Anthropic accuses Alibaba of largest-ever AI ‘distillation’ attack, seeks tougher US curbs on Chinese AI labs

Anthropic has accused Chinese technology giant Alibaba of carrying out the largest known “distillation” attack against its Claude AI models, alleging that operators linked to the company used nearly 25,000 fraudulent accounts to extract the capabilities of its frontier AI systems over a six-week period. The allegations were made in a letter sent by Anthropic to the US Senate Banking Committee ahead of a hearing on artificial intelligence.

According to Anthropic, operators affiliated with Alibaba and its AI research arm, Alibaba Qwen, generated more than 28.8 million exchanges with Claude between April 22 and June 5, 2026. The company alleged that the activity violated its terms of service and was aimed at extracting some of Claude’s most advanced capabilities, including agentic reasoning, software engineering and long-horizon task planning. 

“Alibaba executed the largest known distillation attack on Anthropic to date,” the company said in the letter.

What is distillation?

Distillation refers to the practice of using the outputs of a more capable AI model to train another model. While the technique is widely used within the AI industry, Anthropic argues that using fake accounts to systematically collect responses from a competitor’s model amounts to intellectual property theft rather than legitimate model development. 

Anthropic said the alleged campaign was significantly larger than similar incidents it disclosed earlier this year involving Chinese AI firms DeepSeek, Moonshot AI and MiniMax. Together, those campaigns accounted for more than 16 million exchanges through roughly 24,000 fraudulent accounts, according to the company. 

“An economic and nation security concern”

“Distillation attacks harvest American IP to advance our competitors,” Anthropic wrote, arguing that such campaigns allow rival AI developers to replicate frontier-model capabilities “without incurring the training and R&D costs required to train US frontier models.” 

The letter also links the alleged activity to the broader AI race between the United States and China. Anthropic claimed that successful distillation efforts could help Chinese companies reach the capability level of its advanced Mythos Preview model more quickly, reducing the technological gap between the two countries. It also argued that “the larger the capability gap is between US and PRC AI models, the more time the US government will have to harden cyber defenses.” 

Beyond disclosing the alleged attack, Anthropic urged Congress to take additional steps to curb similar incidents. The company called for legislation that would allow US AI companies to share threat intelligence more freely, tighten controls on China’s access to advanced US AI chips and computing infrastructure, and impose penalties on Chinese AI labs found to be conducting large-scale distillation campaigns. “More action is needed to ensure continued American AI leadership,” the company said.