Anthropic Accuses Alibaba of Largest AI Distillation Attack on Claude: 28.8M Exchanges, Senate Sanctions Incoming
TL;DR
Anthropic told the US Senate that Alibaba ran the largest known distillation attack on Claude: 28.8 million exchanges across 25,000 fake accounts over six weeks, targeting Claude's most commercially valuable capabilities. The cost may have been under $90K. The competitive value extracted was orders of magnitude higher.
If you’ve run identical coding prompts through both Claude and Qwen recently, try comparing the stylistic patterns in the responses side by side. Not the answers themselves, but the structure: how errors are explained, how edge cases are flagged, how code comments are written. If you spot systematic similarities that look like more than coincidence, I’d genuinely like to hear about it. That kind of empirical observation is exactly what the legal debate currently lacks.
What Happened Over Six Weeks
Between April 22 and June 5, 2026, Anthropic’s systems flagged a sustained pattern of anomalous API activity. Thousands of accounts, routed through commercial proxy services to bypass Claude’s China access restrictions, were sending carefully structured prompts at scale, collecting responses, and repeating the cycle.
The final count: roughly 25,000 accounts conducting 28.8 million exchanges with Claude over six weeks. That total exceeds the combined volume of the three previous Chinese AI labs Anthropic had accused of similar behavior back in February 2026.
Anthropic sent a letter to the US Senate Banking Committee on June 10, with copies to White House officials, identifying the operators as affiliated with Alibaba’s Qwen AI research division. CNBC first reported the letter’s contents on June 24.
Alibaba did not respond to requests for comment.
Senators Bill Hagerty and Andy Kim announced plans to introduce an amendment to must-pass defense legislation that would blacklist or sanction any Chinese firm found to be improperly accessing US AI model output. Senators Ted Cruz and Maria Cantwell issued a joint statement calling for immediate action. Draft language circulating on Capitol Hill would treat frontier AI model outputs as controlled technology exports, subject to licensing requirements similar to those applied to advanced semiconductor shipments.
The capabilities targeted were not generic: software engineering proficiency and agentic reasoning, the two areas where Anthropic has made the most aggressive commercial inroads against competitors.
The Numbers Behind the Claims
Start with a rough cost calculation.
Claude’s API pricing in early 2026 runs approximately $0.002 to $0.004 per exchange when accounting for average input and output token lengths. At 28.8 million exchanges, the maximum cost of the entire operation was somewhere between $57,600 and $115,200. Alibaba’s annual AI research budget for Qwen-related work is estimated by analysts at over one billion dollars. The cost of this attack is comparable to catering for a large engineering team dinner.
Flip to the other side. If Qwen’s next major release shows disproportionate benchmark improvements in code generation and agentic task completion relative to improvements in areas that weren’t specifically targeted, like general reasoning or factual recall, that asymmetry would be circumstantial but directionally meaningful. No independent party can currently verify how much distillation improved any specific capability.
The attribution question deserves more scrutiny than it’s getting. Commercial proxy services are used by millions of legitimate international users. Account registration patterns that look systematic could be Alibaba-linked operators or a well-funded third-party reseller. Anthropic’s letter uses the phrase “operators affiliated with Alibaba,” which is precise in implication but leaves significant legal ambiguity about the direct chain of control.
The legal framework for this kind of activity simply doesn’t exist. The Next Web noted that no court has tested whether harvesting API outputs constitutes intellectual property theft. The 2021 Supreme Court ruling in Oracle v. Google addressed API interface copyright, not API response content. Anthropic’s request for new legislation is itself an admission that current law doesn’t cover this scenario.
On the technical defense side: output watermarking has been an active research area for years, with patents held by multiple AI security groups. If watermarks embedded in Claude’s outputs could be detected in Qwen’s training data or model outputs, the attribution problem becomes tractable. That capability doesn’t appear to be mature enough yet to serve as courtroom evidence.
What to Watch For Next
The first concrete signal to track is Qwen’s next major release, expected in Q3 2026. Look specifically at whether software engineering and agentic reasoning benchmark scores improve disproportionately compared to areas that weren’t targeted in Anthropic’s complaint. A 20-30% jump in coding benchmarks alongside flat or modest improvements in math reasoning or factual knowledge would be consistent with targeted distillation. It wouldn’t prove causation, but it would narrow the question.
The second indicator is how far the proposed legislation actually travels. Treating API outputs as controlled technology exports faces a technical enforcement problem that may prove harder to solve than the political one. An API gateway cannot determine in real time whether a requester is a Chinese entity; geographic blocking gets bypassed by proxy services, as this case demonstrates. If the amendment language in the final National Defense Authorization Act is directional rather than enforceable, that gap will be meaningful.
The third signal is whether OpenAI and Google file similar complaints with Congress within the next 90 days. Anthropic’s Senate letter is now a template that demonstrably generates legislative attention. If other major US AI labs follow, the framing shifts from a single company’s grievance to a systemic pattern, which changes both the legislative urgency and the diplomatic context of US-China AI negotiations.
If this was useful, subscribe to the newsletter for weekly AI PM insights and GenAI case studies.
Further reading:
Related Articles
Anthropic Calls for a Global AI Pause: Recursive Self-Improvement Is Closer Than You Think
Claude's task horizon doubles every four months. Anthropic engineers ship 8x more code than five years ago. The company racing toward a near-trillion dollar IPO is now calling for a global pause mechanism before things get out of hand.
Project Fetch Phase 2: Claude Opus 4.7 Wrote Robodog Code 37x Faster. The Ball Stayed on the Floor.
Anthropic Project Fetch Phase 2 shows Claude Opus 4.7 autonomously wrote robodog control code 37x faster than the best unaided human team, with one-tenth the lines of code. The robodog still did not fetch the ball. The result is both a milestone and an honest map of where the limits are.