Operators linked to Alibaba and its AI lab Qwen have conducted a large-scale campaign to distill Claude. This was stated in a letter from Anthropic to U.S. Senate Banking Committee Chairman Tim Scott and senior Democrat Elizabeth Warren, according to Reuters.
The company described the incident as the largest known distillation attack. According to the agency, from April 22 to June 5, nearly 25,000 fake accounts created over 28.8 million interactions with the model.
“Beyond its scale, this campaign was striking due to its brazen nature […]. Alibaba is listed on the New York Stock Exchange, supports business operations in the United States, and is accountable to American investors and regulators,” the letter states.
In February, Anthropic noted that the distillation method is often used legitimately, for example, to create a cheaper or more compact version of a model. The problem arises when competitors gain access to an advanced tool through fake accounts, bypass service restrictions, and use responses to train their own systems.
In the letter, Anthropic claims that the alleged campaign targeted Claude’s capabilities in agent tasks, software development, and long-term planning. According to the developer, such actions allow the reproduction of advanced model behavior without the costs of training it.
“When Chinese labs distill these capabilities from American models, they benefit from American investments without bearing the costs and risks associated with training advanced AI models. This overturns the economic logic underpinning U.S. leadership in AI, turning research and development, computational resources, and other American investments worth billions of dollars into a subsidy for our competitors,” Anthropic emphasized.
Company representatives also indicated that unauthorized distillation could accelerate the development of Chinese AI systems for cyber operations, military tasks, and intelligence.
What Anthropic Asks from Congress
According to Decrypt, Anthropic urged lawmakers to expand the sharing of technical indicators and intelligence between developers of advanced AI models and the U.S. government. The company also requested clarification of antitrust rules so firms can share information about such attacks without risking competition law violations.
Another part of the proposals concerns export control. Anthropic demanded stricter restrictions on advanced AI chips and computing resources, as well as closing loopholes that allow Chinese organizations to access overseas data centers. The company suggested imposing sanctions or other measures against parties responsible for large-scale extraction of model capabilities.
Other Cases
In February, Anthropic accused DeepSeek, Moonshot AI, and MiniMax of generating over 16 million interactions with Claude through approximately 24,000 fake accounts. At that time, developers claimed to have linked the campaigns to specific labs through IP addresses, request metadata, infrastructure indicators, and, in some cases, data from partners. For instance, DeepSeek generated over 150,000 interactions, Moonshot AI over 3.4 million, and MiniMax about 13 million.
These accusations sparked debate, as distillation itself remains a common industry practice. In April, as Decrypt notes, Elon Musk testified in federal court that xAI “partially” used OpenAI models in training Grok.
On April 20, Congressman Bill Huizenga introduced a bill against the extraction of key technical specifications of closed American AI models by foreign adversaries. According to the U.S. Congressional Budget Office, the document provides for export restrictions and sanctions against foreign entities that illegally access AI-based products.
In December 2025, Nvidia announced the development of technology to verify the location of its processors amid reports of smuggling accelerators to China.
