On June tenth, Anthropic sent a letter to the two most senior members of the Senate Banking Committee.
The letter, first reported by Reuters and Bloomberg two weeks later, alleges that operators affiliated with Alibaba's Qwen AI lab ran what Anthropic calls the largest known distillation attack in its history: roughly twenty-five thousand fraudulent accounts, generating more than twenty-eight million conversations with Claude over six weeks, routed through commercial proxy services to dodge the geographic restrictions that bar Chinese entities from accessing the model.
The alleged goal was not to use Claude. It was to copy it.
One important line before we go further: these are allegations, not findings. Alibaba has not addressed the specifics, and no outside party has verified the claims.
But the letter went to Congress, senators are already drafting sanctions legislation around it, and the story it tells about how this industry actually works matters to everyone building with AI, which is why we are covering it.
Fraudulent accounts alleged
~25,000
Per Anthropic's Senate letter
Claude conversations
28.8M
In six weeks, April to June
Vs all prior campaigns
Larger
Than three Chinese labs combined
Alibaba stock reaction
Fell
Nearly three percent on the news
Read the reporting: The CNBC report includes the exact phrase Anthropic's policy chief used to describe the operation, four words that explain why this went to the Senate instead of a courtroom. →
What distillation actually is and why it works
Distillation is deceptively simple. You point a cheaper model at a stronger one, ask it millions of questions, harvest the answers, and train your model to imitate them.
You get a usable echo of the leader, without paying the billions it cost to build the original.
According to the letter, this campaign did not target general chat ability. It zeroed in on the two capabilities that are hardest to build and most commercially valuable: software engineering and agentic reasoning, the capacity to plan and carry out long tasks autonomously. The exact capabilities that separate frontier models from everything else.
And here is the escalation pattern that should worry every AI company. In February, Anthropic disclosed that three other Chinese labs: DeepSeek, Moonshot, and MiniMax had run similar campaigns totalling around sixteen million exchanges.
The alleged Alibaba operation, at nearly twenty-nine million, is larger than all three combined. Each campaign, Anthropic says, has been better at evading detection than the last.
Alleged distillation campaigns against Claude: exchanges (millions)
The detail that makes it structural
A distillation query looks identical to a legitimate query at the API level. There is no firewall rule that separates a paying customer from a copying operation. The only way to fully prevent it is to stop selling access to the model at all, which is the business.
That is why Anthropic went to the Senate instead of just banning accounts: this is not a bug it can patch. It is a property of selling intelligence over an API.
A twenty-nine million query operation aimed at one model is a backhanded valuation of that model. Nobody runs an industrial copying campaign against a product that isn't worth copying.
Presented by Clickup
Replace scattered apps and endless status meetings with ClickUp.
Tasks, subtasks & priorities for clear ownership.
Docs & wikis that live alongside your work.
Built-in time tracking - no third-party tools needed.
ClickUp AI writes updates, summarizes threads, and removes blockers.
1,000+ integrations including Slack, Notion, and Google Drive.
Try ClickUp free - no credit card required and reclaim your team's time today.
Now connect it to the number nobody wants to say out loud
Here is where this stops being a story about two companies and starts being a story about you.
This week, CNBC separately confirmed that somewhere between a third and nearly half of enterprise AI usage at American companies now flows to Chinese models. A year ago that number was under two percent.
The shift was never announced. It happened one engineer at a time, one cost decision at a time, cheap open-weight models handling the routine work, frontier models reserved for the hard stuff.
Put the two stories together and the picture sharpens uncomfortably. American enterprises are quietly migrating to Chinese models because they are nearly as good and dramatically cheaper. And the maker of the most capable American model just told the Senate under a letter its lawyers drafted, that it believes the biggest Chinese lab got that good, at least in part, by copying American capabilities at industrial scale.
If the allegation holds, the discount your engineering team loves has a hidden line item: someone else paid the research bill, and it may have been paid involuntarily.
February
Anthropic names three Chinese labs in distillation campaigns totalling around sixteen million Claude exchanges.
April
The White House warns of industrial-scale foreign distillation of American AI models. The alleged Alibaba campaign begins roughly two weeks later.
June
Anthropic's letter reaches the Senate. The Pentagon separately adds Alibaba to its list of Chinese military companies. Alibaba is contesting the designation.
Now
Senators from both parties are drafting a defense-bill amendment to sanction entities that run distillation campaigns, moving this from a terms-of-service dispute to trade law.
Three things this changes for anyone building with AI
Know whose model your stack actually runs on.
Open your API dashboards and your router configs this week and check which models handle your traffic. Not what you chose a year ago, what runs today. If part of your product quietly routes to cheap models, you should at least know it, be able to defend it to your customers, and understand that sanctions legislation targeting some of those providers is now actively moving through Congress.
If your product exposes AI through an API, you are distillable too.
The uncomfortable generalization from this story: capability extraction is industrializable against any commercial AI endpoint. If your differentiation lives in fine-tuned behavior, prompt architecture, or a custom model your users can query freely, a competitor can harvest it exactly the way Claude was allegedly harvested, smaller scale, same method.
Rate limits, account verification, and anomaly detection just became product features, not infrastructure chores.
The moat lesson repeats: capability is temporary, distribution is not.
If frontier capability can be copied in six weeks by anyone with proxy servers and patience, then capability alone is the weakest moat in the industry. What cannot be distilled: your customer relationships, your proprietary data, your distribution, your trust.
Every issue we publish lands on the same conclusion from a different direction because every story in this industry keeps proving it.
🔮 The Bottom Line
Anthropic believes someone spent six weeks and twenty-five thousand fake identities copying the most valuable thing it has ever built. Its response was not a lawsuit. It was a letter to the Senate, because there is no court that can fix a problem built into the business model of selling intelligence through an API.
Whether the allegation against Alibaba holds or not, the structural truth underneath it is already settled: in this industry, capability leaks. It leaks through APIs, through proxies, through twenty-five thousand patient fake accounts.
The companies that survive will not be the ones with the smartest model. They will be the ones holding the assets that cannot be copied at any scale: trust, data, and the customers who open their emails.
📧 Forward this to 3 entrepreneur friends who need to see this opportunity
