Anthropic accuses Alibaba of the largest ever documented distillation attack: 28.8 million exchanges, 25,000 fraudulent accounts — the AI war enters a new dimension

Anthropic accuses Alibaba of the largest documented distillation attack ever: 28.8 million exchanges, 25,000 fraudulent accounts — the AI war enters a new dimension

🔎 28.8 million stolen requests, a strategic model in the crosshairs, and a timing that smells of political maneuvering

On June 24, 2026, the AI world learned that Anthropic had accused Alibaba of carrying out the largest distillation campaign ever documented on an artificial intelligence model. The scale is unprecedented: 28.8 million exchanges on Claude, carried out via nearly 25,000 fraudulent accounts, between April 22 and June 5, 2026.

This is not an isolated incident. It is the second documented round, after the attacks by DeepSeek, Moonshot and MiniMax in February 2026. Except here, the volume has almost doubled. And the target is no longer just any model: it is Claude Mythos Preview, Anthropic's crown jewel in agentic reasoning and software engineering.

The letter sent to the Senate Banking Committee on June 10, 2026, addressed to Senators Tim Scott and Elizabeth Warren, is not a simple report. It is a calibrated geopolitical maneuver, arriving two days before the Commerce Department imposed export restrictions on Fable 5 and Mythos 5. In this context, the affair goes far beyond the theft of intellectual property. It marks the point where AI competition definitively shifts into the realm of national security.

The Essentials

• Anthropic accuses Alibaba and its Qwen branch of illicitly extracting Claude's capabilities via 28.8 million exchanges across ~25,000 fraudulent accounts (April 22 - June 5, 2026).
• This campaign is 1.8 times larger than the total of the three previous campaigns combined (DeepSeek, Moonshot, MiniMax — ~16 million exchanges, February 2026).
• The primary target would be Claude Mythos Preview, Anthropic's most advanced model in agentic reasoning.
• Anthropic sent a letter to the Senate Banking Committee on June 10, 2026; the Commerce Department imposed restrictions on Fable 5 and Mythos 5 on June 12.
• Alibaba denies the allegations and is simultaneously suing the Pentagon to be removed from the list of Chinese military companies.
• The central danger: a distilled model inherits reasoning capabilities without the guardrails of Anthropic's Constitutional AI.

Recommended Tools

The mechanics of the attack: how industrial-scale distillation works

Model distillation is not a new technique. It is a learning method where a less capable model is trained on the outputs of a more advanced model. The goal: to reproduce the capabilities of the target model at a fraction of the time and cost of training from scratch.

Specifically, operators create accounts on Claude's interface. They send carefully crafted requests — reasoning prompts, coding problems, complex agentic tasks. Each response from Claude becomes a training signal for the attacker's model.

With 28.8 million exchanges, the volume of data generated is colossal. It is enough to capture not only a model's reasoning patterns, but also its edge-case behaviors, its planning strategies, and its multi-step problem-solving capabilities.

The Alibaba campaign lasted 44 days. That is about 655,000 exchanges per day, spread across 25,000 accounts. This represents an average of 26 exchanges per account per day — a pace that stays under the radar of basic detection systems, but becomes statistically detectable at the aggregate scale.

Anthropic had already identified the pattern in February 2026 with the campaigns of DeepSeek (150,000+ exchanges), Moonshot AI (3.4 million) and MiniMax (13 million). The company therefore had time to refine its detection. This is probably what made it possible to attribute this new campaign to Alibaba and Qwen with a sufficient level of confidence for an official letter to the Senate.

Why Mythos Preview is the strategic target

Not all models are equal when it comes to distillation. Extracting capabilities from a mid-tier model offers limited diminishing returns. But siphoning a cutting-edge model in agentic reasoning is something else entirely.

Claude Mythos Preview represents Anthropic's state of the art in chain-of-thought reasoning and complex software task execution. It's the type of model that, in agentic benchmarks, ranks alongside Claude Opus 4.7 (Adaptive) — scoring 94.3 on SWE-bench, behind GPT-5.5 (98.2) and Gemini 3 Pro Deep Think (95.4).

Agentic reasoning is precisely the capability that Chinese labs are looking to close the gap on. DeepSeek V4 Pro (Max) reaches 88 on the general benchmark and does not appear in the top agentic in its cloud version. Moonshot AI's Kimi K2.6 reaches 88.1 in agentic in self-host — a respectable score but far from the 90+ mark.

Distilling Mythos Preview would theoretically allow a Chinese lab to skip months, or even years, of R&D. Elon Musk estimated in June 2026 that a Chinese lab would have a Fable 5-class model by Q1 2027. The CEO of Z.AI, whose GLM-5.1 reaches 83 on the general benchmark, replied: "won't take that long." Distillation is exactly the shortcut that makes this prediction credible.

This dynamic is part of a broader context of an AI talent war where US and Chinese players are fighting over every competitive advantage.

The invisible danger: capabilities without guardrails

The problem isn't just that a Chinese model becomes as capable as Claude. It's that it does so without inheriting what makes Claude "safe" according to Anthropic.

Anthropic built its reputation on Constitutional AI — a framework where the model is trained to follow a set of ethical principles and to refuse certain categories of requests. It's not perfect, but it's a layer of safety built into the model itself, not just an external filter.

When you distill a model, you capture its outputs. You capture what it knows how to do. But you don't inherently capture its refusal mechanisms, its internal alignments, its ethical calibration. A model distilled from Claude might reason just as well, but agree to do things that Claude would refuse.

The US government understands this. According to Nikkei Asia, the administration specifically fears that Mythos's capabilities could fall into the hands of the Chinese military. On April 17, 2026, the White House had already accused China of stealing US labs' intellectual property "on an industrial scale."

This concern echoes that of intelligence alliances like the Five Eyes, which have warned that offensive AI hacking is now a top-tier threat. Distillation isn't hacking in the traditional sense, but the result is identical: a transfer of strategic capabilities to an adversary.

The revealing timeline: letter, restrictions, silence

The timing of this affair is anything but accidental. Let's look at the sequence:

• June 8, 2026: Alibaba is added to the Pentagon's Chinese military companies list.
• June 10, 2026: Anthropic sends its letter to the Senate Banking Committee (Tim Scott + Elizabeth Warren).
• June 12, 2026: The Commerce Department imposes restrictions on Fable 5 and Mythos 5. Anthropic disables access to these models globally.
• June 24, 2026: The affair breaks in the media (Reuters, CNBC, WSJ, FT, BBC).

Two days separate Anthropic's letter and the export restrictions. This is extremely tight for a federal bureaucratic process. The letter clearly served as a pressure element, providing the Commerce Department with a concrete and publicized case to justify restrictions that were likely already in the works.

Anthropic describes the campaign as the "largest known distillation attack on Anthropic to date" in its letter. The company claims that Alibaba "ignored the Trump Administration's warnings" — a formulation that positions China as deliberately defiant, not as a passive actor.

Note a significant detail: the Commerce Department postponed placing DeepSeek on the commercial blacklist, despite the risks identified by an interagency committee. DeepSeek, which maintains its rock-bottom prices at ~$0.44 per million input tokens compared to ~$0.50 for GPT-5.5, therefore remains accessible. The US strategy seems to target cutting-edge models (Mythos, Fable) while letting Chinese mid-range models flood the market — an approach that could prove counterproductive in the long run.

Alibaba's response: denial and legal counter-attack

Alibaba did not immediately respond to requests for comment from Reuters, CNBC, WSJ, FT, and BBC, according to articles published on June 24. But the company's strategy is taking shape through two parallel actions.

First, according to a tweet from @techtechchina, Alibaba formally denies the distillation allegations. Second, the company is suing the Pentagon to be removed from the list of "Chinese military companies" — a designation received on June 8, 2026.

This is a classic dual approach: denying the substance of the accusations while attacking the legitimacy of the accuser. If the Pentagon is wrong about Alibaba's military status, the underlying argument is that its other accusations (including distillation) lose credibility.

The problem for Alibaba is that Anthropic's letter is addressed to the Senate Banking Committee, not the Pentagon. This is a Congressional committee, with investigative and hearing powers that go beyond the executive branch. And the 28.8 million documented exchanges represent a volume that is difficult to explain as a coincidence.

Alibaba and its Qwen branch thus find themselves backed into a corner: either the fraudulent accounts are theirs, or someone else used their infrastructure for an operation of this magnitude under their name — a scenario that, in either case, raises serious questions.

The financial context: why Anthropic is playing for high stakes

It would be naive to read this affair solely through the lens of national security. Anthropic has massive commercial interests in this drama.

The numbers are telling. Anthropic generated 4.8 billion USD in revenue in Q1 2026, with a projected run-rate of 10.9 billion USD in Q2 2026 — reaching its first operating profit. Claude Code alone generates 2.5 billion USD in annualized revenue according to MindStudio (May 2026). Annualized revenue grew from ~1 billion USD in December 2024 to ~30 billion USD in April 2026, a multiplication by 30 in 16 months.

In this context, the company is preparing a confidential S-1 IPO. Intellectual property protection is not an abstract concept — it's a stock valuation argument. If a Chinese competitor can reproduce Mythos's capabilities at a fraction of the cost through distillation, Anthropic's competitive advantage depreciates.

Sending the letter to the Senate two weeks before the export restrictions serves a dual purpose: securing the model (Fable 5 and Mythos 5 are now blocked) and building the narrative of a company whose technology is so precious that entire nations are trying to steal it. It's a pricing power argument for the IPO.

Anthropic is not a neutral player in this story. But that doesn't make the allegations false. The 28.8 million exchanges exist. The 25,000 accounts exist. The question is who controls them, not whether they exist.

The Chinese ecosystem: a race against time using accelerated methods

The Alibaba campaign did not come out of nowhere. It fits into a dynamic where Chinese labs are under immense pressure to close the gap with American models.

In February 2026, Anthropic had already documented three distinct campaigns. The table below summarizes the evolution:

The Alibaba campaign alone accounts for 63% of the total documented volume. And above all, it is 1.8 times larger than the three previous campaigns combined.

The parallel with Anthropic's research on Dreaming — where Claude agents learn between sessions — is ironic. On one hand, Anthropic is developing legitimate and controlled learning mechanisms. On the other hand, Chinese actors are exploiting these same learning capabilities, but through non-consensual distillation.

Chinese labs are not starting from scratch. Moonshot AI's Kimi K2.6 reaches 84 on the general benchmark and 88.1 in agentic self-host. DeepSeek V4 Pro (Max) scores 88 in general. Z.AI's GLM-5.1 reaches 83. But none rival the American top 3 (Gemini 3.1 Pro at 92, GPT-5.5 at 91, Claude Opus 4.7 at 90). Distillation is the fastest way to close this gap.

Implications for developers and users

The Alibaba-Anthropic case is not just a distant geopolitical story. It has concrete consequences for the tech community.

Firstly, the restrictions on Fable 5 and Mythos 5 mean that Anthropic has disabled access to these models globally — not just for Chinese users. If you were building workflows around these models, you lost access on June 12, 2026. The immediate alternatives are Claude Opus 4.7 (Adaptive) at 90 in general, or GPT-5.5 at 91.

Secondly, trust in Chinese APIs could be affected. If the allegations are confirmed, using the Qwen API or DeepSeek potentially means benefiting from a model built on intellectual property theft. For companies subject to compliance frameworks (SOC 2, ISO 27001), this could become a legal risk.

Thirdly, distillation will become a security issue for all AI API providers. If Anthropic, with its resources, could not prevent 28.8 million fraudulent exchanges in 44 days, smaller providers are even more vulnerable. Expect more aggressive rate limits, more intrusive pattern detection systems, and potentially enhanced identity verification.

For developers deploying AI agents, the impact is direct: hosting these agents requires reliable infrastructure. Solutions like Hostinger offer an execution environment, but the question of which model you are allowed to use and where it can be hosted becomes a real regulatory headache.

❌ Common mistakes

Mistake 1: Confusing distillation with server hacking

Distillation is not a technical intrusion into Anthropic's servers. It is the abusive use of a legitimate interface (the API or Claude chat) via fraudulently created accounts. The line between "intensive use" and "illicit extraction" is legally blurry, which is precisely why Anthropic chose to alert the Senate rather than rely solely on civil lawsuits.

Mistake 2: Thinking distillation produces a perfect clone

A model distilled from 28.8 million exchanges is not a bit-for-bit copy of Claude. It captures reasoning patterns, not the underlying architecture or alignment mechanisms. The resulting model will likely be inferior in quality and unpredictable in safety — which is exactly the problem.

Mistake 3: Downplaying the stakes by saying "everyone does it"

Yes, distillation is a common practice in machine learning. But distilling an open-source model or a model you own has nothing to do with creating 25,000 fraudulent accounts to extract the capabilities of a closed model. The difference is the same as between studying a book you bought and illegally photocopying a confidential manual.

❓ Frequently Asked Questions

What exactly is model distillation?

It is a technique where a small model is trained on the outputs of a large model to reproduce its capabilities at a lower cost. Legitimate internally, it becomes illicit when it exploits a third-party model without consent via fraudulent accounts.

Why did Anthropic disable Mythos 5 and Fable 5 globally?

By order of the Commerce Department (June 12, 2026). The export restrictions aim to prevent any foreign national from accessing them. Anthropic chose global deactivation rather than attempting complex and easily bypassed geographic filtering.

Did Alibaba acknowledge the facts?

No. Alibaba denies the allegations according to sources close to the company, and is simultaneously suing the Pentagon to be removed from the list of Chinese military companies. No official response has been published in the media as of June 24.

What is the connection to Anthropic's IPO?

Anthropic is reportedly preparing a confidential S-1 IPO. IP protection is a central argument for its valuation. Demonstrating that its models are targeted by foreign nations reinforces the narrative of an irreplaceable technology — even if distillation also proves that the capabilities are reproducible.

Is DeepSeek involved in this campaign?

Not directly in the April-June 2026 one. But DeepSeek had conducted its own campaign in February 2026 (150,000+ exchanges). Paradoxically, DeepSeek was not placed on the commerce blacklist by the Commerce Department, unlike the restricted Anthropic models.

✅ Conclusion

Anthropic's accusation against Alibaba marks the moment when the AI war ceases to be a metaphor and becomes a documented, quantified, and instrumentalized national security operation. With 28.8 million stolen exchanges, distillation is no longer an academic research topic — it is a weapon of technology transfer on an industrial scale. The next two years will tell whether US export controls are enough to slow the process, or whether the dynamic of geopolitical conciliation and innovation makes any attempt at containment illusory.