Skip to content
News Incident

Anthropic tells Senate that Alibaba ran 28.8 million Claude queries through 25,000 fake accounts in the largest known AI distillation attack

· by Pondero Newsdesk

The short version

Anthropic submitted a formal letter to the Senate Banking Committee accusing Alibaba of running an industrial-scale model-distillation campaign against Claude from April 22 to June 5, 2026, generating 28.8 million unauthorized exchanges through roughly 25,000 fraudulent accounts.

Anthropic tells Senate that Alibaba ran 28.8 million Claude queries through 25,000 fake accounts in the largest known AI distillation attack

For six weeks this spring, operators linked to Alibaba's Qwen lab ran 28.8 million unauthorized exchanges with Claude models through roughly 25,000 fraudulent accounts, according to a formal letter Anthropic submitted to the Senate Banking Committee. The scale exceeds every prior distillation disclosure Anthropic has made, and it targets the most commercially sensitive capabilities the company sells.

What happened

Anthropic's letter, dated June 10, 2026, and addressed to Committee Chair Tim Scott and Ranking Member Elizabeth Warren, described a campaign running from April 22 to June 5. Operators used commercial proxy services to route API calls from China, where Anthropic bars access, through jurisdictions where the service is available. The accounts generated 28.8 million Claude exchanges targeting agentic reasoning, software engineering proficiency, and long-horizon task completion, per TechTimes's reporting on the Senate letter.

Anthropic head of policy Sarah Heck told senators the attacks were "carried out illicitly, systematically, and at industrial scale to harvest U.S. AI capabilities across frontier labs and repackage them as their own without incurring the training and R&D costs required to train U.S. frontier models." Alibaba had not responded publicly as of June 25.

Bloomberg first reported the letter on June 24. CNBC confirmed the same day with additional details on the committee framing and Anthropic's policy requests.

How it compares to prior disclosures

In February 2026, Anthropic publicly named three Chinese AI startups: DeepSeek (approximately 150,000 exchanges), Moonshot AI (more than 3.4 million), and MiniMax (more than 13 million), all using a combined pool of roughly 24,000 fraudulent accounts. The Alibaba figure of 28.8 million exchanges exceeds the combined February total.

The accused party is also different in kind. DeepSeek, Moonshot, and MiniMax are AI-focused startups. Alibaba is a global technology company with e-commerce infrastructure spanning dozens of markets and a market capitalization in the hundreds of billions of dollars. Anthropic framed this difference explicitly: the letter argued that distillation was converting "billions of dollars in American investment and R&D into a massive subsidy for our geopolitical competitors."

Why it matters

The distillation technique used here requires no access to model weights, architecture, or training data. Attackers query the API at scale, collect input-output pairs, and fine-tune a competing model on those results. The resulting system can match the target model's capability profile while skipping the alignment and safety training that went into the original. Anthropic told senators that a distilled model could inherit Claude's software-engineering performance without the behavioral guardrails built in through its alignment pipeline.

That safety gap is why Anthropic escalated to the Senate rather than filing a terms-of-service complaint. The company's policy requests were concrete: clarify antitrust rules so U.S. AI companies can share distillation threat intelligence legally, expand semiconductor export controls, and pass legislation imposing penalties on AI developers caught running unauthorized distillation campaigns.

For anyone operating AI-powered products on Claude's API, the disclosure matters for two reasons. First, it is direct evidence that sophisticated actors are already attempting to replicate frontier model behavior at commercial scale. Second, it signals that Anthropic is pushing for legislation that could affect the competitive landscape of the models available in the market. Operators building on Claude should watch whether the Senate Banking Committee schedules a hearing and whether companion bills in the House advance through the defense appropriations cycle.

Context

Anthropic brought the same evidence to the White House as supporting context for the Fable 5 export-control directive. The Commerce Department issued that directive on June 12, 2026, ordering Anthropic to suspend access to Claude Fable 5 and Mythos 5 for foreign nationals globally. Anthropic complied while publicly characterizing the order as a misunderstanding. The Senate letter and the White House briefing together constitute Anthropic's argument that restricting access and fighting distillation are complementary national security measures, not contradictions.

Senators Bill Hagerty and Andy Kim announced plans to introduce a defense-bill amendment that would sanction any Chinese firm found improperly accessing U.S. AI model outputs to train competing models. A bipartisan House bill with similar scope was under consideration for the same defense measure, per TechTimes.

What to watch next

Alibaba's formal response, if one comes, will be the next data point. A Senate Banking Committee hearing on AI distillation would mark a significant escalation from a corporate letter to congressional oversight. Watch also for OpenAI or Google to file parallel complaints. If multiple frontier labs disclose simultaneously, the story shifts from a bilateral corporate dispute to a systemic infrastructure-security issue.

Sources