Anthropic accuses Alibaba of massive Claude model extraction attack

Anthropic accused Alibaba of running what it called the largest known attack of its kind against Claude, saying nearly 25,000 fraudulent accounts generated more than 28.8 million exchanges in a campaign tied to Alibaba and Alibaba Qwen. The company said the activity ran from April 22 through June 5 and was aimed at speeding China’s path toward Anthropic’s advanced Mythos Preview capabilities.

The allegation turns on a technical practice with real-world policy consequences. Anthropic says distillation is a normal machine-learning method in which a stronger model’s outputs are used to train a smaller one. In this case, the company says the same method was abused at scale through fraudulent accounts and proxy services designed to conceal suspicious traffic and evade detection.

That matters because model extraction does not require breaking into a data center or stealing source code. Instead, it can involve querying a frontier model repeatedly, collecting its answers, and using those responses to teach a competing system to imitate behavior, reasoning patterns, and safety features. Anthropic has said those campaigns are growing more sophisticated and can undercut export controls by letting foreign labs close capability gaps through indirect access to American systems.

The dispute landed directly in Washington’s policy debate. Anthropic sent a letter to Senators Tim Scott and Elizabeth Warren before the Senate Banking, Housing, and Urban Affairs Committee’s June 11 hearing on AI, American innovation and national security. The hearing was framed around keeping the United States ahead of China, putting the company’s complaint squarely inside a broader fight over access to frontier models, chip restrictions and enforcement.

The timing also follows a White House accusation in April that China is stealing U.S. AI intellectual property on an industrial scale. Anthropic has been using its public security reporting to place this case alongside other AI misuse concerns, including what it says was a Chinese state-sponsored group that manipulated Claude Code in cyber espionage attempts. The message is clear: the company is no longer describing these incidents as isolated misuse, but as part of a pattern that blends cyber operations, industrial competition and state-linked risk.

Alibaba had not responded publicly, leaving Anthropic’s claim to define the debate for now. If the allegation is substantiated, it could sharpen scrutiny of how Chinese firms access U.S. AI systems and push lawmakers toward tighter controls on model outputs, monitoring and account abuse. It would also mark a shift in frontier-model competition, from product rivalry to accusations that one side is extracting the other’s capabilities at industrial scale.