Anthropic vs. Alibaba: Inside the Largest Known AI Distillation Attack

A corporate dispute that escalated into a national-security flashpoint.

When two technology companies fall out, the usual venue is a courtroom. Lawyers file briefs, a judge sets a schedule, and the rest of us forget about it until a verdict years later.

What makes the clash between Anthropic and Alibaba so unusual — and so consequential — is that Anthropic didn't go to court at all.

It went to Capitol Hill.

In a letter dated June 10, 2026, addressed to the Senate Banking Committee, the San Francisco AI lab accused operators affiliated with Alibaba and its Qwen AI division of running what it called the largest known "distillation attack" ever carried out against the company.

The operation allegedly generated more than 28.8 million exchanges with Anthropic's Claude models through roughly 25,000 fraudulent accounts, over a six-week window stretching from April 22 to June 5, 2026.

That single accusation has turned a piece of machine-learning jargon most people had never heard of into a matter debated by senators, flagged by the White House, and reflected in Alibaba's stock price.

What started as a technical dispute is now playing out in front of Congress.

What Anthropic Actually Alleges

Let us start with the claims themselves, stripped of spin.

Anthropic says that between late April and early June of 2026, a coordinated campaign created around 25,000 fake Claude accounts and used them to bombard the model with carefully constructed prompts. The goal was not ordinary use. It was extraction — methodically pulling out Claude's most valuable behaviors so they could be reused to train a rival system.

The letter reportedly singles out three capabilities as the prime targets. Agentic reasoning — an AI's ability to plan and carry out multi-step tasks on its own. Software engineering — writing, debugging, and reasoning about code. Long-horizon task completion — staying coherent and useful across lengthy, complex jobs rather than just one-shot answers.

These are not incidental features. They are precisely the abilities that separate a true frontier model from the previous generation of chatbots. They are also the abilities enterprises pay the most for.

To be precise about what is and is not being claimed: Anthropic is not alleging that Alibaba stole Claude's source code, model weights, or training data. Nothing was hacked in the conventional sense. The accounts interacted with Claude the way any paying customer would, through the public interface and API. What allegedly made it an attack was the scale, the coordination, the use of fraudulent identities, and the intent to harvest outputs for training a competitor.

So What Is Distillation, Really?

Here is the twist that makes this story genuinely complicated rather than a simple tale of good guys and bad guys.

Distillation is a completely legitimate, widely used technique. Nearly every major AI developer uses some form of it.

In its ordinary form, a developer takes a large, powerful teacher model and uses its outputs to train a smaller, faster, cheaper student model. The student learns to mimic the teacher's behavior, capturing much of its capability in a more efficient package. Meta has done this with Llama. Google has done it with Gemma. There is nothing controversial about it when you own the teacher.

The phrase Anthropic uses for what it alleges happened here is adversarial distillation. The difference between the legitimate and adversarial versions comes down to two words: ownership and permission. In standard distillation, you distill from a model you built and control. In adversarial distillation, you systematically query someone else's proprietary model without authorization and use its responses to train your own competing system.

Same underlying mechanism. Entirely different ethics and legality.

The line between legitimate AI training and unauthorized extraction often comes down to permission, not technique.

Why This Is So Hard to Defend Against

If you have ever wondered why Anthropic did not simply block the offending accounts and move on, this is the structural heart of the dispute.

A distillation query looks, at the API level, identical to a legitimate one. There is no malicious payload, no exploit, no signature that announces theft. It is just a prompt and a response — the exact product the company sells. When the harmful behavior is indistinguishable from the core business activity, conventional cybersecurity defenses do not have much to grab onto.

According to Anthropic's account, the operation leaned on fraudulent accounts and commercial proxies specifically to circumvent the geographic restrictions Anthropic had put in place to keep certain entities from accessing the model in the first place. The geo-fence existed. It was reportedly routed around.

Analysts have described this as a warning about a brand-new category of supply-chain risk. The enterprise supply chain no longer stops at software, APIs, and cloud regions. It now includes rented intelligence, and rented intelligence can be copied and redeployed far outside the safety controls it was born with.

This Has Happened Before — Just Not at This Scale

The Alibaba accusation did not arrive out of nowhere.

In February 2026, Anthropic disclosed similar campaigns linked to three other firms, collectively involving around 24,000 fraudulent accounts and more than 16 million exchanges with Claude.

Put those numbers next to the new allegation and the escalation is stark. The single Alibaba-linked campaign — roughly 25,000 accounts and 28.8 million exchanges — is alleged to exceed the combined total of all three earlier operations.

There is an escalation in scale here that is hard to ignore.

The latest allegation reportedly dwarfs every previous distillation campaign combined.

Why Anthropic Went to the Senate, Not to Court

This decision tells you how Anthropic wants the world to read this story.

A company that believed it had merely suffered a terms-of-service violation would send a cease-and-desist and ban the accounts. A company that believes it has witnessed the systematic transfer of strategically vital technology behaves differently.

By addressing its evidence to the Senate Banking Committee, Anthropic deliberately reframed the matter. This is not someone broke our rules. This is American AI capability is leaking to a geopolitical rival, and policy needs to respond.

The letter reportedly urged Congress to impose penalties on entities that conduct this kind of extraction, strengthen export controls around AI, and build legal safeguards around model intellectual property.

The Geopolitical Backdrop

The accusation landed in the middle of an already difficult stretch for Alibaba in Washington.

Just two days before Anthropic's letter, the Pentagon added Alibaba to a blacklist of companies it associates with the Chinese military. Alibaba has rejected that label and filed suit seeking removal from the list.

Then the story took a turn that complicates any simple narrative. Two days after Anthropic sent its letter, the U.S. Commerce Department imposed export restrictions on Anthropic's own most advanced models, citing concern that those systems could be deployed by military or intelligence users abroad. Anthropic disabled access to those models globally in response.

The same national-security logic Anthropic invoked to seek protection was, days later, turned toward constraining Anthropic itself.

How Markets and Lawmakers Reacted

Alibaba's shares fell more than four percent in Hong Kong trading following the news, underperforming the broader tech index.

Several analysts characterized the reaction as relatively muted given the severity of the accusation, reasoning that because this is now the fourth lab Anthropic has named, the incremental reputational damage to any single company may be limited.

The legislative reaction may prove more durable than the stock move. Two senators announced plans to introduce an amendment to defense legislation that would sanction entities found improperly accessing U.S. AI systems through campaigns like this one.

Alibaba's Side — and the Reasons for Caution

As of the initial wave of reporting, Alibaba had largely not issued a detailed public rebuttal to the distillation allegation specifically, even while vigorously contesting the separate Pentagon designation in court.

A few important caveats deserve real weight. The allegations remain unverified by any neutral, independent investigation. Anthropic's phrasing — operators affiliated with Alibaba — is a looser standard than proof that Alibaba's leadership directed the campaign. And even if the queries happened exactly as described, there is no public proof that Qwen successfully replicated Claude's advanced capabilities as a result.

This does not mean the accusation is wrong. It means it remains, for now, a serious and detailed accusation rather than a proven fact.

The dispute is a preview of a much larger problem the AI industry has yet to solve.

The Bigger Picture

For most of the history of technology export controls, the things being controlled were physical. Chips. Manufacturing equipment. Hardware you could put on a ship and inspect at a port. You can build a border around an object.

AI capabilities are different. A frontier model's most valuable asset — its learned behavior — can in principle be approximated by anyone who sends it enough well-crafted prompts and captures the answers. There is no shipping container to inspect. The export happens through nothing more tangible than a conversation.

That is the deep challenge this episode exposes. How do you enforce an intellectual property border around something that exists purely as software, that is sold by being made queryable, and that can be copied through ordinary-looking use?

If the proposed legislation gains traction, the consequences could extend well beyond Anthropic and Alibaba. They could begin to define how the entire AI industry protects what it builds — and how seriously the rest of us should be thinking about understanding the tools that are now shaping global competition.

What This Means For You

You do not need to be a senator or a tech CEO to understand why this matters.

This is a window into how seriously AI capability is being treated right now — not as a novelty, but as a strategic asset worth fighting over at the highest levels of government. The tools you are learning to use today are the same category of technology nations are now racing to protect and acquire.

Understanding how these systems actually work, and how to use them well, is not a side skill anymore. It is becoming a core one.

Ambitious Society exists to make AI education accessible to everyone. No jargon. No gatekeeping. Just real skills that translate into real results. Follow us on Threads @ambitious_society_1972.