Anthropic accuses Alibaba of extracting Claude's capabilities through 28.8 million queries using a standard AI training technique called distillation.
Anthropic says Alibaba's operators ran the largest known distillation campaign against its Claude model, with about 28.8 million exchanges through roughly 25,000 fraudulent accounts between April 22 and June 5, 2026. The company laid out the allegation in a June 10 letter to Sens. Tim Scott and Elizabeth Warren and in a public post describing how it detected and disrupted the operation.
What Anthropic calls "illicit extraction" is, in machine-learning vocabulary, distillation: training or aligning a smaller "student" model on the outputs of a stronger "teacher." It comes in two flavors that matter for this dispute. The first is black-box question-and-answer distillation, where an adversary scrapes raw responses from the teacher and tries to mimic them. That approach is genuinely noisy and produces weak results. The second is targeted distillation, sometimes called RLAIF-style fine-tuning, where the teacher is used to generate preference signals or training data for another model. That approach is far more effective, and it is also the standard way thousands of commercial AI teams fine-tune their own models every day. Anthropic says the operators it traced went after agentic reasoning, tool use, software engineering, and longer-horizon task handling, the capabilities that are most expensive to build from scratch and therefore most worth copying.
That is where the framing fight starts. Wire headlines, including those from Reuters, the BBC, and CNBC, have largely echoed Anthropic's "attack" and "illicit extraction" language, often without scare quotes. Anthropic's own characterization of the incident, "a major adversarial distillation campaign," sits awkwardly next to the company's public position that individual jailbreaks of its own model are not dangerous. A technically literate reader can hold both of those positions at once. Targeted distillation at industrial scale is a different threat than a single user talking a chatbot past its guardrails. But it is fair to ask why one is treated as a national-security subsidy of a competitor and the other as a research curiosity, especially when the technique itself is not new.
The label matters because of when it was applied. The campaign Anthropic describes ran in April and May 2026, after a White House Office of Science and Technology Policy memo in April pledged federal help detecting and coordinating against industrial-scale distillation. Anthropic's public post explicitly frames the timing as a test of that warning. On Capitol Hill, Sens. Bill Hagerty and Andy Kim are preparing an amendment to must-pass defense legislation that would blacklist or sanction Chinese firms found improperly using US AI model outputs. The Reuters report describes the amendment as forthcoming, not yet scheduled for a vote, and frames the Alibaba accusation as the kind of case it is built to address.
Alibaba's position complicates the picture. The company was recently added to the Pentagon's list of Chinese military-linked firms and is suing the Pentagon over the designation; it denies military affiliation. Alibaba did not immediately respond to a Reuters request for comment on Anthropic's specific allegations. That silence is not a denial, and any read of Alibaba's position would need Alibaba's own statement or a follow-up wire.
Anthropic says the Alibaba operation is its fourth public attribution of industrial-scale distillation against a major Chinese AI lab. The earlier named labs, DeepSeek, Moonshot, and MiniMax, were disclosed in earlier posts; the MiniMax case involved about 13 million exchanges, roughly half the scale Anthropic now attributes to Alibaba. Reporting on the earlier cases has not produced evidence the named labs acknowledged the activity.
What to watch: whether the Hagerty-Kim amendment reaches the Senate floor in this Congress, whether the White House OSTP memo grows into formal coordination with frontier labs on distillation detection, and whether Anthropic's framing becomes the default public vocabulary for this category of incident. The next move that would clarify the technical dispute, not just the political one, is a detailed public replication of what Anthropic's detection actually saw: the IP correlation, request metadata, and infrastructure indicators the company says it used. Until that lands, the reader is being asked to weigh a contested label in a window where the label itself has policy consequences.