in which they are stored.

Preventing the theft of cyber-capable models and RSI must become a national security priority. National security agencies should support frontier labs and compute operators in identifying nation-state threats and coordinate the response to suspected theft.

We must build real-time monitoring to detect and disrupt weight-exfiltration attempts. Security systems must be able to detect a theft as it happens and stop the weights before they leave the data center.

Counterintelligence protections must extend across frontier labs, data centers, and critical suppliers. Labs must strengthen personnel vetting and insider threat programs to detect foreign intelligence services attempting to recruit or coerce employees, contractors, data-center operators, and suppliers.