Anthropic Accuses Alibaba of the Largest Claude Distillation Attack in History, 28.8 Million Fraudulent Exchanges
Anthropic accused Alibaba's Qwen AI lab of orchestrating 28.8 million exchanges with Claude through nearly 25,000 fraudulent accounts between April 22 and June 5, in what Anthropic calls the largest known distillation attack in its history.
In a letter to US senators and White House officials, Anthropic accused Alibaba of orchestrating an industrial-scale operation to siphon proprietary knowledge from its Claude models, describing it as a coordinated extraction campaign rather than casual probing.
Anthropic said the effort involved distillation, training a weaker model on the outputs of a stronger one. to accelerate China’s ability to reach Anthropic’s advanced Mythos Preview capabilities. The development lends new weight to the US State Department’s warning that Chinese IP theft and IP distillation may represent a broader national security threat, offering the clearest evidence yet of the concerns officials have raised.
What “Adversarial Distillation” Actually Involves
According to Bloomberg, Anthropic claimed Alibaba used a technique known as adversarial distillation, in which outside entities repeatedly prompt an advanced model to extract its reasoning patterns and data structures.
Those outputs can then be used to train competing AI systems, avoiding millions of dollars in research and development costs.
Anthropic argued that frontier AI capabilities are being harvested ‘illicitly’, systematically, and at an industrial scale, allowing competitors to replicate advanced systems without bearing the huge research, development, and training costs required to build them.
While distillation itself is a common machine learning technique for compressing large models into smaller, faster ones, Anthropic argued the issue was the method of access.
The company said roughly 25,000 fraudulent accounts generated 28.8 million Claude interactions, targeting two of its most commercially sensitive capabilities.
Anthropic also warned that AI systems developed through adversarial distillation may lack critical safety guardrails, creating safety and security risks beyond intellectual property theft.
Scale, Precedent, and Alibaba’s Silence
The reported scale exceeded all previous distillation campaigns combined.
In February, Anthropic accused DeepSeek, MiniMax, and Moonshot AI of generating more than 16 million exchanges through roughly 24,000 fake accounts; the Alibaba-linked operation reportedly surpassed all three combined.
The development also extends a broader wave of US concerns. In February 2026, Anthropic, OpenAI, and Alphabet’s Google disclosed industrial-scale efforts to extract capabilities from their models and agreed to share information on terms-of-service violations.
The timing is notable. Alibaba was added to the Pentagon’s list of alleged Chinese military-linked firms on June 8, a designation cited in Anthropic’s letter, and sued the Pentagon this week to be removed, denying any military affiliation.
However, Alibaba had no immediate comment.
For Anthropic, the dispute adds to an already complex position: opposing the Trump administration’s shutdown of Fable 5 and Mythos 5 while seeking stronger enforcement against foreign distillation campaigns.
What Anthropic Is Asking the Government to Do
Anthropic said combating illicit distillation requires closer coordination between government and industry and pledged continued engagement with Congress and the Administration to preserve American AI leadership.
Policy groups, including the International Institute for Strategic Studies and Just Security, have argued that China’s distillation campaigns warrant stronger US responses, treating frontier model outputs as a national security asset.
Critics remain divided. Elon Musk accused Anthropic of acquiring training data at a massive scale, while ethics consultant Lia Raquel Neves argued the core issue is fraudulent access, not distillation itself, which remains a common machine learning practice, as Musk notes.
That distinction, between a legitimate technique and an illegitimate access method, is the legal line Anthropic wants Congress to define more clearly.
Coming a day after the Anthropic Mythos classified-system vulnerability disclosure, the debate capped a particularly eventful week for the company.
Source: Anthropic Accuses Alibaba of ‘Illicitly’ Accessing AI Models
