Anthropic Says Alibaba Ran 28.8 Million Claude Exchanges Through Fake Accounts

Anthropic accused Alibaba-linked operators of running 28.8 million exchanges with Claude through nearly 25,000 fraudulent accounts, according to a June 10 letter to U.S. officials that Bloomberg, Reuters and CNBC reviewed. The campaign ran from April 22 to June 5, Anthropic said, and targeted Claude's software engineering and agentic reasoning skills. Anthropic described it as the largest known distillation attack against the company.

The company said operators affiliated with Alibaba and its Qwen lab used the accounts to gather Claude outputs for adversarial distillation, a training method in which a smaller model learns from responses generated by a stronger one. Distillation is common when a lab compresses its own models. Anthropic's claim is different: the company says Alibaba used fraudulent accounts to bypass Anthropic's access restrictions and terms of service for a product Anthropic does not sell in China.

Bloomberg said Alibaba gave no comment, while Reuters and CNBC reported no immediate company response; Bloomberg also said the company's American depositary receipts touched $99.10 in New York after falling more than 3 percent.

What Anthropic says changed

The Alibaba allegation is larger than the three China-linked campaigns Anthropic named in February. In that disclosure, Anthropic put MiniMax at more than 13 million Claude exchanges, Moonshot AI above 3.4 million and DeepSeek above 150,000. The three together accounted for more than 16 million exchanges across about 24,000 fake accounts, below the 28.8 million now attributed to Alibaba-linked operators.

Anthropic had already pushed the distillation fight into Washington before naming Alibaba. In April, OpenAI, Anthropic and Google began sharing information about adversarial-distillation attempts through the Frontier Model Forum after OpenAI and Anthropic had publicly warned that Chinese labs were extracting capabilities from U.S. models. The antitrust question around that cooperation remains unresolved, which is why Anthropic is now asking officials to clarify what rival labs may share when the subject is security.

Washington already had a file open

The letter arrived after the White House Office of Science and Technology Policy released an April 23 memorandum on "Adversarial Distillation of American AI Models." Michael Kratsios, the office's director, said foreign entities, principally in China, were running industrial-scale campaigns to copy U.S. frontier systems. Reuters later reported that the State Department told diplomats to warn foreign governments about models trained through unauthorized distillation.

Lawmakers are preparing a harder response. Senators Bill Hagerty and Andy Kim plan to seek an amendment to defense legislation that would blacklist or sanction Chinese firms found to have improperly accessed U.S. AI model outputs, Bloomberg reported. A related House proposal from Rep. Bill Huizenga and Rep. Sydney Kamlager-Dove would create a public list of model-extraction attackers and authorize sanctions. Huizenga's office said the bill is meant to separate approved model distillation from extraction attacks.

Alibaba's second Washington fight

The Anthropic claim lands while Alibaba is already contesting a U.S. military-linked designation. The Pentagon added Alibaba, Baidu and BYD to its Section 1260H list on June 8, saying the companies support China's defense industrial base. Alibaba denied being a Chinese military company and sued the Defense Department in federal court on June 23, arguing the label has no basis in fact or law.

That case is separate from Anthropic's letter, but the two disputes now sit in the same policy lane. The Pentagon list can restrict defense contracting. The distillation allegation could give lawmakers another reason to treat Alibaba's AI work as a national security matter, especially because the allegation centers on Alibaba's Qwen AI lab rather than a peripheral business unit.

Anthropic is asking for help from the same administration that recently restricted its own models. Reuters and CNBC reported that Commerce Department controls imposed on June 12 led Anthropic to disable access to Fable 5 and Mythos 5 after officials feared the models could be deployed by military-intelligence users in China and other countries of concern. As of Wednesday, CNBC reported that Anthropic had not said when it expected those models to come back online.

OpenAI, Anthropic, Google Share Attack Data to Counter Chinese AI Distillation

OpenAI, Anthropic, and Google have started passing each other data on adversarial distillation, working through the Frontier Model Forum, Bloomberg reported Monday. The three built that nonprofit with

The Implicator

OpenAI Quietly Bought Voice-Cloning Startup Weights.gg, Then Folded the Team

OpenAI's purchase of Weights.gg, the voice-cloning startup whose Replay catalog hosted models for Taylor Swift, Samuel L. Jackson, President Trump and dozens of other named figures, looks less like an

The Implicator

Distillation Attacks on Claude Are Real. So Is the Lobbying Campaign.

When Anthropic released a new Claude model earlier this year, MiniMax redirected nearly half its distillation traffic to the updated system within 24 hours. Not days. Not a week. Hours. The Chinese AI

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai