Anthropic Accuses Alibaba of 28.8 Million Claude Queries for Qwen

Anthropic Accuses Alibaba of the Largest Known Distillation Attack on Claude

Anthropic sent a letter to the United States Senate Banking Committee on 10 June 2026, accusing Alibaba and its Qwen AI laboratory of conducting the largest known distillation attack on Anthropic's Claude models to date. The letter, addressed to Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren, remained confidential until Bloomberg reported it on 24 June 2026, with CNBC independently confirming the contents the same day. Between 22 April and 5 June 2026, operators connected to Alibaba ran approximately 25,000 fraudulent accounts and executed 28.8 million exchanges with Claude — behaving in every external respect like ordinary users while systematically probing the model's most valuable capabilities.

What a Distillation Attack Actually Is

A distillation attack is a method of transferring capability from a target AI model into a separate model by harvesting a large volume of input-output pairs at scale. Rather than reproducing the architecture or weights of the target model — which would require access to proprietary systems — the attacker queries the target exactly as an ordinary user would, but with millions of carefully designed prompts to elicit high-quality responses, and then trains a different model on those responses. The resulting model inherits the behaviour and quality of the target without the attacker ever accessing the target's training data or parameters directly. Because the interaction is externally indistinguishable from legitimate API usage, distillation attacks are difficult to detect until they reach a scale that triggers anomaly detection.

Anthropic described the campaign as targeting Claude's most commercially valuable skill clusters: agentic reasoning, software engineering capability, and long-horizon task completion. These are precisely the capabilities that enterprises pay to access through Claude Code, the Anthropic API, and the claude.ai operator tier. Alibaba has not responded publicly to the allegations, and as of the date of writing, the Qwen team has made no comment.

The Scale of the Fraudulent Account Infrastructure

Running 25,000 accounts simultaneously and sustaining 28.8 million exchanges over a six-week period — averaging approximately 6.8 million exchanges per week — required automated pipeline infrastructure capable of generating diverse, high-quality prompts at volume, routing them through a large pool of separate account identities, and capturing and indexing the responses for downstream model training. Anthropic's terms of service prohibit using Claude outputs to train competing models; the fraudulent account infrastructure was designed specifically to conceal the campaign's purpose from standard detection systems.

The six-week duration, from 22 April to 5 June 2026, is also notable. A six-week campaign at that exchange volume points to a coordinated, sustained effort rather than an exploratory probe. The choice of agentic reasoning and software engineering as target capabilities aligns with Qwen's publicly stated development priorities, which have emphasised multi-step task completion and code generation in the models Alibaba has released in 2025 and 2026.

Why Anthropic Went to the Senate Banking Committee

Anthropic's decision to route the complaint to the Senate Banking Committee rather than pursuing purely commercial remedies reflects the political context of AI in mid-2026. The US government has spent the first half of 2026 tightening export controls on frontier AI technology. A coordinated, cross-border campaign to extract Claude's capabilities is directly relevant to Senate discussions about the extent of Chinese access to American AI, and Anthropic's letter positions the distillation attack within that policy debate rather than framing it as a purely commercial dispute between two companies.

The disclosure also fits into the broader trajectory of AI IP and national security concerns in 2026. By escalating to elected officials and publishing the letter via press contacts, Anthropic signalled that it views model distillation attacks as a category of threat serious enough to warrant legislative attention, not only technical countermeasures. This is a meaningful shift from treating API abuse as a product-safety matter handled internally.

What This Means for AI Model Operators and Developers in India

For Indian enterprise teams and software vendors building products on the Claude API, the distillation attack disclosures are a signal about the active threat environment in the AI model economy. Anthropic is investing in detection systems capable of identifying campaigns at the scale and sophistication of the Alibaba operation; teams running legitimate integrations should expect more rigorous usage monitoring as Anthropic hardens its platform in response.

At a practical level, the incident also illustrates the commercial value that frontier AI companies assign to their training pipelines. The capabilities that Alibaba allegedly went to this length to extract — agentic reasoning and long-horizon software engineering — are the same capabilities that make Claude the model of choice for complex enterprise workflows. For Indian product teams deciding which AI vendor to build on in 2026, the disclosure matters in a second way: Anthropic's willingness to name a state-adjacent attacker publicly and escalate to US senators signals that it treats its model capabilities as protected assets and will pursue legal and regulatory avenues to defend them. That posture indicates a company investing in the long-term security of its platform, which is relevant information for teams making multi-year build decisions.

The Bottom Line

Anthropic publicly accused Alibaba of conducting the largest known distillation attack on its Claude models, involving 25,000 fraudulent accounts and 28.8 million exchanges between 22 April and 5 June 2026. The campaign targeted Claude's agentic reasoning, software engineering, and long-horizon task completion capabilities, which Alibaba allegedly used to train its Qwen models. Anthropic disclosed the attack in a letter to the US Senate Banking Committee on 10 June 2026, with the letter becoming public on 24 June. Alibaba has not responded. For Indian teams building on the Claude API, the incident signals tighter usage monitoring ahead and reinforces the case for investing in legitimate, proprietary model access rather than attempting distilled alternatives that Anthropic is actively working to detect and prevent.