Anthropic has accused operators affiliated with Alibaba and its Qwen AI lab of running what it calls the largest known distillation attack against Claude to date — an alleged effort to "illicitly" copy Claude's capabilities at industrial scale. In a letter dated June 10, 2026 and made public on June 24, Anthropic says these operators used roughly 25,000 fraudulent accounts to conduct more than 28.8 million exchanges with its models between April 22 and June 5, 2026. Critically, this is an accusation in a letter to U.S. lawmakers, not a lawsuit, an indictment, or a court finding. Alibaba had not issued an official response as of June 25, and one Chinese expert quoted by state media dismissed the claim as "tech-hegemony anxiety." Model distillation is a training technique where a weaker model learns by imitating a stronger model's outputs.
What the letter actually says
On June 24, 2026, multiple outlets reported on a letter Anthropic had sent to Washington. CNBC, which broke the story, framed the company's language bluntly: Anthropic accuses Alibaba of moving to "brazenly" and "illicitly" extract its AI capabilities. The letter is dated June 10, 2026, and according to reporting reviewed by Reuters, it went to Senate Banking Committee Chair Tim Scott and ranking member Elizabeth Warren, with copies described as reaching White House officials.
The central allegation is specific. Anthropic claims that operators it links to Alibaba and its Qwen research unit ran a coordinated "distillation" campaign aimed at Claude's most commercially valuable abilities — software engineering and agentic reasoning, the same strengths that anchor Anthropic's advanced Mythos Preview models. In the company's own framing, reported by cybersecurity press, "these distillation attacks are carried out illicitly, systematically, and at an industrial scale."
We want to be precise about the words here, because they carry weight. Anthropic uses "accuses," "alleges," and "claims." We are doing the same. As of this writing, no court has ruled on any of this, no regulator has opened a public proceeding tied to the letter, and Alibaba has not been charged with anything. What exists is a detailed accusation, made by one of Claude's owners, addressed to people with the power to write AI policy.
What is model distillation, in plain terms
Distillation is a standard machine-learning technique. A large, expensive "teacher" model produces outputs — answers, code, chains of reasoning — and a smaller "student" model is trained to imitate those outputs. Done with a teacher you own or license, it is how labs compress frontier behavior into cheaper, faster models. It is everywhere in the industry, and that ubiquity is exactly why this dispute is contested rather than clear-cut.
The accusation is not that distillation happened. It is how Anthropic says it happened: against a competitor's commercial model, through accounts Anthropic describes as fraudulent, at a volume the company says was engineered to harvest capability rather than to use the product. That is the line Anthropic is drawing — between distillation as legitimate engineering and distillation as, in its words, illicit extraction. Whether a given pattern of API usage crosses that line is precisely the kind of question that courts, not press releases, ultimately settle.
If you have followed our coverage, this framing will sound familiar. Anthropic has spent the past year publicly building defenses against exactly this scenario — including, as we reported, injecting fake tools into Claude Code to poison competitor training data. The same company that was hardening its product against distillation is now the one alleging it was distilled. That arc is the real story.
The numbers Anthropic put on the record
What makes this letter different from the usual back-and-forth about Chinese AI is that Anthropic attached figures. The headline numbers, consistent across CNBC, Benzinga, and Reuters-sourced reporting, are these:
The alleged campaign at a glance
| Metric | What Anthropic alleges |
|---|---|
| Fraudulent accounts | Roughly 25,000 |
| Exchanges with Claude | More than 28.8 million |
| Time window | April 22 to June 5, 2026 (about 6 weeks) |
| Capabilities targeted | Software engineering, agentic reasoning |
| Model in focus | Anthropic's Mythos Preview models |
| Anthropic's label | "Largest known distillation attack" against it to date |
Spread across roughly six weeks, 28.8 million exchanges from about 25,000 accounts works out to a sustained, high-volume pattern rather than a handful of curious users. That density is the core of Anthropic's argument that this was an organized harvesting operation, not ordinary product usage.
Anthropic also placed the alleged campaign in a lineage. The company has previously disclosed similar activity it attributes to other Chinese labs: DeepSeek (reported in the range of 150,000 interactions), Moonshot AI (about 3.4 million), and MiniMax (around 13 million), all surfaced earlier in 2026. Against that backdrop, the 28.8 million figure now attributed to Alibaba- and Qwen-affiliated operators would be, by Anthropic's own count, the biggest yet — more than double the MiniMax figure.
How Anthropic says it detected this
Anthropic has not published a forensic technical report alongside the letter, so the public detail on detection is limited to what reporting describes. The company frames the 25,000 accounts as fraudulent — meaning, in its telling, accounts created or operated to disguise who was behind them and to evade limits that would normally throttle this kind of bulk querying. The pattern Anthropic describes is consistent with usage-side detection: clustering accounts by behavior, spotting query distributions that look like capability extraction rather than end-user work, and tracing them back to operators it associates with Alibaba and Qwen.
This matters for how much weight to give the accusation. Attribution in cases like this is genuinely hard. Linking accounts to a specific company — rather than to contractors, resellers, or unaffiliated actors using a lab's models — is the part most likely to be contested if this ever moves from a letter to a formal proceeding. Anthropic states the link confidently. It has not, as of now, shown the underlying evidence publicly.
Why this lands the way it does
Strip away the specifics and the timing tells you why Anthropic sent this to the Senate Banking Committee rather than only to its lawyers. This is a frontier US lab asking US lawmakers to treat alleged capability theft as a national-competitiveness issue at the exact moment Washington is writing the rules of the US-China AI race. The choice of recipients — the chair and ranking member of a committee focused on economic and financial security, plus the White House — is a strategic one. It frames distillation not as a private API dispute but as industrial policy.
For the broader industry, the letter crystallizes a tension that has been building all year. Closed frontier labs argue their models are crown-jewel IP that rivals are extracting through the API. Open-weight and Chinese labs argue distillation is a normal, lawful compression technique and that the alarm is really about protecting a lead. Both of those positions can be argued in good faith, which is why this will not be settled by a single letter. We have tracked this fault line directly — from the Frontier Model Forum's espionage-defense pact uniting OpenAI, Anthropic, and Google, to Alibaba's own aggressive product moves like turning the Qwen app into an app store for AI agents.
There is also a strategic irony worth naming plainly, without editorializing on anyone's character. The same Anthropic now alleging its outputs were taken without permission agreed in the past year to a roughly $1.5 billion settlement with a group of authors who said their books were used to train Claude without permission. That fact was raised by Chinese commentators as a rhetorical counterpoint. It does not refute Anthropic's specific allegations about 25,000 accounts — the two situations are legally distinct — but it does explain why the "who took whose data" framing is being contested rather than accepted.
The other side — silence, and a sharp rebuttal
As of June 25, 2026, Alibaba had not issued an official response. CNBC and Benzinga both reported that the company did not immediately reply to requests for comment. We treat that as exactly what it is: an absence of an official position, not an admission and not a denial. Reading silence as guilt would be a mistake.
The closest thing to a rebuttal came not from Alibaba's corporate communications but from Chinese state media. In Global Times, Tian Feng — former dean of SenseTime's Intelligence Industry Research Institute — argued the allegations "lack substance" and are "rooted in tech-hegemony anxiety," describing them as a "kick away the ladder" tactic meant to slow China's AI progress. He noted that distillation is a widely adopted model-compression technique across the industry, and argued Chinese firms have advanced through lawful data sources and algorithm optimization.
It is important to frame that correctly. Tian Feng's comments are a counter-argument relayed through state media, not an official Alibaba denial and not a point-by-point rebuttal of the 25,000-account claim. They challenge the framing and the motive; they do not engage the specific forensic allegation. Both can be true at once: distillation can be a normal technique and a specific campaign can be alleged to have crossed a line. Until either side shows evidence, that gap stays open.
An accusation, not a verdict — why the distinction matters
It is worth restating the status of this story, because the headlines blur it. Anthropic has made a detailed, on-the-record accusation in a letter to lawmakers. It has not filed a lawsuit over this campaign. No court has weighed the evidence. No regulator has issued a public finding tied to the letter. Alibaba has not been charged, and has not been proven to have done anything.
That does not make the accusation trivial — a frontier lab putting hard numbers in front of the Senate Banking Committee is a serious act, and the figures are specific enough to be tested. But "serious accusation" and "established fact" are different things, and the difference is the whole game when a company you cover is on the receiving end. We will update this piece if Alibaba responds, if Anthropic publishes underlying evidence, or if this escalates into a formal proceeding.
What we are watching next
Three things will tell us where this goes. First, whether Alibaba issues an official corporate response rather than letting state-media commentary stand as its proxy. Second, whether Anthropic publishes any of the forensic detail behind the 25,000-account attribution, which is the part most exposed to challenge. Third, whether the Senate Banking Committee or the White House acts on the letter — through hearings, export-control signals, or API-access rules — which would turn a corporate accusation into policy.
For anyone building on these models, the practical takeaway is narrower and calmer than the headlines suggest: the terms of service around frontier APIs are about to get more scrutiny, and the line between "using a model" and "extracting a model" is about to be litigated — in courts, in Congress, or both. If you want the underlying tool at the center of all this, our breakdown of Claude Code covers what Anthropic is actually protecting.
Frequently asked questions
What is model distillation?
Model distillation is a machine-learning technique where a smaller "student" model is trained to imitate the outputs of a larger, more capable "teacher" model — answers, code, and reasoning. It is a standard, widely used method for compressing frontier capabilities into cheaper, faster models. The dispute here is not whether distillation is legitimate in general, but whether a specific alleged campaign against Claude crossed into unauthorized extraction.
What exactly does Anthropic accuse Alibaba and Qwen of?
Anthropic accuses operators it links to Alibaba and its Qwen AI lab of running a coordinated "distillation" campaign to illicitly copy Claude's most valuable capabilities — software engineering and agentic reasoning. In a letter dated June 10, 2026, Anthropic alleges these operators used roughly 25,000 fraudulent accounts to conduct more than 28.8 million exchanges with its models between April 22 and June 5, 2026, calling it the largest known distillation attack against it to date. These are allegations; Alibaba has not been charged or found liable.
How were 28.8 million interactions allegedly collected?
According to Anthropic's account as reported by CNBC, Benzinga, and Reuters-sourced coverage, the activity ran through roughly 25,000 accounts Anthropic describes as fraudulent over about six weeks (April 22 to June 5, 2026). Anthropic frames this as a high-volume pattern engineered to harvest capability rather than ordinary product usage. Anthropic has not publicly released the forensic evidence behind the attribution, and linking the accounts to a specific company is the part most likely to be contested.
Is this a lawsuit against Alibaba?
No. This is an accusation contained in a letter Anthropic sent to U.S. lawmakers — Senate Banking Committee Chair Tim Scott and ranking member Elizabeth Warren, with copies reported to have reached White House officials — dated June 10, 2026 and made public on June 24. It is not a lawsuit, not an indictment, and not a court finding. No court has ruled on the claims, and Alibaba has not been charged with anything.
How did Alibaba respond?
As of June 25, 2026, Alibaba had not issued an official response and did not immediately reply to reporters' requests for comment. The most prominent pushback came from Chinese state media: in Global Times, Tian Feng, former dean of SenseTime's Intelligence Industry Research Institute, called the allegations baseless and "rooted in tech-hegemony anxiety," arguing distillation is a normal industry technique. That is a counter-argument relayed through state media, not an official Alibaba denial or a point-by-point rebuttal of the specific 25,000-account claim.
How does this compare to Anthropic's earlier distillation disclosures?
Anthropic has previously disclosed similar activity it attributes to other Chinese labs earlier in 2026: DeepSeek (reported around 150,000 interactions), Moonshot AI (about 3.4 million), and MiniMax (around 13 million). At more than 28.8 million exchanges, the activity now attributed to Alibaba- and Qwen-affiliated operators would be the largest Anthropic has named — more than double the MiniMax figure — which is why Anthropic labels it the largest known distillation attack against it to date.
