Anthropic Tells Senate Alibaba Stole Claude's Capabilities

Anthropic has formally accused Alibaba's Qwen AI lab of running the largest known distillation attack against its models, creating nearly 28.8 million unauthorized exchanges with Claude through roughly 25,000 fraudulent accounts between April 22 and June 5, 2026. The company disclosed the campaign in a letter to Congress and called for legislation that would let AI labs treat capability theft as a national security matter - not just a terms-of-service problem.

"When PRC labs distill these capabilities from U.S. models, they capture the returns on American investments without bearing the costs or risks associated with training frontier AI models."

• Anthropic, in its June 10, 2026 letter to the Senate Banking Committee

The Attack

The campaign follows a playbook that Anthropic first detailed in February, when it accused DeepSeek, Moonshot AI, and MiniMax of running 16 million unauthorized exchanges through 24,000 accounts. The Alibaba operation is roughly 80% larger.

According to Anthropic's letter, operators linked to Alibaba's Qwen AI division used commercial proxy services to mask their geographic origin and bypass controls that bar Chinese entities from accessing Claude. The accounts posed as legitimate users while systematically querying the model for outputs on software engineering tasks, agentic reasoning scenarios, and long-horizon planning problems - exactly the capabilities that distinguish frontier models from cheaper alternatives.

Alibaba's headquarters complex in Hangzhou. The Qwen AI division operates as part of Alibaba Cloud. Source: commons.wikimedia.org

The technique, known as adversarial distillation, doesn't require access to a model's weights or architecture. A smaller model is trained on the query-response pairs collected at scale, absorbing behavioral patterns and domain knowledge without the multi-billion-dollar investment that goes into training a frontier system from scratch. Anthropic characterized this as Alibaba capturing "the returns on American investments without bearing the costs or risks."

Anthropic also noted that Alibaba's position makes the campaign more difficult to dismiss as the work of some unaccountable actor. In its letter, the company pointed out that Alibaba "is listed on the New York Stock Exchange, maintains business operations in the United States, and is accountable to U.S. investors and regulators" - a framing designed to force Congress to treat this as something other than a foreign espionage problem beyond U.S. jurisdiction.

Impact Assessment

Who Gets Affected

The Labs

Anthropic didn't limit its argument to its own losses. The letter framed distillation as a structural problem that exposes every frontier model provider whose models are accessible via commercial API. If the technique is industrializable at scale against Claude, it works against GPT-5, Gemini, and any other model that accepts text input and returns text output. The company argued this creates a free-rider problem where Chinese labs can compress years of R&D investment into a few weeks of API queries.

The policy asks Anthropic put to Congress reflect that framing: expand intelligence sharing between AI labs and the federal government, clarify antitrust rules so that competitors can share information about distillation attacks without triggering liability, strengthen export controls on AI chips and compute, close loopholes that let Chinese entities access American models through overseas data centers, and impose penalties on companies running large-scale extraction campaigns.

Developers

API developers aren't the target of the proposals, but they'd feel the effects. Mandatory screening of high-volume API usage - one of Anthropic's specific requests - would require infrastructure for monitoring query patterns at scale, something most API providers don't currently do methodically. Any new regime would likely mean additional latency, rate limits, or verification requirements for large enterprise accounts.

The Qwen Ecosystem

The U.S. Senate chamber. Senate Banking Committee leaders Tim Scott and Elizabeth Warren received Anthropic's letter on June 10. Source: commons.wikimedia.org

Alibaba's Qwen has emerged as one of the most competitive open-weight model families in 2026, particularly on software engineering benchmarks. Context about how Qwen's capabilities have developed makes the distillation accusation land differently: if Anthropic's claims are accurate, some of Qwen's recent coding and agentic performance gains may reflect capabilities transferred from Claude rather than original training.

Alibaba hadn't publicly responded to the accusations as of publication.

The Pentagon Dimension

The Senate letter wasn't the only pressure hitting Alibaba that week. On June 8, the Pentagon added Alibaba to its Section 1260H roster - the list of companies the Defense Department considers linked to China's military or military-civil fusion efforts. The designation bars the Pentagon from entering new contracts with listed companies or their subsidiaries, effective June 30.

Alibaba filed a federal lawsuit on June 23 contesting the designation, arguing there's "no basis" for inclusion and that the listing violates its "free-speech and due-process rights." The company stated plainly it "is not a Chinese military company nor part of any military-civil fusion strategy." Baidu, listed with Alibaba, has mounted similar legal challenges.

The precedent isn't completely against them. Smartphone maker Xiaomi successfully challenged a similar designation and won removal from the list, which shows these labels can be overturned in court. But the simultaneous pressure from the Pentagon and a Senate Banking Committee letter representing both parties suggests the political environment in Washington has shifted against giving Chinese tech firms the benefit of the doubt.

That shift reflects something bigger. As U.S. export controls on advanced chips have tightened and tensions over technology transfer have escalated, the question of what Chinese AI companies can access through commercial channels has moved from a licensing discussion to a national security one. Anthropic's letter accelerates that shift by putting a specific dollar figure - or at least a specific behavioral gap - on what distillation extracts.

What Happens Next

Senators Bill Hagerty (R-TN) and Andy Kim (D-NJ) have already moved to act, proposing a defense-bill amendment that would let the government blacklist or sanction entities running capability extraction campaigns. That's faster than anyone expected from a Congress that has struggled for years to pass comprehensive AI legislation.

Whether it passes in its current form is another question. The amendment's scope - how broadly "capability extraction" gets defined, whether it covers open-weight model distillation, how penalties get enforced against foreign entities - will determine whether the measure has teeth or becomes another paper threat. Anthropic's request to clarify antitrust rules so that competing labs can share threat intelligence is the kind of detail that tends to get lost in political negotiations but matters enormously in practice.

The deeper problem is structural. Every frontier model accessible via commercial API is a target. The cost of mounting this kind of campaign - renting proxies, creating accounts, writing query pipelines - is measured in thousands of dollars, not billions. The gap between what it costs to run a distillation campaign and what it costs to train the model being targeted is what makes the economics work so well for the attacker. No single piece of legislation changes that math. But if Congress does move to impose real penalties on companies behind large-scale extraction, the calculus for whether to run one shifts considerably.

Sources:

• Decrypt - Anthropic Urges Congress to Crack Down on AI Distillation
• Let's Data Science - Anthropic Alleges Distillation Theft by Alibaba Qwen Lab
• Cybersecurity Insiders - Anthropic Accuses China Alibaba of Distillation Attack
• TechMoney - Alibaba Sues Pentagon Over Chinese Military Blacklist
• Yahoo Finance - Anthropic accuses Alibaba of mass distillation attack
• SiliconANGLE - Anthropic CEO wants governments to block dangerous AI systems