Anthropic Alleges Alibaba-Affiliated Operators Conducted Major AI Distillation Attack

Anthropic is calling on Congress to strengthen protections against AI model distillation after claiming that Alibaba-affiliated operators carried out the largest known effort to extract capabilities from its Claude chatbot.

In a June 10 letter to Senate Banking, Housing, and Urban Affairs Committee Chairman Tim Scott and Ranking Member Elizabeth Warren, Anthropic alleged that operators affiliated with Alibaba and its Qwen AI lab generated more than 28.8 million exchanges with Claude between April 22 and June 5 using nearly 25,000 “fraudulent accounts,” or those not representing real, organic users.

Known as a distillation attack, Anthropic said the operations targeted Claude's agentic reasoning, software engineering, and long-horizon planning capabilities, allowing competitors to reproduce advanced model behavior without the cost of training a frontier AI system.

“Beyond its scale, this campaign was striking for its brazen nature,” Anthropic wrote. “Alibaba is listed on the New York Stock Exchange, maintains business operations in the United States, and is accountable to U.S. investors and regulators.”

Anthropic said the campaign went beyond intellectual property concerns, framing large-scale model distillation as a national security issue that could accelerate China's military and cyber AI capabilities while narrowing the United States' technological lead.

The letter comes as Washington intensifies efforts to protect U.S. AI leadership. Earlier this month, President Donald Trump signed an executive order expanding AI-powered cybersecurity initiatives after delaying the measure over concerns it could weaken America's competitive position against China.

“When PRC labs distill these capabilities from U.S. models, they capture the returns on American investments without bearing the costs or risks associated with training frontier AI models,” Anthropic wrote. “This inverts the economic logic that underwrites American AI leadership, turning billions of dollars’ worth of research and development, compute, and other U.S. investments into a subsidy for our competitors.”

Anthropic urged lawmakers to expand intelligence sharing between frontier AI developers and the U.S. government, clarify antitrust rules to allow AI companies to share information about distillation attacks, strengthen export controls on advanced AI chips and compute, close loopholes that allow Chinese firms to access overseas data centers, and impose penalties on companies responsible for large-scale model extraction.

A spokesperson for Anthropic declined to comment specifically on the letter, but told Decrypt, "We believe combating the threat of illicit distillation requires coordinated action between government and industry, and we will continue working with Congress and the administration to maintain American AI leadership."

The letter also builds on Anthropic's claims in February that Chinese AI developers DeepSeek, Moonshot AI, and MiniMax generated more than 16 million Claude exchanges using roughly 24,000 fraudulent accounts.

Those allegations drew criticism from observers who argued that AI companies rely on similar techniques when training their own systems. Anthropic has countered that conventional distillation is a legitimate method for producing smaller, cheaper models, while unauthorized extraction of frontier model capabilities through fraudulent access violates its terms of service.