Anthropic Accuses Alibaba of Stealing 29 Million Claude Conversations in Largest Known AI Distillation Attack
By Mark Smith
Follow us on X @realnewshubs and subscribe for push notifications
In a development that spotlights the high-stakes competition in artificial intelligence, Anthropic has accused Alibaba of orchestrating the largest known campaign to illicitly extract capabilities from its Claude AI model. The U.S. company detailed in a letter to senators how operators linked to Alibaba’s Qwen lab allegedly used nearly 25,000 fake accounts to pull more than 28.8 million conversations from Claude over a six-week period this spring. This incident has raised fresh concerns about intellectual property protection in the rapidly evolving AI sector and the broader implications for American technological leadership amid intensifying rivalry with China.
The letter, dated June 10, 2026, and addressed to Senate Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren, describes what Anthropic calls “the largest known distillation attack on Anthropic to date.” According to the company, the operation ran from April 22 to June 5 and systematically targeted Claude’s strongest capabilities in agentic reasoning, software engineering, and long-horizon task handling.
The Scale of the Alleged Operation
Anthropic claims operators affiliated with Alibaba and its Qwen AI laboratory created roughly 25,000 fraudulent accounts that generated more than 28.8 million exchanges with Claude. The campaign relied on proxy networks and obfuscation techniques to bypass geo-restrictions and terms-of-service rules. Claude has faced access limitations in certain regions, including China, making the use of fake accounts a deliberate workaround.
This effort dwarfs earlier incidents Anthropic previously reported. In February 2026, the company flagged combined distillation activity from Chinese labs DeepSeek, Moonshot AI, and MiniMax that totaled over 16 million exchanges. The Alibaba-linked campaign nearly doubled that volume in a shorter timeframe and focused more precisely on commercially valuable skills.
What Distillation Means in Practice
Distillation involves querying a powerful frontier model like Claude repeatedly and feeding its high-quality outputs into training or fine-tuning a smaller model. The goal is to replicate advanced performance without the massive compute and data costs of building a model from scratch. Anthropic says the stolen conversations were used to boost Alibaba’s own models, effectively converting U.S. research and development investment into a subsidy for competitors.
In the letter, Anthropic’s head of policy Sarah Heck wrote that these attacks are “carried out illicitly, systematically, and at industrial scale to harvest U.S. AI capabilities across frontier labs and repackage them as their own without incurring the training and R&D costs required to train U.S. frontier models.” She added that distillation attacks “turn hundreds of billions of dollars in American investment and research and development into a massive subsidy for our geopolitical competitors.”
Why This Matters to American Readers
The accusation lands at a sensitive moment for U.S. technology leadership. American companies and developers widely use Claude through platforms like Amazon Bedrock for coding assistance, enterprise automation, research, and building AI agents. If foreign competitors rapidly close the capability gap through large-scale extraction, it could erode the competitive edge U.S. firms have spent years and billions of dollars building.
National security analysts view advanced AI as a strategic technology. Faster Chinese progress in agentic systems and software engineering could affect everything from defense applications to commercial software markets. The letter was sent ahead of a Senate hearing on AI and the American Dream, signaling that policymakers see these incidents as part of a larger pattern of industrial-scale IP challenges in the AI domain.
Recent U.S. government actions underscore the tension. Alibaba was added to the Pentagon’s list of Chinese military companies earlier this year, a designation the company is contesting. At the same time, the Commerce Department imposed restrictions on Anthropic’s newest models, prompting the company to disable global access to certain versions out of concern they could be misused by military or intelligence entities.
Growing Calls for Stronger Defenses
Anthropic is urging Congress to enact penalties for companies engaged in large-scale distillation and to strengthen measures that prevent unauthorized extraction of frontier model capabilities. The company has expressed support for expanded threat-intelligence sharing between government and industry to detect and disrupt future campaigns.
The revelation has sparked discussion across tech circles and online platforms about the practical challenges of protecting AI models. Observers note the rise of what Anthropic described as a “growing circumvention economy” that supplies proxy networks and fake-account infrastructure to evade detection. Many in the U.S. AI community argue that stronger technical safeguards, clearer legal frameworks around model outputs, and coordinated international standards will be necessary as competition intensifies.
Alibaba has not yet issued a public response to the specific allegations in the letter. The company has previously denied ties to the Chinese military in other contexts.
The episode illustrates how the global AI race is shifting from pure model development to a contest over data access, security, and the ability to protect proprietary capabilities. For American businesses and policymakers, it reinforces the stakes involved in maintaining leadership in frontier AI while managing the risks of rapid capability transfer to competitors.
