Hundreds of billions in research transformed into a subsidy for rivals
In the quiet arithmetic of geopolitical rivalry, the most consequential thefts leave no broken windows — only borrowed intelligence. Anthropic, the San Francisco AI company, has accused Alibaba of orchestrating nearly 29 million fraudulent exchanges with its Claude model, using thousands of fake accounts to extract the system's core capabilities through a method known as distillation. The allegation, delivered to US senators in June 2026, frames what might appear to be a technical dispute as something older and larger: the question of who bears the cost of discovery, and who reaps its rewards.
- Anthropic claims Alibaba ran the largest known AI extraction campaign in history — 29 million fraudulent queries designed not to gather data, but to clone the competitive soul of Claude itself.
- The distillation technique turns a rival's strength into a shortcut, allowing a weaker model to learn from a stronger one's outputs — effectively converting billions in American R&D into a free lesson for a geopolitical competitor.
- The Pentagon has linked Alibaba to Chinese military interests, and Anthropic's letter to Congress deliberately places this alleged theft inside a national security frame, not merely a corporate one.
- Alibaba has denied military ties and is actively suing the US government to contest its blacklist status, while declining so far to address Anthropic's specific accusations.
- With a major IPO on the horizon, Anthropic's public accusation serves as both a genuine alarm and a strategic signal — to investors, to lawmakers, and to an industry watching closely how this form of competition gets defined and punished.
Anthropic has accused Alibaba of conducting the largest known campaign to steal AI capabilities, alleging that operators linked to the Chinese technology giant used thousands of fake accounts to run nearly 29 million exchanges with Claude, the company's flagship model. The accusation was laid out in a letter to US Senators Tim Scott and Elizabeth Warren, dated June 10.
The method at the center of the allegation is called a distillation attack. By querying an advanced AI system repeatedly and observing its responses, an attacker can use those outputs to train a competing model — teaching a lesser system to approximate a more sophisticated one. Anthropic argues that at this scale, the practice effectively converts hundreds of billions of dollars in American research into a competitive advantage for a geopolitical rival. The targeting, the company says, was deliberate: Alibaba-linked operators focused specifically on Claude's most distinctive and valuable capabilities, not its surface features.
The letter invokes a broader national security concern, citing the US Department of Defense's assessment that Alibaba maintains ties to the Chinese military — a claim the company denies. Alibaba has gone further, filing a lawsuit this week to challenge its inclusion on the Pentagon's blacklist. It has not yet responded to Anthropic's specific allegations.
The accusation arrives at a charged moment. Anthropic is preparing for a stock market debut that could rank it among the world's most valuable companies. The letter to Congress, then, carries more than one message: it documents a real threat, reassures investors about the company's security posture, and calls on lawmakers to impose penalties on distillation attacks and tighten export controls. How Congress responds may determine not just Anthropic's competitive future, but the broader terms on which the US and China contest dominance in artificial intelligence.
Anthropic, the San Francisco artificial intelligence company, has leveled a stark accusation at Alibaba: the Chinese technology giant systematically extracted the capabilities of Claude, Anthropic's flagship AI model, using thousands of fake accounts in what the company describes as an unprecedented theft of intellectual property.
The allegation emerged in a letter dated June 10, addressed to US Senators Tim Scott and Elizabeth Warren. According to Anthropic, operators connected to Alibaba conducted nearly 29 million exchanges with Claude through fraudulent accounts. The scale alone distinguishes this from previous suspected thefts. Anthropic called it the largest extraction campaign of its kind—a coordinated effort to harvest not just data, but the underlying capabilities that make Claude valuable: its ability to handle complex, lengthy tasks and its decision-making architecture.
The method Alibaba allegedly employed is known as a distillation attack. The concept is straightforward in principle but devastating in practice. By querying Claude repeatedly, the attackers could observe its outputs and use those responses to train a competing AI model—essentially teaching a weaker system to mimic a stronger one. Anthropic argues that this approach, carried out at industrial scale, transforms hundreds of billions of dollars in American research and development into what amounts to a subsidy for geopolitical rivals. Why spend years and billions building an advanced AI system when you can extract one that already exists?
The targeting was deliberate. Anthropic states that Alibaba-linked operators focused specifically on Claude's most valuable features—the capabilities that distinguish it from cheaper alternatives and that represent the company's competitive edge. This was not random data harvesting. It was surgical.
The letter positions the accusation within a broader context of national security concern. Anthropic cited the US Department of Defense's assessment that Alibaba maintains ties to the Chinese military, along with other major Chinese firms including automaker BYD and tech company Baidu. The company urged Congress to impose penalties on organizations conducting such attacks and to strengthen protections around American technology exports. The implication is clear: what Anthropic views as theft, it also frames as a vulnerability in America's technological dominance.
Alibaba has denied any connection to the Chinese military and has taken the unusual step of suing the US government this week to challenge its inclusion on the Pentagon's blacklist. The company has not yet responded to the specific allegations from Anthropic, though the BBC has requested comment.
This is not the first time a major American AI company has raised alarms about distillation attacks. OpenAI has previously accused Chinese competitors of employing the same technique. The practice has become common enough that it now shapes how US AI developers think about security and competitive strategy. Each extraction campaign that succeeds makes the next one easier—the stolen model becomes the foundation for further theft.
Anthropics timing matters. The company is preparing for a major stock market debut that could value it among the world's most valuable corporations. The letter to Congress, in that context, serves multiple purposes: it documents a genuine threat, it signals to investors that the company takes security seriously, and it appeals to lawmakers to create conditions—through regulation or export controls—that protect American AI companies from this form of competition. The outcome of that appeal could reshape how the US manages its technological relationship with China.
Citas Notables
The largest campaign to illicitly extract Claude's capabilities— Anthropic, in letter to Congress
Distillation attacks turn hundreds of billions of dollars in American investment and research into a massive subsidy for our geopolitical competitors— Anthropic
La Conversación del Hearth Otra perspectiva de la historia
Why does it matter that they used thousands of fake accounts instead of just a few?
Scale is the point. A few queries might look like normal usage. Twenty-nine million exchanges across thousands of accounts looks like a coordinated campaign—it's the difference between someone trying to hide and someone who doesn't think they'll be caught.
Can you explain what a distillation attack actually accomplishes?
Imagine you have a brilliant teacher and a mediocre student. The student sits in on the teacher's lectures, takes notes on the answers, and then teaches those answers to others. The student never learns the underlying knowledge, but they can reproduce the outputs. That's distillation. Alibaba was the student.
If Alibaba built a competing model this way, wouldn't it be obviously inferior?
Not necessarily. If you extract enough outputs from a sophisticated model, you can train something that performs similarly on many tasks. You save years of research and billions in development. The copy might not be perfect, but it's good enough to compete, and it cost a fraction of the original.
Why is Anthropic making this public now, through Congress, rather than suing?
A lawsuit is between two companies. A letter to Congress is a plea for the government to change the rules. Anthropic is saying this isn't just a business problem—it's a national security problem. They want export controls, penalties, structural change.
Does the Pentagon connection actually matter to the technical accusation?
Technically, no. The extraction would be theft either way. But politically, it reframes the story from corporate espionage to something closer to military advantage. That changes what Congress is willing to do about it.
What happens if Congress doesn't act?
Then the next Chinese company does the same thing. And the one after that. The cost of extraction stays near zero while the cost of building stays in the billions. Eventually, American companies either accept the theft or they stop building things worth stealing.