Anthropic Accuses Alibaba of Largest-Ever Claude Distillation Attack

Anthropic has publicly accused Alibaba of orchestrating the largest known model distillation attack against any US AI lab, sending a letter to Senate Banking Committee members and White House officials that details an industrial-scale operation targeting Claude's software engineering and agentic reasoning capabilities.

The letter, dated June 10 and addressed to Committee Chair Sen. Tim Scott and Ranking Member Sen. Elizabeth Warren, was first reported by Bloomberg on June 24. It describes a coordinated campaign in which operators linked to Alibaba's Qwen AI lab used approximately 25,000 fraudulent accounts to conduct 28.8 million exchanges with Claude between April 22 and June 5, 2026. Alibaba's American depositary receipts fell more than 3% on news of the accusations.

"These distillation attacks are carried out illicitly, systematically, and at industrial scale to harvest US AI capabilities across frontier labs and repackage them as their own without incurring the training and R&D costs required to train US frontier models," Anthropic wrote.

What Distillation Actually Means for Developers

Adversarial distillation is not conventional hacking. Attackers do not need access to source code or model weights. Instead, they systematically prompt a frontier model at scale, collect its responses, and use those outputs to train a competing model that approximates the original's capabilities at a fraction of the development cost.

The Alibaba campaign specifically targeted Claude's most commercially valuable capabilities: software engineering — the same domain where Claude Code has achieved industry-leading SWE-Bench scores — and agentic reasoning, which underpins Claude's ability to handle multi-step tasks autonomously. Those are the exact capabilities developers pay for, and they represent the core of Claude Code's $2.5 billion run-rate revenue.

For developers building on Claude's API, the threat is less about immediate service disruption and more about longer-term implications. If frontier model capabilities can be systematically harvested and reproduced in rival models that lack safety guardrails, it pressures how Anthropic prices access, what rate limits it imposes, and how it monitors API usage patterns going forward.

The Scale Sets a New Benchmark

The Alibaba campaign dwarfs every prior distillation attack Anthropic has disclosed. In February 2026, the company revealed three campaigns by Chinese AI labs: DeepSeek generated more than 150,000 exchanges, Moonshot AI more than 3.4 million, and MiniMax more than 13 million. The Alibaba operation generated 28.8 million exchanges — nearly 75% more than all three prior campaigns combined.

Anthropic characterized the effort as "the largest known distillation attack on Anthropic to date" and the largest attempt by any Chinese company to extract capabilities from a top US lab. Alibaba has not commented on the allegations. The company is simultaneously contesting its placement on the Pentagon's list of Chinese military companies, which was added on June 8.

The disclosure came ahead of a scheduled Senate Banking Committee hearing on AI, giving it deliberate policy timing. The letter noted the campaign took place after a White House OSTP memo in April 2026 that flagged adversarial distillation as a national security concern and committed the government to sharing threat intelligence with US AI labs — yet Alibaba allegedly pressed on regardless.

Legislative Response Is Moving Fast

Lawmakers are responding quickly. Senators Bill Hagerty and Andy Kim plan to introduce an amendment to must-pass defense legislation that would blacklist or sanction any Chinese firm found to be improperly accessing US AI model output to train competing models. A bipartisan House bill covering the same ground is also under consideration.

Anthropic used the letter to urge three specific actions: clarify antitrust guidelines so US labs can freely share intelligence about distillation campaigns with each other; strengthen export controls on advanced AI chips; and impose penalties on firms that employ the technique. Anthropic, OpenAI, and Google have already begun coordinating to share information about distillation attempts that violate their terms of service.

What's Unconfirmed

Anthropic's letter names "operators affiliated with Alibaba and Alibaba Qwen" — not Alibaba itself directly. That framing stops short of asserting that Alibaba centrally directed the campaign. Whether the fraudulent accounts successfully replicated Claude's advanced capabilities in a functional rival model has not been confirmed. Alibaba has not responded to the allegations as of publication. Neither the White House nor the Commerce Department has publicly announced any response to Anthropic's specific requests.