Anthropic accused Chinese tech giant Alibaba of orchestrating the largest distillation attack known to date, using tens of thousands of fraudulent accounts to systematically extract features from its AI model, Claude. These accusations were reportedly made directly to U.S. lawmakers and signal a significant increase in tensions over AI intellectual property between U.S. and Chinese tech companies.
The alleged operation involved approximately 25,000 fake accounts and reportedly resulted in approximately 29 million exchanges with Claude over just six weeks. This amount shows just how industrialized these types of AI extraction activities are becoming.
The claim adds Alibaba to the growing list of Chinese AI developers that Anthropic says are targeting its models. We have also reached a point where the global race for AI supremacy is intensifying at a pace that is reshaping both corporate strategy and geopolitics.
Inside the Suspected Campaign
According to Anthropic’s explanation to U.S. lawmakers, operators linked to Alibaba and the company’s Qwen AI team generated 28.8 million exchanges with Claude over a period of roughly six weeks, from April 22 to June 5, 2026. The alleged campaign did not target Claude’s source code, model weights, or original training data. Instead, Anthropic claims the fraudulent account repeatedly posed carefully designed questions to Claude and collected responses at scale.
This process is known as distillation, a technique in which companies use the output of larger, more capable AI models to train smaller, cheaper AI models. Smaller models learn to replicate the useful behavior of more powerful systems without requiring the same computing resources.
The targeted area was particularly specific. The alleged campaign focused on software development, multi-step inference, and agent tasks, features that allow AI models to plan and execute complex multi-step tasks rather than simply responding to individual prompts. Anthropic told lawmakers that the campaign could help Chinese AI developers access the capabilities of the Mythos Preview model, which focuses on advanced cybersecurity tasks, including identifying and exploiting complex software vulnerabilities.
Industry under pressure
Francesco Pili, Attorney at Hogan LovellsBlaming, he said, is part of a pattern that extends far beyond humanity.
“This is part of a broader trend of regulatory disputes over whether and under what conditions AI systems can access third-party platforms, services or data,” he said.
“These cases are blurring the lines between traditional platforms and agent AI services. They are also testing the limits of what targeted platforms can legally do in response, including whether and how they can limit access.”
Pili pointed to the dispute between Perplexity and Amazon as another example. He said this raises questions about whether agent AI systems can be held liable for accessing third-party platforms through user accounts without permission.
While distillation is not inherently illegal or unethical, Anthropic argues that collecting another company’s model output on an industrial scale without permission clearly crosses a line. The company has called on U.S. lawmakers to punish companies that engage in such practices.
Anthropic argues that if left unchecked, this practice serves as a “heavy subsidy to geopolitical competitors.” The United States and China are accelerating the race to become the world’s AI superpower. China’s DeepSeek shocked Western observers by performing similarly to leading American models at a fraction of the training cost. Several major U.S. AI companies have since warned against domestic regulation, saying it would give China a strategic advantage.
Anthropic has made similar accusations against Chinese companies before. Earlier this year, the company claimed that DeepSeek, Moonshot AI, and MiniMax collectively generated more than 16 million Claude exchanges across approximately 24,000 accounts. The Alibaba campaign resulted in almost twice as many exchanges over a similar period of time.
What’s next
Anthropic’s decision to bring these accusations directly to U.S. lawmakers rather than take immediate legal action suggests that the company is seeking a policy response as much as a legal one. The scale of the alleged operation makes it difficult to dismiss it as opportunistic or haphazard.
As the legal and regulatory frameworks governing AI access, data use, and model training continue to take shape, cases like these will help define where the boundaries are drawn. For now, Anthropic’s message is clear: Extracting AI capabilities without consent is not a gray area, and the company plans to demonstrate this at the highest levels of government.