US Agencies Warn of State-Linked Harvesting of AI Reasoning Outputs via API Abuse

The NSA, CISA, and FBI have warned that chain-of-thought outputs from major AI models — including Claude, GPT, Gemini, and Grok — are being harvested at scale through bulk API subscription abuse to train competing models. The technique relies on distributed infrastructure, obfuscated accounts, and automated failover, methods long familiar to security teams from ticketing and ad-network scraping. Analysts note that while the target is novel — a model's reasoning process representing significant R&D investment — the underlying attack mechanics are not new and have known, if imperfect, mitigations. Stopping a well-resourced adversary running thousands of accounts is structurally difficult, since the same API access patterns used by legitimate developers can be exploited for large-scale data exfiltration. Developers building on these APIs should expect increased friction in the near term, including tighter rate limits, stricter identity checks on high-volume accounts, and a higher risk of legitimate users being caught in anti-abuse enforcement actions.