Alibaba and Qwen Under Suspicion: Anthropic Reveals the Largest Claude Distillation Attack
A large-scale operation to extract knowledge from the Claude model was organized by operators linked to China's Alibaba and its AI lab, Qwen. In a letter addressed to the Chairman and the senior Democrat of the U.S. Senate Banking Committee, developer Anthropic revealed details of this attack, calling it the largest known of its kind.
From April 22 to June 5, over 28.8 million interactions with Claude were generated through nearly 25,000 fake accounts. The company emphasizes that the campaign was notable not only for its scale but also for its audacity: "Alibaba is listed on the New York Stock Exchange, maintains business operations in the U.S., and is accountable to American investors and regulators."
What is distillation and why is it a problem?
Distillation is a method where a less powerful model is trained on the responses of a stronger one. Legitimately, it is used to create cheaper or more compact versions. However, the problem arises when competitors gain access to a cutting-edge tool through dummy accounts, bypass service restrictions, and use the responses to train their own systems. In this case, the attack targeted Claude's capabilities in agentic tasks, software development, and long-term planning.
Anthropic claims that such actions allow replicating the behavior of a frontier model without the cost of training it. "When PRC labs distill these capabilities from American models, they reap the benefits of American investments without bearing the costs and risks. This upends the economic logic underpinning U.S. leadership in AI," the company emphasized.
What is Anthropic asking from Congress?
The company urged lawmakers to expand the sharing of technical indicators and intelligence between AI developers and the U.S. government. It also proposed clarifying antitrust rules so that firms can share information about attacks without risking violations of competition law. Another set of proposals concerns export controls: tightening restrictions on advanced AI chips and computing resources, and closing loopholes for Chinese organizations to access foreign data centers. The company also suggested imposing sanctions on those responsible for large-scale extraction of model capabilities.
Other cases and context
Earlier in February, Anthropic accused DeepSeek, Moonshot AI, and MiniMax of generating over 16 million interactions with Claude through approximately 24,000 fake accounts. At the time, developers claimed they linked the campaigns to specific labs via IP addresses, request metadata, and infrastructure indicators. For example, DeepSeek generated over 150,000 interactions, Moonshot AI over 3.4 million, and MiniMax about 13 million.
These accusations sparked debate, as distillation itself remains a common industry practice. In April, Elon Musk testified in federal court that xAI "partially" used OpenAI's models when training Grok. Notably, in December 2025, Nvidia reported developing technology to verify the location of its processors amid information about the smuggling of accelerators into China.
My analysis: This incident is a stark signal that the AI race is entering a phase of intense competitive intelligence. Distillation, while legal within certain bounds, is becoming a tool to bypass billion-dollar investments in development. If the U.S. does not tighten controls, we will see not just a technological but also an economic redistribution of power in the AI market.