The allegation
In a formal letter dated June 10, 2026, Anthropic told Senate Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren that operators affiliated with Alibaba's AI research division — known as Qwen — had systematically extracted its Claude model's capabilities using nearly 25,000 fraudulent accounts, generating more than 28.8 million exchanges between April 22 and June 5, 2026. The company described the operation as "the largest known distillation attack on Anthropic to date," according to CNBC and Cybersecurity News.
Anthropic alleged the campaign specifically targeted Claude's most commercially valuable features — software engineering and agentic reasoning — the capabilities that underpin its most advanced model offerings. Because Anthropic does not offer commercial access to Claude in China, the company said every account involved was created in violation of its terms of service from the outset.
This is not a lawsuit. Anthropic's disclosures went to lawmakers and White House officials rather than a court, placing the dispute in a national security and trade-policy frame rather than a civil litigation one.
Alibaba did not respond to requests for comment from multiple news organizations, including CNBC and The Next Web.
What distillation means
Model distillation, in plain terms, is a process by which a less capable AI system learns by studying a more capable one. In the scenario Anthropic describes — sometimes called "black-box distillation" — an attacker does not need access to the target model's internal architecture or weights. Instead, the attacker sends carefully structured prompts to the model through its public interface, collects the responses at scale, and uses those input-output pairs as training data for a separate model. The result is a competing model that has absorbed the capabilities of the original without the years of research and the compute cost that built them.
The practice is not inherently illegal — distillation is a legitimate research technique used openly in academia. What makes it contentious here, Anthropic argues, is that the accounts used were fraudulent, the scale was industrial, Claude's terms of service explicitly bar using its outputs to train competing models, and Anthropic does not operate in China at all, meaning every account in the campaign violated those terms from day one.
Scale and context
AI Weekly reported that the Alibaba-linked campaign, at roughly 29 million exchanges, exceeded the combined volume of three prior distillation incidents Anthropic disclosed in February 2026 — those involving DeepSeek, Moonshot AI, and MiniMax, which together generated more than 16 million exchanges through about 24,000 fake accounts. Anthropic has since banned all accounts connected to the alleged operation.
Prior disputes and the broader pattern
The Alibaba allegation fits a pattern that has widened over the past year. In early 2026, OpenAI publicly accused DeepSeek of distilling its models, stating that "DeepSeek's next model should be understood in the context of its ongoing efforts to free-ride on the capabilities developed by OpenAI and other US frontier labs," according to Rest of World. OpenAI said it had observed accounts associated with DeepSeek employees developing code to access its models programmatically and extract outputs for training.
The White House flagged distillation as a national security concern in April 2026, a designation that gives these disputes a dimension beyond standard intellectual-property disputes.
Policy and market fallout
Alibaba's American depositary receipts fell more than 3 percent in the session following the disclosure, according to AI Weekly, which also reported that some U.S. lawmakers signaled they would pursue legislation to sanction or blacklist foreign firms found to have improperly harvested American AI model outputs.
The allegations also land at a complicated moment for Alibaba. The Pentagon added the company to its Chinese military companies blacklist on June 8, 2026 — two days before Anthropic's letter was dated. Alibaba filed suit against the Defense Department this week seeking removal from that list, calling the designation baseless and arguing the company has no military affiliation.
What's at stake commercially
For Anthropic, which is privately held and backed by Google and Amazon, the alleged campaign goes to the heart of its commercial model. Its frontier Claude models are its primary revenue source; if a competitor can replicate those capabilities cheaply by harvesting outputs at scale, the competitive moat Anthropic spent billions building narrows quickly. For Alibaba's Qwen lab, which competes directly in the global open-weights AI market, the allegations — if substantiated — could draw regulatory restrictions on its access to U.S. AI infrastructure.
Anthropic attributed the conduct to operators "affiliated" with Alibaba and Qwen rather than asserting the company itself directed the campaign. That distinction, standard in such allegations, still leaves the underlying question — what Alibaba knew, authorized, or benefited from — unanswered and, so far, uncontested by the company.
