Anthropic accuses Alibaba of using 25,000 fake accounts to distil Claude AI capabilities in largest known attack

What happened

Anthropic has accused Chinese technology giant Alibaba of orchestrating the largest known distillation attack on its systems to date. In a letter dated 10 June 2026 and sent to U.S. senators and White House officials, the American AI firm said operators affiliated with Alibaba's Qwen AI laboratory used almost 25,000 fraudulent accounts to generate 28.8 million exchanges with its Claude model between 22 April and 5 June 2026.

“These distillation attacks are carried out illicitly, systematically and on an industrial scale to exploit American AI capabilities.”

The company stated that the campaign was designed to extract Claude's software engineering, automated reasoning and long-horizon task abilities, which are among the most valuable for enterprise AI sales. By feeding Claude's responses into their own models, Alibaba could replicate advanced capabilities while avoiding the heavy research and development costs incurred by U.S. labs.

How distillation works

AI distillation is a legitimate technique when a smaller model learns from a larger one under agreed rules. In an adversarial context, however, it becomes a way to copy behaviour at marginal cost. Attackers bombard a teacher model with queries via APIs using fake accounts and then train a student model on the outputs, sidestepping both licensing restrictions and the expense of original training.

“It is a way for competitors to harvest American AI, and help China reach its most advanced model’s capabilities sooner.”

The scale of the reported operation dwarfed a campaign Anthropic flagged in February 2026, when it accused DeepSeek, Moonshot and MiniMax of conducting a similar effort involving roughly 16 million exchanges across some 24,000 fake accounts.

Political and market reaction

Anthropic addressed its letter to Senators Tim Scott and Elizabeth Warren, the chair and ranking member of the Senate Banking Committee, ahead of a scheduled hearing on AI. It urged a coordinated response from the Trump administration and the private sector, arguing that ignoring such attacks could allow China to erode America's lead in artificial intelligence and pose a national security risk. Alibaba was added to a Pentagon blacklist of companies cooperating with the Chinese military only weeks earlier.

“Leaving the attacks unanswered could mean China gains ground on the U.S. in the artificial intelligence race, which represents a threat to national security.”

Alibaba did not respond to requests for comment. Its Hong Kong-listed shares fell almost 5 percent after the news broke.

A wider pattern

The accusation moves the AI rivalry between Washington and Beijing into new territory. Previous disputes focused on chip export controls and cloud restrictions. This case concerns the outputs of operational models. For China's labs, distilling from U.S. systems offers a shortcut around hardware and data bottlenecks. For American companies, it raises fresh questions about how to protect commercially sensitive model behaviour when publicly accessible interfaces are the main delivery channel.

Feb 2026 (DeepSeek, Moonshot, MiniMax)16

Apr–Jun 2026 (Alibaba Qwen)28.8

Feb 2026 (DeepSeek, Moonshot, MiniMax)

16 million exchanges

Apr–Jun 2026 (Alibaba Qwen)

28.8 million exchanges

Data from the article text