# Anthropic accuses Alibaba of the largest known distillation attack on Claude

> Anthropic alleges Alibaba-linked operators ran its largest known distillation attack on Claude; Alibaba denies it.

*The accusation is unusually specific, the venue was a Senate committee rather than a press release, and Alibaba denies all of it. The mechanism — not the numbers — is what makes it matter.*

By WireRead Editorial · WireRead
Canonical: https://wireread.com/news/anthropic-alibaba-distillation-attack

Anthropic has levelled its most serious anti-distillation accusation to date at a Chinese rival — and it did so in front of Congress. In a **10 June 2026** letter to the **US Senate Banking Committee**, first reported by Bloomberg, the company alleged that operators affiliated with **Alibaba** and its AI lab ran what it calls the **largest known model-distillation campaign** against Claude: roughly **28.8 million model exchanges** through some **25,000 fraudulent accounts** over a **44-day window** from 22 April to 5 June 2026. Two things should anchor the reader before any analysis: these are Anthropic's **allegations**, and **Alibaba denies them**. None of the figures has been independently verified.

## What Anthropic alleges

By Anthropic's account, the campaign was not opportunistic scraping but a targeted extraction, concentrated on Claude's **software-engineering, agentic-reasoning and cybersecurity** capabilities — and specifically on the frontier model Anthropic refers to as **Mythos Preview**. Those are the highest-value, hardest-to-replicate skills a lab has, which is why the choice of target matters as much as the volume. Senator **Elizabeth Warren**, citing the letter, described the episode as 'the largest known distillation attack on Anthropic to date'. The venue is itself a signal: Anthropic routed the claim through a Senate committee rather than a blog post, folding it into a week already thick with export-control pressure on the company.

> Anthropic accused operators tied to Alibaba of moving to 'brazenly' and 'illicitly' extract Claude's most advanced capabilities, describing it as the largest distillation campaign it has detected against its models.
> — [CNBC](https://www.cnbc.com/2026/06/24/anthropic-alibaba-distillation-campaign.html), 2026-06-24

## What distillation is — and why the guardrails don't travel

Model distillation means training a smaller, cheaper model on the outputs of a more powerful one so the student imitates the teacher. Done with permission it is ordinary engineering; done covertly against a competitor's paid API it is, in Anthropic's telling, theft of the most expensive thing a frontier lab owns. Anthropic's sharper argument is not commercial but about safety: a model distilled from Claude can pick up the raw **capability** while leaving behind everything Anthropic layered on top of it — the safety fine-tuning, the usage policies, the refusals, the access controls. The skill is copied; the brakes are not.

> **Key:** The load-bearing claim is mechanistic, not numeric: **'the capability transfers, the guardrails do not.'** If a distilled model inherits Claude's cyber or agentic ability without its safety training, the risk is not that a rival saves money — it is that a capable model ships into the world with none of the constraints its teacher was built with.

## A pattern Anthropic says is escalating — and a dispute

This is not Anthropic's first such accusation. In **February 2026** the company said it had identified three separate 'industrial-scale' distillation campaigns, which it attributed to **DeepSeek, Moonshot and MiniMax**. What makes the Alibaba allegation land harder is scale: Anthropic says the ~28.8-million-exchange campaign is **larger than that entire earlier set combined**. Read charitably, that is a company documenting an intensifying pattern of capability theft by Chinese labs. Read sceptically, it is a well-timed escalation — the disclosure arrived the same week Anthropic was under acute US export-control pressure, and a vivid 'largest ever' number is useful to a company arguing that Washington should treat its models as strategic assets.

> Anthropic told lawmakers the alleged Alibaba-linked campaign was larger than the three 'industrial-scale' distillation efforts it disclosed earlier in 2026 combined, casting it as the largest known distillation attack on Claude.
> — [Nikkei Asia](https://asia.nikkei.com/business/technology/artificial-intelligence/anthropic-accuses-alibaba-of-largest-known-distillation-attack-on-claude), 2026-06-24

The honest position, as of now, is that both things can be true and neither is proven. The **28.8-million** exchange count and the **~25,000** account figure are Anthropic's allegations; Alibaba rejects them; no independent party has confirmed either number. What is verifiable is that a leading US lab has publicly accused a leading Chinese one of large-scale capability theft, in a formal letter to Congress, during a fight over how tightly the US should control frontier models. That combination — serious accusation, disputed evidence, high political stakes — is the story, and it will not resolve on the strength of a headline number — the burden of proof sits with Anthropic, and so far it has offered assertion rather than evidence.

## Key takeaways

- Anthropic alleges operators affiliated with Alibaba and its AI lab ran ~28.8 million model exchanges through ~25,000 fraudulent accounts over 44 days (22 April–5 June 2026) — figures it calls its largest known distillation campaign, and which Alibaba denies.
- The accusation surfaced not in a press release but in a 10 June 2026 letter to the US Senate Banking Committee, reported by Bloomberg; Sen. Elizabeth Warren cited it as the largest known distillation attack on Anthropic to date.
- Anthropic says the campaign deliberately targeted Claude's software-engineering, agentic-reasoning and cybersecurity capabilities in the frontier model it calls Mythos Preview — the highest-value skills to copy.
- The core argument is mechanistic: a model distilled from Claude can inherit the capability without Claude's safety training, usage policies or access controls — 'the capability transfers, the guardrails do not'.
- Anthropic frames this as an escalation of a pattern: in Feb 2026 it named three 'industrial-scale' campaigns (DeepSeek, Moonshot, MiniMax); it says the alleged Alibaba effort is larger than all three combined.
- The 28.8M and 25,000 figures are unverified and disputed; the timing — the same week as US export-control pressure on Anthropic — is part of the context, not a coincidence to ignore.

## FAQ

### What did Anthropic accuse Alibaba of?
Anthropic alleged that operators affiliated with Alibaba and its AI lab ran the largest known model-distillation campaign against Claude — roughly 28.8 million model exchanges via around 25,000 fraudulent accounts over 44 days (22 April–5 June 2026), targeting Claude's coding, agentic and cybersecurity skills. These are allegations, and Alibaba denies them.

### Are the 28.8 million exchanges and 25,000 accounts confirmed?
No. Both figures are Anthropic's unverified allegations, disclosed in a 10 June 2026 letter to the US Senate Banking Committee. Alibaba denies the claims, and no independent party has confirmed the numbers. It is an active dispute, not a settled finding.

### What is model distillation, and why is it a concern?
Distillation trains a smaller, cheaper model on a more powerful model's outputs so it imitates it. Anthropic's worry is that a model distilled from Claude inherits the capability but not Claude's safety training, usage policies or access controls — 'the capability transfers, the guardrails do not.'

### How does this compare with earlier distillation cases?
In February 2026 Anthropic said it had found three 'industrial-scale' campaigns, attributed to DeepSeek, Moonshot and MiniMax. It says the alleged Alibaba campaign is larger than all three combined — which is what makes it the largest known attack in Anthropic's telling.

### Why disclose it to a Senate committee instead of a press release?
Anthropic put the allegation in a 10 June 2026 letter to the US Senate Banking Committee, reported by Bloomberg. The disclosure arrived the same week Anthropic faced US export-control pressure, so the venue and timing are part of the context — the claim is entangled with a broader policy fight over frontier-model controls.

## Sources

- [Anthropic accuses Alibaba of campaign to 'brazenly' and 'illicitly' extract AI capabilities](https://www.cnbc.com/2026/06/24/anthropic-alibaba-distillation-campaign.html) — CNBC, 2026-06-24
- [Anthropic accuses Alibaba of 'largest known distillation attack' on Claude](https://asia.nikkei.com/business/technology/artificial-intelligence/anthropic-accuses-alibaba-of-largest-known-distillation-attack-on-claude) — Nikkei Asia, 2026-06-24
- [Anthropic Says Alibaba Used 25,000 Fake Accounts To Distill Claude](https://www.forbes.com/sites/jonmarkman/2026/06/26/anthropic-says-alibaba-used-25000-fake-accounts-to-distill-claude/) — Forbes, 2026-06-26