Anthropic accuses Alibaba of the 'largest known distillation attack' on Claude — 25,000 fake accounts, 28.8 million exchanges

What’s confirmed

Per CNBC, Bloomberg, TechSpot, TechTimes, and OODAloop:

• Who: Anthropic, in a letter to the US Senate Committee on Banking, Housing, and Urban Affairs, accusing Alibaba and operators affiliated with its Qwen AI lab.
• The allegation: “the largest known distillation attack on Anthropic to date” — an effort to “brazenly” and “illicitly” extract Claude’s capabilities.
• The scale: roughly 25,000 fraudulent accounts generating ~28.8 million exchanges with Claude between April 22 and June 5, 2026.
• The target: Claude’s most valuable capabilities — software engineering and agentic reasoning.
• The pattern: in February 2026, Anthropic named three other “industrial-scale” distillation campaigns — from DeepSeek, Moonshot, and MiniMax — and said they were growing in intensity.
• Alibaba’s response: none public as of disclosure; media requests initially unanswered.
• Not confirmed: independent verification of the figures, Alibaba’s side, or any legal finding. This is Anthropic’s account, presented to lawmakers.

What distillation actually is

Distillation trains a smaller or cheaper model on the outputs of a more capable one — the student learns to imitate the teacher. As a technique it’s legitimate and widespread (labs distill their own big models into faster small ones). What Anthropic alleges is different: mass-querying a competitor’s model, against its terms of service and via fake accounts, to copy the capabilities that competitor spent billions developing. If true, it’s the AI equivalent of reverse-engineering a product by buying 25,000 copies under fake names — except the “product” is the distilled know-how of a frontier model.

That’s why the capability targets matter. Anthropic says the operators went after software engineering and agentic reasoning specifically — not trivia, but the exact frontier strengths that make Claude Code and agentic Claude valuable and expensive to build.

Why this matters

Three reads.

1. It’s a security story that’s also a product story. Most “model security” news is abstract for end users. This isn’t. If frontier US models are being systematically distilled, that’s part of the explanation for why some Chinese open models — DeepSeek, Qwen — deliver so much capability per dollar: a portion of the R&D cost may have been borne by the labs they learned from. For anyone choosing between Claude, GPT, and a cheap open Chinese model, that provenance is legitimate context, even if it doesn’t change raw performance. Our DeepSeek vs Claude Opus comparison covers the capability-and-cost trade-off; this adds the ethics-and-origin dimension.

2. Anthropic is turning a technical problem into a policy weapon — and the venue is the tell. This wasn’t a blog post; it was a letter to a Senate committee. Anthropic is framing distillation as a national-competitiveness issue and lobbying for protection, right as Washington is already restricting frontier-model access (the Fable 5 export-control order, Executive Order 14409). The message to lawmakers: US labs are under sustained extraction pressure from Chinese rivals, so support us. It’s a savvy reframing of a commercial harm as a security one.

3. The irony is impossible to miss — and worth naming honestly. Anthropic is simultaneously (a) the victim of distillation asking the government for protection, and (b) the company fighting a government order that pulled its flagship model offline partly over distillation and cyber-capability risk. Fable 5’s own safety classifiers were built to block distillation attempts; the export-control directive cited extraction concerns. So Anthropic is arguing distillation is a grave threat when it’s the target, while arguing the government overreacted when distillation risk was used to restrict its model. Both positions can be coherent — but the tension is real, and it shapes how cynically or sympathetically Washington reads the Alibaba letter.

What it means for AI-tools buyers

If you use Claude or Claude Code: nothing changes operationally. The accusation is about others copying Claude, not about Claude being compromised. If anything, it underscores that Claude’s agentic and coding strengths are the industry’s benchmark — valuable enough to be worth stealing.

If you use DeepSeek, Qwen, or other Chinese open models: no security action is needed on your end — the issue is alleged training provenance, not user harm. But if terms-of-service ethics, model origin, or data jurisdiction factor into your tool choices (they do for many enterprises), this is a data point. The models still perform; the question is whether their lineage matters to you or your compliance team.

If you’re tracking the geopolitics: this is one more thread in the US-China AI split that increasingly determines which tools are available where. Export controls, the government-equity-stake debate, and now distillation enforcement all point the same direction — frontier AI is being treated as strategic national infrastructure, with access and provenance policed accordingly.

The honest caveats

These are allegations, not findings. Anthropic is a party with commercial and policy interests, presenting its own account to lawmakers. The 28.8M-exchange and 25,000-account figures are Anthropic’s; there’s no independent audit or court finding, and Alibaba hasn’t responded.

Distillation is hard to prove cleanly. Models learn from vast public data, including text generated by other models that’s now all over the internet. Distinguishing deliberate, fraudulent-account distillation from incidental learning is genuinely difficult — which is part of why Anthropic is pushing the issue to policymakers rather than (only) the courts.

“Chinese labs steal, Western labs invent” is too simple. DeepSeek, Qwen, and peers produce real original research and architecture work. Distillation, if it happened, would be one input among many — not the whole story of their capability. Treat the accusation as serious and specific, not as a verdict on an entire ecosystem.

What it changes for Pick Right readers

Your tools work the same today. What changes is context: when you weigh a cheap, capable Chinese open model against Claude or GPT, you now know one more thing about the landscape — frontier US labs allege their capabilities are being systematically extracted, and they’re taking it to Congress. Whether that shifts your choice depends on how much provenance and policy risk matter to your use case.

For the connected threads, see the Claude review, the DeepSeek review, the DeepSeek vs Claude Opus comparison, the Fable 5 export-control shutdown, the Executive Order 14409 explainer, the Claude Code review, and the best AI chatbots guide.

Questions or corrections? Email Pick Right. Want the full list? See all news.