Anthropic Accuses Alibaba of a Record Distillation Campaign

Anthropic has accused Alibaba of running the largest model distillation campaign it has ever publicly disclosed — and it made the accusation not in a press release, but in a June 10, 2026 letter to the US Senate Banking Committee. According to that letter, operators affiliated with Alibaba and its Qwen AI lab generated more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts. Those numbers are Anthropic’s allegation. Alibaba denies it.

The claim landed at a combustible moment. Two days after the letter was sent, the US Commerce Department restricted Anthropic’s own Fable 5 and Mythos 5 models on national-security grounds, forcing the company to disable them globally. Anthropic now describes itself as fighting a two-front war: asking Washington to protect its frontier models from Chinese extraction while contesting Washington’s own limits on those same models.

This guide separates what Anthropic actually alleged from what has been independently confirmed, sets the campaign against the February 2026 distillation disclosures it dwarfs, explains the difference between legitimate and adversarial distillation, and translates the geopolitics into a practical security posture for any business building on a closed AI API. Where a figure is vendor-stated or contested, we say so.

On June 10, 2026, Anthropic wrote to Senator Tim Scott, chair of the US Senate Banking Committee, and Senator Elizabeth Warren, its ranking member, alleging that operators affiliated with Alibaba and Alibaba’s Qwen AI lab had run what it called the largest known distillation attack against Anthropic to date. The timing was deliberate: the committee held a hearing titled “AI and the American Dream: Promoting Innovation, Affordability, and American Dominance” on June 11 and 12, and the letter was written to land alongside it.

It is important to be precise about who received this disclosure. This was a letter to a Senate committee — not a White House or Commerce Department announcement. The separate government action that followed two days later came from a different branch entirely, and conflating the two is the most common error in the coverage. The details did not become public until Reuters, CNBC and Bloomberg reported on the letter on June 24, roughly two weeks after it was sent.

Per the letter, the alleged campaign ran from April 22 to June 5, 2026 — a 44-day window — and targeted Claude’s software engineering, agentic reasoning and cybersecurity capabilities, specifically the abilities embodied in Anthropic’s Mythos Preview frontier model. Anthropic also alleged that the Chinese government was complicit in the effort, and framed the broader pattern in stark economic terms, warning that distillation is turning hundreds of billions of dollars in American AI investment into a subsidy for geopolitical competitors. Both points are Anthropic’s characterization rather than independently confirmed fact.

What makes this disclosure land harder than February’s is the arithmetic. In February 2026, Anthropic disclosed three separate Chinese distillation campaigns: DeepSeek (150,000+ exchanges), Moonshot AI’s Kimi (3.4 million+) and MiniMax (13 million+). Add those together and you get roughly 16.5 million exchanges across an estimated 24,000 accounts. Anthropic says the single Alibaba campaign generated 28.8 million — about 1.7x the prior three put together, or roughly 74% more on top of that combined total.

No outlet has laid out all four disclosed campaigns side by side, so we built the reference table below. It is the clearest single view of Anthropic’s distillation timeline — but read it as a map of Anthropic’s own disclosures, not a complete census. The word “largest” refers specifically to campaigns Anthropic has detected and chosen to reveal; other labs may have faced larger ones they have not discussed.

The recomputed math is worth stating plainly: 0.15M + 3.4M + 13M equals about 16.55 million exchanges across the three February campaigns, and 28.8 million divided by 16.55 million is roughly 1.74 — so the single Alibaba campaign, as alleged, is about three-quarters larger than all three earlier campaigns put together. That is the comparison Anthropic itself drew, and it is the reason the company describes the trend as accelerating rather than plateauing.

Anthropic’s letter, as reported by CNBC and Reuters, said the Alibaba-affiliated operators had “brazenly” and “illicitly” attempted to extract its AI capabilities. The prize, per the letter, was the cluster of abilities that make Mythos so valuable: autonomous software engineering, agentic reasoning, and offensive and defensive cybersecurity. Those are precisely the capabilities Anthropic put on display through Project Glasswing and the Mythos cybersecurity model, the program that let more than 200 large technology companies test Mythos against their own systems — and made its power public enough to be worth stealing.

Anthropic frames adversarial distillation as a shortcut that lets a competitor skip the cost of building those capabilities from scratch. Its own February write-up put the economics bluntly.

Alibaba rejects the accusation. In coverage that followed the initial reports, the company said it does not use outputs from proprietary AI models to train its own models and that its AI development complies with applicable intellectual property laws. The timing of that response is itself part of the story: Reuters initially reported that Alibaba did not immediately respond to a request for comment, and the explicit denial surfaced in later coverage, including a June 26 Business Standard explainer. We present it as Alibaba’s stated position, with that sequence noted.

Model distillation is not inherently illicit — it is a standard machine-learning technique, and the word doing the real work in this story is “adversarial.” Distillation trains a smaller “student” model to imitate the outputs of a larger “teacher” model. Every major lab uses it internally to ship cheaper, faster versions of its own systems. The dispute is about whose model is the teacher, and whether the student’s owner had permission to learn from it.

That legal vacuum is the heart of the matter. Anthropic’s February post warned that an illicitly distilled model can lose the safety guardrails of the original — its filters against bioweapon guidance or offensive cyber operations — because the student inherits capability without the original’s alignment work. So the concern is not only commercial. A distilled model stripped of safeguards is a national-security argument as much as an intellectual-property one, which is why Anthropic made the case to a Senate committee rather than a courtroom.

Here is the tension most coverage buries. On June 10, Anthropic asked the government to protect its frontier models from Chinese extraction. On June 12 — two days later — the Commerce Department imposed export-control restrictions on Fable 5 and Mythos 5, citing fears the models could be accessed by military and intelligence users in China and other countries of concern, and forcing Anthropic to disable both models globally. This was a separate government action from the Senate disclosure, not a response to it, but the sequence is jarring: the company seeking protection for its models watched the same government switch them off.

Anthropic says it received the directive at 5:21pm ET and is complying while disputing the basis for it — a potential narrow jailbreak of Fable 5 that the company argues does not justify recalling a commercial model deployed to hundreds of millions of people. It is asking the administration to crack down on Chinese distillation while simultaneously fighting the administration’s restrictions on its own models, presenting the two as complementary rather than contradictory.

None of this came out of nowhere. In April 2026 the White House Office of Science and Technology Policy had already accused China of “deliberate, industrial-scale campaigns” to steal US AI models and directed agencies to share intelligence with AI companies. Anthropic’s letter argues that the Alibaba campaign took place after that warning — its framing being that Alibaba ignored the administration’s position. That is Anthropic’s interpretation of the timeline, and a pointed one, since it casts the alleged conduct as defiance rather than oversight.

Strip away the geopolitics and a practical truth remains for any business running on Claude, GPT-5.5 or Gemini: your vendor’s intellectual property is under active attack, and the defensive measures that follow can change your own access. Two things move from abstract to operational here. First, the techniques used to extract a model are the same techniques that abuse a customer’s account. Second, a vendor’s response to an attack — or a government’s — can suspend a model you depend on. The table below maps the threat vectors to the business risk and the mitigation that actually addresses each.

None of these mitigations is exotic, but most teams have not adopted them because the threat felt theoretical until now. Treat this dispute as the prompt to make four moves concrete. The checklist below is the minimum posture we recommend to clients building on closed AI APIs.

This is the work we do with clients on AI digital transformation engagements — turning a vendor headline into a concrete posture: a model-routing layer so no single suspension is fatal, account controls that survive an audit, and monitoring that distinguishes a genuine usage spike from credential abuse. If the AI sits inside a customer-facing product, the same resilience thinking belongs in the application architecture itself, not bolted on afterward.

The Alibaba accusation is one move in a much larger contest, and the surrounding events make that obvious. On the same day the Reuters story broke, Chinese security firm 360 unveiled AI security tools at the ISC.AI 2026 conference in Beijing, with founder Zhou Hongyi explicitly calling one of them “China’s version of Mythos.” Alibaba had been added to the Pentagon’s Chinese Military Companies list on June 8 and filed suit against the Defense Department on June 23 to challenge that designation. And the company’s US-listed shares reacted immediately to the accusation.

Washington is moving too, though unevenly. Senators Bill Hagerty and Andy Kim said they would introduce an amendment to must-pass defense legislation that would blacklist or sanction Chinese firms found to be improperly accessing US AI model outputs, with a related bipartisan House bill behind it — though, as The Next Web notes, whether either proposal survives into the final defense bill is uncertain. At the same time, the Commerce Department held off blacklisting DeepSeek this month, despite an interagency committee deeming it a security risk, to avoid escalating tensions with Beijing. The signals point in opposite directions.

The rhetoric has run ahead of the proof. Senator Mark Warner said publicly that NSA chief Joshua Rudd had told him Mythos “broke into almost all of our classified systems, not in weeks, but in hours” — a striking line, but one reported by CyberNews citing congressional testimony rather than confirmed against a primary transcript, so we treat it as reported rather than verified. Our read is that the distillation fight has become a proxy for the broader US-China AI race, where the strategic incentive to close the gap makes extraction attempts rational regardless of any single accusation. For the competitive backdrop, see our Chinese AI labs Q2 2026 market position and our coverage of Alibaba’s Qwen 3.7 Max, the flagship the campaign was allegedly meant to strengthen — note that the allegation concerns an ongoing effort, not proof that Qwen’s existing capabilities were built on distilled Claude outputs.

Looking forward, the most consequential outcome is not the Alibaba case itself but whether adversarial distillation gets a legal definition. Right now there is none, and a dispute this large with no settled law tends to force one — through legislation, litigation, or both. If a workable definition emerges, expect closed-API terms of service to tighten, access-gating on the most sensitive models to become routine, and intelligence sharing between labs to be formalized. The companies that will navigate it best are the ones already treating model access as a managed dependency rather than a permanent utility.