Anthropic Accuses Alibaba of Running 28.8 Million Fraudulent Claude Exchanges in the Largest Known AI Distillation Attack
Anthropic sent a letter to the US Senate Banking Committee on June 10, 2026, accusing Alibaba of conducting the largest known distillation attack on the company's Claude AI models. The letter, obtained by Reuters and CNBC, describes a campaign by operators affiliated with Alibaba and its AI lab Alibaba Qwen that generated 28.8 million exchanges with Claude through approximately 25,000 fraudulent accounts over a 45-day period.
Anthropic accused Alibaba, the Chinese technology and e-commerce giant, of illicitly extracting its Claude AI model capabilities in what it said was the largest known attack of its kind on the company. Anthropic said the campaign was conducted between April 22 and June 5, 2026, and generated more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts. The campaign was conducted by operators affiliated with Alibaba and Alibaba Qwen, Alibaba's AI lab.
What Distillation Actually Means
The term "distillation attack" describes a specific technique for extracting AI capabilities without access to the underlying model weights or training data. Distillation is a way to train a less capable model on the outputs of a stronger one. Anthropic said the campaign was designed to help accelerate China's ability to reach Anthropic's advanced Mythos Preview capabilities.
In practical terms: if you run millions of queries through a powerful AI model and record all the outputs, you can use those input-output pairs as training data for your own model. Done at sufficient scale, this allows a less capable model to learn to approximate the behaviors of the more capable one - without ever having access to the model's internal architecture or weights.
The 28.8 million exchanges over 45 days represents a significant data collection effort. At that scale, the resulting training dataset would cover a wide range of tasks, reasoning patterns, and output styles - potentially giving a model trained on it a meaningful capability boost across multiple domains.
A Pattern of Escalating Attacks
Anthropic said in a February posting that it had identified earlier campaigns by Chinese AI startup DeepSeek - whose low-cost AI model sent shockwaves through the technology world in January 2025 - and two other Chinese AI labs to illicitly extract capabilities from its Claude AI platform. DeepSeek's operation involved over 150,000 exchanges, while Moonshot AI was at a scale of over 3.4 million and MiniMax over 13 million.
The progression from DeepSeek (150,000 exchanges) to MiniMax (13 million) to Alibaba (28.8 million) across a period of roughly 18 months shows a pattern of escalating scale. Each successive campaign is larger and more sophisticated than the previous one.
Anthropic said at the time of the February posting that the campaigns were growing in "intensity and sophistication" and that addressing the threat would require "rapid, coordinated action among industry players, policymakers and the global AI community." An Anthropic spokesperson said: "We believe combating the threat of illicit distillation requires coordinated action between government and industry, and we will continue working with Congress and the Administration to maintain American AI leadership."
The Export Control Connection
On June 12, two days after Anthropic sent the letter accusing Alibaba of the distillation campaign, the Commerce Department imposed controversial restrictions on Anthropic's latest Mythos and Fable AI models because officials feared they could be deployed by military intelligence users in China and other countries of concern. The restrictions resulted in Anthropic disabling access to the models globally.
This timeline clarifies the export control order in ways that were not fully understood at the time of its announcement. The US Commerce Department was aware of the Alibaba distillation letter before imposing restrictions on Anthropic's models. The order was not simply a response to a reported jailbreak - it was also a response to a documented, large-scale Chinese campaign to systematically extract Claude's capabilities.
Alibaba was added to the Pentagon's Chinese military companies list this month, a designation it is challenging. The Commerce Department has held off placing DeepSeek on a trade blacklist, despite it being deemed a national security risk by an interagency governmental committee.
What This Means for Business Leaders
For enterprises using AI for business tools, the Alibaba distillation story has direct operational implications. API usage policies for frontier AI models are tightening in response to exactly these kinds of attacks. Organizations that deploy AI agents at scale or build applications on top of Claude, GPT, or other frontier models should expect more rigorous account verification requirements, usage monitoring, and potentially tighter geographic access restrictions as AI companies respond to systematic extraction attempts.
The broader signal is that AI model capabilities are now geopolitical assets being actively contested. The same models powering productivity gains in Western enterprises are being systematically targeted for extraction by Chinese AI labs. That context will continue to shape export controls, API access policies, and the regulatory environment for AI products.
Cut Through the Noise
What did Anthropic accuse Alibaba of doing?
Anthropic sent a letter to the US Senate Banking Committee on June 10, 2026, accusing operators affiliated with Alibaba and its AI lab Alibaba Qwen of conducting the largest known distillation attack on Anthropic's systems. The campaign ran 28.8 million exchanges with Claude models through approximately 25,000 fraudulent accounts between April 22 and June 5, 2026.
What is an AI distillation attack?
A distillation attack involves training a less capable AI model on the outputs of a more capable one, using the recorded input-output pairs as training data. At sufficient scale, this allows the attacker's model to approximate the behaviors of the target model without access to its internal weights or training data. Anthropic said Alibaba's campaign was designed to help accelerate Chinese AI capabilities toward Anthropic's advanced Mythos Preview level.
How does the Alibaba distillation attack compare to previous incidents?
The Alibaba campaign (28.8 million exchanges) dwarfs previously identified distillation attacks on Anthropic: DeepSeek conducted approximately 150,000 exchanges, Moonshot AI approximately 3.4 million, and MiniMax approximately 13 million. The escalating scale reflects what Anthropic described in February as campaigns "growing in intensity and sophistication."
Is the distillation attack connected to the Anthropic export control order?
Yes. Anthropic sent its letter accusing Alibaba of the distillation campaign on June 10, 2026. The US Commerce Department imposed export controls on Anthropic's Fable 5 and Mythos 5 models on June 12 - two days later. The export control was framed as a response to concerns about Chinese military and intelligence access, and the Alibaba distillation evidence provided documented justification for that concern.
