Alibaba just got caught running the largest AI model theft operation ever recorded — and Anthropic is fighting a war on two fronts to survive it.
In a letter sent to US Senators Tim Scott and Elizabeth Warren on 10 June, Anthropic accused Chinese technology giant Alibaba of orchestrating an industrial-scale campaign to harvest capabilities from its Claude AI models. The numbers are staggering: nearly 25,000 fraudulent accounts generated 28.8 million exchanges with Claude between 22 April and 5 June 2026, targeting the model’s most commercially valuable skills — software engineering and agentic reasoning.
The Alibaba Qwen Distillation Attack
The technique is called adversarial distillation — feeding carefully crafted queries to a frontier AI model, collecting its responses, and using those outputs to train a cheaper rival system that approximates the original’s capabilities. Think of it as photocopying someone’s brain, one conversation at a time.
Anthropic’s letter, first reported by Bloomberg, alleged that operators affiliated with Alibaba and its Qwen AI lab ran the campaign “illicitly, systematically, and at an industrial scale.” The goal: accelerate China’s ability to match the capabilities of Anthropic’s advanced Mythos Preview model without paying the billions in research, compute, and safety engineering required to build one from scratch.
This wasn’t Anthropic’s first accusation. In February, the company exposed distillation campaigns by three Chinese AI startups — DeepSeek (150,000 exchanges), Moonshot AI (3.4 million), and MiniMax (13 million). Combined, those three generated roughly 16.5 million illicit interactions. The Alibaba campaign alone exceeded all three combined by nearly double.
Why This Is More Than a Terms-of-Service Violation
The White House had already flagged AI model distillation as a national security concern. In April, OSTP Director Michael Kratsios published a memo committing the US government to share intelligence with domestic AI labs about foreign distillation campaigns. Anthropic pointedly noted in its letter that the Alibaba operation took place after that warning — in open defiance of the administration’s position.
The geopolitical context makes this explosive. The Pentagon added Alibaba to its Chinese military companies blacklist on 8 June, just two days before Anthropic sent its letter. Alibaba has sued the Defence Department to contest the designation, calling it baseless. Now it faces a second front: accusations of systematically stealing American AI intellectual property.
Senators Bill Hagerty and Andy Kim are preparing an amendment to must-pass defence legislation that would blacklist or sanction any Chinese firm found improperly accessing US AI model outputs. A companion bill in the House, backed by Representatives Bill Huizenga and Sydney Kamlager-Dove, is also under consideration.
Elon Musk, never one to miss an opportunity, weighed in via X: “Anthropic is guilty of stealing training data at massive scale and has had to pay multi-billion dollar settlements for their theft. This is just a fact.” He was referencing Anthropic’s $1.5 billion copyright settlement with a group of authors in September 2025 — the largest in publishing history.
Caught Between Washington and Beijing
Here’s the delicious irony: Anthropic needs the US government to crack down on Chinese labs extracting its technology, but it’s simultaneously fighting that same government’s decision to restrict its own products.
On 12 June, Commerce Secretary Howard Lutnick signed an order blocking foreign nationals from accessing Anthropic’s most advanced Fable 5 and Mythos 5 models, citing security concerns. Anthropic disabled them globally to comply. The NSA — which had been using those models — lost access overnight. Meetings between Anthropic’s technical staff and White House officials have produced little progress.
China’s response has been predictably dismissive. Foreign Ministry spokesperson Guo Jiakun called the allegations “groundless” and “deliberate attacks on China’s development.” The Global Times ran an editorial accusing Anthropic of “technological hegemony anxiety” and a “kick away the ladder” strategy. Former SenseTime researcher Tian Feng told the paper that Chinese companies “have advanced through lawful data sources and algorithm optimisation under a compliant framework.”
Alibaba itself has remained silent on the distillation accusations. Its American depositary receipts fell more than 3%, dropping below $100 in Wednesday trading.
The $965 Billion Question
The stakes for Anthropic could not be higher. The company, now valued at $965 billion after a $65 billion Series H round, filed confidentially for an IPO this month and is preparing for a listing as soon as this autumn. The threat of cheaper Chinese imitation products that siphon away customers using stolen capabilities is a material risk for any company heading to public markets.
But Anthropic’s letter to Congress is also strategic positioning. By naming Alibaba — a company already on the Pentagon’s military blacklist — rather than just scrappy startups like DeepSeek, Anthropic is escalating the narrative from “terms-of-service abuse” to “national security emergency.” It wants antitrust guidelines clarified so US labs can share intelligence about distillation attempts, tougher chip export controls, and penalties for firms that use the technique.
The question is whether Washington will buy it. The same administration that classified Anthropic’s own models as quasi-weapons may not rush to become the company’s protector. And the fundamental problem Anthropic faces — that AI capabilities can be copied over the internet through nothing more than a well-crafted prompt — has no obvious legislative fix.
What we’re witnessing is the birth of a new kind of intellectual property war, one fought not with stolen source code or hacked servers but with 25,000 fake email addresses and millions of carefully worded questions. Whether governments can enforce borders around AI systems that exist as pure software remains, for now, an open question.
This story is developing. Alibaba has not responded to requests for comment.
