Anthropic Accuses Alibaba of a 28.8 Million-Exchange Claude Distillation Campaign

The letter says the accounts targeted Claude's agentic reasoning, software engineering and long-horizon task capabilities while violating Anthropic's terms and regional access restrictions. Anthropic describes distillation as training a less capable model on outputs from a stronger one. The method is common in legitimate model development, but Anthropic uses the term "distillation attack" for coordinated extraction that it says bypasses access controls and transfers capabilities to a competitor.

Anthropic compared the Alibaba-linked activity with three campaigns it disclosed in February involving DeepSeek, Moonshot AI and MiniMax. Those earlier campaigns totaled more than 16 million Claude exchanges through about 24,000 accounts. The June letter says the Alibaba-linked campaign alone exceeded that combined exchange volume.

The company asked Congress to improve threat-information sharing among U.S. AI labs, close routes that let Chinese AI companies use advanced U.S. chips, and consider penalties for companies responsible for illicit distillation. Those requests are proposals. The letter does not establish that Congress adopted them, that regulators opened an enforcement case, or that Alibaba trained a named Qwen release on the collected outputs.

Reuters also reported that Alibaba had recently been added to the Pentagon's list of Chinese military companies, a designation the company was challenging. That dispute is separate from Anthropic's model-access allegation.

For AI-platform teams, the incident highlights account verification, proxy detection, coordinated-traffic analysis and capability-focused abuse monitoring as control points around model APIs. It does not show that high query volume alone proves distillation. Reliable attribution requires linked account, infrastructure and behavioral evidence, much of which Anthropic described as confidential rather than publishing in the letter.