Anthropic accuses Alibaba of 'largest known distillation attack' on Claude

Anthropic, the U.S. artificial-intelligence company behind the Claude family of large language models, accused Chinese e-commerce conglomerate Alibaba Group on 24 June 2026 of conducting what it called the largest known "distillation attack" against Claude — a campaign the firm says was carried out through nearly 25,000 fraudulent accounts, designed to extract the model's capabilities rather than its raw weights.

The allegation, first reported by Reuters and the BBC before being amplified across the Chinese-language press on the morning of 25 June (UTC), is the most direct public accusation by a U.S. frontier-lab against a named Chinese tech major over model extraction. It also lands inside an already charged policy environment: U.S. export controls on advanced AI chips, repeated warnings from Washington about Chinese access to U.S. model APIs, and Beijing's parallel push for "self-controlled" foundation models.

The substance of the dispute is technical but the stakes are commercial and geopolitical. Distillation — the practice of training a smaller model to mimic a larger one — is a legitimate technique used inside research labs and is now embedded in the product roadmaps of most major AI companies. What Anthropic alleges here is the illegitimate end of that spectrum: thousands of fake accounts, run in a coordinated pattern, querying Claude at industrial scale to harvest its outputs, then using those outputs to train a competitor.

What Anthropic says it found

According to Anthropic's account, summarised in Reuters' 25 June (UTC) write-up and corroborated by BBC News on the same day, the operation relied on fraudulent accounts that routed queries through Alibaba's infrastructure. The pattern, the company says, was inconsistent with normal user behaviour: high query volume, low diversity of task type, and a strong bias toward the kinds of reasoning chains most useful for replicating a frontier model. The 25,000-account figure was first circulated by Polymarket on the evening of 24 June and is now in wide circulation.

Anthropic framed the incident in unusually direct language, calling the effort "brazenly and illicitly" executed. The company says it has since terminated the implicated accounts and tightened abuse-detection on its API. It is not, on the public record, seeking damages; it is signalling.

What Alibaba has said

Alibaba's public response, as of 25 June (UTC), has been to deny that the company conducted or commissioned any such operation. Chinese-language coverage, including summaries in the Nikkei Asia feed, has framed the allegation as an unverified claim that conflates the behaviour of individual developers using Alibaba Cloud's infrastructure with the actions of Alibaba itself. That distinction matters. Cloud platforms in China — Alibaba Cloud, Tencent Cloud, Huawei Cloud — host hundreds of thousands of independent accounts; an operator running distillation workloads on its own rented compute is not, on its face, the same as the cloud provider directing the operation.

Chinese commentators have also pointed out that distillation is openly discussed in Chinese AI research papers and is a standard technique inside Alibaba's own model-training pipeline. The argument, in essence, is that Anthropic is repackaging a routine practice as a security breach because the party doing it is Chinese. That framing has not been confirmed by any independent technical analysis — but it is the structural counter-narrative now circulating in Beijing, Shanghai and Hangzhou.

The wider context: a two-sided squeeze

The accusation lands on a U.S. AI industry that has spent two years lobbying for tighter export controls on advanced GPUs to China, and on a Chinese industry that has spent those same two years building domestic alternatives — Huawei's Ascend line, Cambricon, SMIC, and an emerging cluster of inference-optimised silicon in Shenzhen and Hangzhou. Distillation is, in that context, a workaround. If a Chinese lab cannot buy enough H100s or H200s to train a frontier model from scratch, it can still attempt to compress the behaviour of a frontier model — Anthropic's, OpenAI's, Google's — into something trainable on a smaller chip budget.

Anthropic's allegation, then, is less about 25,000 accounts and more about the strategic logic of compute scarcity. The same dynamic has been visible in earlier incidents: model-weight leaks, jailbreak marketplaces on Telegram, and the proliferation of "uncensored" Claude and GPT-4 derivatives tuned on Chinese infrastructure. Each of those episodes sits at the seam between legitimate research, commercial competition and export-control evasion.

There is also an internal U.S. dimension. Frontier labs have, at times, themselves distilled competitors' models to benchmark and improve their own. The industry's public posture on distillation is therefore not a clean line between allowed and disallowed; it is a line between acceptable internal practice and unacceptable external extraction. Anthropic's complaint reads as enforcement of that line against a foreign competitor at a politically convenient moment.

What is contested

Several elements of the public account remain unverified. Anthropic has not, as of 25 June (UTC), published a technical report with hashes of the fraudulent account activity, network metadata, or any independent forensic confirmation. The 25,000-account figure originated on a prediction-market feed and has been repeated without on-the-record sourcing. Alibaba has not been shown the underlying logs. Independent researchers have not analysed the API patterns.

It is also worth noting that the line between "a developer on Alibaba Cloud running a distillation job" and "Alibaba itself running a distillation job" is doing real work in this dispute. If a third-party developer accessed Claude from a server co-located on Alibaba's infrastructure, the cloud provider is not obviously the responsible party under any published terms-of-service standard. Anthropic's framing implies a level of corporate involvement that Alibaba, on the current record, denies.

Stakes

If the allegation holds up under independent scrutiny, it gives the U.S. Commerce Department a fresh basis to tighten the API-side of its chip-export regime — restricting not just hardware flows to China, but the consumption of U.S. model outputs by Chinese-controlled accounts. That is a step the U.S. AI industry has been quietly requesting for over a year. If it does not hold up, the episode becomes another entry in a lengthening list of public accusations from U.S. labs that have produced headlines but no enforcement action.

For Alibaba, the exposure is reputational and contractual. Cloud customers — including European banks, ASEAN telecoms and Middle Eastern sovereign-AI projects — will watch how the company handles the allegation. A weak response hands U.S. competitors a procurement talking point. A strong, evidence-led rebuttal — including independent technical analysis — does the opposite. For Anthropic, the upside is the same as the downside: the company has put itself on record as a defender of frontier-model integrity, and the durability of that claim will be tested the first time the underlying data is requested under seal.

The structural read is straightforward. The contest between U.S. and Chinese AI is no longer a contest of who can train the largest model; it is a contest of who can run the largest closed ecosystem without leakage. Distillation, jailbreaks and weight-extraction are the new export-control battleground — fought not at fabs in Hsinchu or Shenzhen, but at the API edge. Anthropic's accusation is the first time a frontier lab has named a Chinese counterpart publicly in that fight. It will not be the last.

Monexus framed this story around the structural read — compute scarcity, API-side export controls, and the contested boundary between cloud-provider responsibility and developer behaviour — rather than the headline accusation alone. The wire led on the corporate dispute; we lead on the contest of ecosystems it sits inside.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/s/NikkeiAsia
• https://x.com/Polymarket/status/
• https://x.com/Reuters/status/
• https://t.me/s/nikkeiasia