Anthropic Accuses Alibaba of Claude Distillation Using 25,000 Fake Accounts

The Story

Anthropic has accused Chinese technology company Alibaba of carrying out what it described as the largest known distillation attack against Claude, its family of AI models.

The accusation was made in a June 10 letter sent to U.S. Senators Tim Scott and Elizabeth Warren, the chair and ranking member of the Senate Committee on Banking, Housing, and Urban Affairs.

Distillation is an AI training method in which a smaller or less capable model is trained on the outputs of a stronger model. It is widely used inside AI companies to create cheaper, faster, or more specialized versions of their own systems. However, Anthropic argues that the same method becomes an illicit extraction campaign when outside operators use fake accounts, access workarounds, or automated traffic to copy the behavior of a protected model.

In this case, Anthropic alleged that operators affiliated with Alibaba and its Qwen AI lab used approximately 25,000 fraudulent accounts to conduct more than 28.8 million exchanges with Claude between April 22 and June 5, 2026. Claude is not available to entities in China.

Alibaba has not publicly responded to the allegation.

The Facts

• Company making the accusation: Anthropic.
• Company accused: Alibaba, including operators allegedly affiliated with Alibaba Qwen.
• Model involved: Claude.
• Method alleged: Distillation.
• Scale alleged: More than 28.8 million Claude exchanges.
• Accounts involved: Nearly 25,000 fraudulent accounts.
• Time period: April 22 to June 5, 2026.
• Market reaction: Alibaba shares fell 4.4% after the report.
• Alibaba response: No public response reported at the time of publication.

What Claude Distillation Means

Model distillation is not automatically improper. AI labs often use it to compress large models into smaller models that are cheaper to run, easier to deploy, or better suited to a specific product.

Claude Distillation becomes controversial when a company allegedly trains its own model on Claude outputs without permission. In practical terms, the stronger model becomes a paid or hidden training source for a competing system.

Anthropic argued that this kind of extraction can reduce the time and cost needed to replicate advanced capabilities. In an April memo, the White House Office of Science and Technology Policy warned that distilled models may not fully replicate the original system, but can still perform comparably on some benchmarks at a fraction of the cost.

What Capabilities Were Allegedly Targeted

Anthropic said the alleged campaign sought to harvest some of Claude’s most valuable capabilities, including:

• agentic reasoning
• software engineering ability
• long-horizon task completion
• advanced coding support
• complex multi-step problem solving

These capabilities support AI agents, developer tools, workplace automation, enterprise assistants, and cybersecurity workflows.

Previous Distillation Warnings

This is not Anthropic’s first public warning about model distillation.

In February 2026, Anthropic said it had identified industrial-scale campaigns by DeepSeek, Moonshot, and MiniMax. Those campaigns generated more than 16 million Claude exchanges through about 24,000 fraudulent accounts, according to Anthropic.

The same month, OpenAI accused DeepSeek employees of bypassing ChatGPT access restrictions and obtaining responses for distillation. Google also warned of Chinese-linked distillation activity, although it did not name specific companies.

Anthropic said the earlier campaigns targeted Claude’s agentic reasoning, tool use, and coding capabilities.

The Alibaba allegation is larger by reported exchange count and account count. It also follows the White House’s April warning that foreign entities, principally based in China, were allegedly conducting industrial-scale campaigns to distill U.S. frontier AI systems.

The Policy Pressure

Anthropic used the letter to push for a stronger government response.

The company urged Washington to consider stricter export restrictions on semiconductors and legal penalties for AI developers caught running illicit distillation campaigns.

That policy request matters because Claude Distillation sits between several unresolved areas of AI law and regulation:

• intellectual property protection
• terms-of-service enforcement
• export controls
• cloud access rules
• national security policy
• cross-border AI competition
• model safeguards and misuse prevention

The case also raises a practical enforcement problem. A frontier model may be blocked in a country or restricted for some entities, but millions of requests can still be routed through fraudulent accounts, proxies, resellers, or intermediaries.

The China AI Competition Context

The distillation dispute reflects a wider shift in the U.S.-China AI race.

U.S. AI companies still lead many global performance rankings, but Chinese labs have narrowed the gap. As of March 2026, top U.S. models led comparable Chinese models by only 2.7% in performance, according to Stanford University’s Human-Centered Artificial Intelligence research lab.

Chinese models also often compete on lower usage costs. That makes Claude Distillation especially sensitive for U.S. labs, because a rival system may not need to fully match a frontier model to become commercially attractive.

The Alibaba Context

The allegation comes as Alibaba is already in conflict with the U.S. government.

In June 2026, Alibaba sued the U.S. Department of Defense after being placed on a list of companies the Pentagon says are linked to China’s military. Alibaba called the designation unsupported and sought removal from the list.

The Pentagon designation does not impose full sanctions by itself. However, it affects U.S. defense contracting and can damage business relationships with American companies.

The distillation allegation adds another layer to that dispute. It places Alibaba in the center of a broader U.S. concern that Chinese technology companies may be accelerating their AI capabilities by extracting value from American frontier models.

The Anthropic Context

Anthropic is also facing its own U.S. government pressure.

On June 12, 2026, the U.S. government ordered Anthropic to restrict access to its most advanced models, Fable 5 and Mythos 5, citing national security concerns. Anthropic disabled access to the models globally to comply.

The government later allowed limited access to Mythos 5 for selected trusted U.S. organizations, while discussions continued over restoring broader access to Fable 5.

That puts Anthropic in a complicated position. The company is asking the U.S. government for stronger protection against foreign model extraction while also negotiating with the same government over restrictions on its own frontier AI releases.

What to Watch Next

The next major question is whether Alibaba responds publicly or contests Anthropic’s technical attribution.

Why This Matters

The case shows that frontier AI competition is no longer only about chips, model training, or product launches. Access to model outputs has become a strategic asset, and companies may face stricter verification, legal, and regulatory controls as governments try to protect advanced AI capabilities.

This article was drafted with the assistance of generative AI. All facts and details were reviewed and confirmed by an editor prior to publication.