Anthropic Accuses Alibaba of Industrial-Scale Distillation Campaign to Extract Claude's Capabilities

Anthropic has accused Chinese technology firm Alibaba of using nearly 25,000 fraudulent accounts to execute more than 28.8 million exchanges with its Claude artificial intelligence model. According to a June 10, 2026, letter sent to U.S. lawmakers, operators affiliated with Alibaba’s Qwen lab systematically targeted Claude’s coding and complex reasoning capabilities. The campaign represents the largest known model distillation attack ever reported by Anthropic.

The Mechanics of the Alleged Extraction Campaign

According to the letter, the operation ran from April 22 to June 5, 2026, generating more than 28.8 million exchanges. To slip past standard rate limits and automated detection, the operators distributed these requests across nearly 25,000 accounts.

Rather than submitting basic, single-turn prompts, these accounts systematically targeted Claude’s advanced capabilities, including:

• Agentic Reasoning: The capability to plan, make decisions, and execute multi-step workflows.
• Software Engineering: Writing, debugging, and explaining complex computer code.
• Long-Horizon Tasks: Managing sustained, multi-turn interactions that require the model to maintain context over long sequences.

The letter was sent to U.S. Senators Tim Scott and Elizabeth Warren on June 10. They serve as the leadership of the Senate Banking Committee. The details of the document became public on June 24.

How Adversarial Distillation Replicates AI Behaviors

The technique central to the accusation is known as model distillation, or adversarial distillation. In a distillation campaign, an operator uses a larger, highly capable model to train a smaller, less advanced system.

The process does not require hacking into a target company’s network or stealing its proprietary model weights. Instead, the attacker mimics the target model’s behavior through a structured extraction workflow:

1. Account Deployment: The operator establishes a massive network of coordinated, fraudulent accounts to bypass API rate limits and avoid triggering automated anti-scraping blocks.
2. Targeted Prompting: The automated accounts issue millions of highly specific, complex prompts designed to probe the frontier model’s advanced reasoning and coding logic.
3. Output Harvesting: The system records the target model’s detailed step-by-step responses, logic chains, and generated code.
4. Model Fine-Tuning: The resulting dataset of prompt-and-response pairs is used to train a smaller, cheaper competitor model.

This workflow allows a rival firm to replicate the behaviors and performance benchmarks of a leading AI model without paying the massive research, development, and computational costs required to build a frontier system from scratch.

Comparing the Alibaba Campaign to Past Incidents

Anthropic’s Head of Policy, Sarah Heck, described the Alibaba operation as the largest distillation campaign the company has ever detected. The volume of exchanges in this single campaign is nearly double the size of previous coordinated security incidents.

The scale of recent distillation campaigns shows a clear upward trend:

• The Alibaba Qwen Lab Campaign (April–June 2026): Generated over 28.8 million exchanges using nearly 25,000 fraudulent accounts in a six-week period.
• The Combined February 2026 Campaigns: Generated over 16 million exchanges across approximately 24,000 fraudulent accounts. This group of attacks was linked to three Chinese AI developers: DeepSeek, Moonshot AI, and MiniMax.

Distillation campaigns are difficult to block because individual exchanges look identical to normal user traffic. A developer asking for help debugging software looks the same to a server as an automated script harvesting data. Anthropic’s security team identifies these attacks by tracking coordinated patterns, such as thousands of sequential accounts targeting the same complex reasoning features.

Policy Proposals Sent to Congress and Regulatory Backlash

In its letter, Anthropic urged U.S. lawmakers to implement stronger legislative and regulatory protections to counter model theft. Rather than calling for new export control measures, the company reiterated its existing support for export controls on advanced AI chips and suggested several specific policy adjustments:

• Antitrust Clarification: Clarifying federal antitrust guidelines to explicitly allow U.S. artificial intelligence companies to share threat-intelligence data and coordinate defenses against distillation attacks.
• Federal Penalties: Imposing direct federal penalties, such as sanctions or blacklisting, on foreign firms and research labs that conduct systematic distillation attacks against domestic AI firms.
• Infrastructure Restraints: Tightening restrictions to block foreign entities from using proxy networks to access overseas U.S.-supported data centers.
• Information Sharing: Expanding intelligence sharing regarding model-extraction threats between frontier AI developers and the federal government.

The dispute occurs amid heightened security scrutiny over AI intellectual property and foreign access to advanced models. Congress is already considering legislative remedies, with Senators Bill Hagerty and Andy Kim reportedly drafting an amendment to defense legislation to blacklist or sanction foreign firms found to be improperly exploiting the outputs of U.S. AI models.

Alibaba has not responded publicly to requests for comment regarding the allegations.