Key facts at a glance

• Anthropic has accused Alibaba of using nearly 25,000 fraudulent accounts to extract capabilities from Claude AI models.
• The company described the alleged operation as the largest known attack of its kind against Anthropic.
• The campaign is said to have run from April 22 to June 5 and generated more than 28.8 million exchanges with Claude.
• Anthropic laid out the allegations in a June 10 letter to senior members of the US Senate Banking Committee.
• The alleged effort involved distillation, a technique in which a less capable AI model is trained on the outputs of a more advanced system.
• Anthropic attributed the activity to operators affiliated with Alibaba and Alibaba Qwen, Alibaba’s AI lab.
• Alibaba did not immediately respond to a request for comment.

What Anthropic alleges

Anthropic has accused Alibaba of running a large-scale model-extraction campaign against its Claude AI models, alleging that nearly 25,000 fraudulent accounts were used to pull capabilities from the system. Anthropic described the alleged operation as the largest known attack of its kind against the company, according to a June 10 letter sent to senior members of the US Senate Banking Committee.

The alleged activity took place between April 22 and June 5 and produced more than 28.8 million exchanges with Claude. That volume, if confirmed, would represent far more than routine experimentation or ordinary customer use. It would point to an industrial-style effort to collect model outputs at scale, using many accounts to spread activity and avoid simple detection thresholds.

Anthropic said the campaign involved distillation, a process in which a less capable model is trained on the outputs of a more advanced system. In practice, a developer can collect prompts and responses from a stronger model and use them as training data for a smaller or cheaper model. The goal is often to reproduce some of the stronger system’s behavior without bearing the full cost of developing a frontier model from scratch.

Anthropic attributed the alleged campaign to operators affiliated with Alibaba and Alibaba Qwen, Alibaba’s AI lab. The company did not say that it had conclusively identified individual employees or that Alibaba had acknowledged the activity. Alibaba did not immediately respond to a request for comment, leaving the allegation contested and unresolved.

The dispute is unfolding against a broader backdrop of US-China technology tensions. Anthropic said the alleged campaign could help accelerate China’s ability to reach the capabilities of its advanced Mythos Preview model. US officials have also stepped up scrutiny of advanced AI systems over concerns that they could be used by military or intelligence users in countries of concern.

Why model distillation is drawing scrutiny

Distillation itself is not a new or inherently illicit technique. It has long been used in machine learning to compress large models into smaller ones, reduce inference costs and make AI systems easier to deploy. Many AI developers use distillation internally to create faster or cheaper versions of their own models. The controversy arises when distillation is applied to another company’s model without permission and in violation of contractual terms.

For API providers, the risk is straightforward. A customer can send prompts to a model, collect the responses and use them to train a competing system. If the provider does not detect the pattern, the competitor may capture some of the model’s reasoning style, instruction-following behavior or domain knowledge. The original developer bears the computing cost and safety work, while the alleged copier may gain a shortcut.

That is why AI vendors have become more aggressive about usage monitoring, account verification and rate limits. They must balance abuse detection with the need to keep services available for legitimate enterprise customers. Overly strict controls can frustrate paying users; overly loose controls can open the door to large-scale extraction. The Anthropic-Alibaba allegation illustrates how difficult that balance has become.

An escalating pattern of extraction attempts

The allegation is not the first time Anthropic has raised concerns about model extraction. In February, the company said it had identified similar campaigns by DeepSeek, Moonshot AI and MiniMax to extract capabilities from Claude. Anthropic said the alleged activity ranged from more than 150,000 exchanges by DeepSeek to more than 13 million exchanges by MiniMax.

Viewed together, the incidents suggest that model extraction is becoming a recurring risk rather than an isolated security lapse. Analysts said the pattern points to a broader challenge for AI vendors: as models become more capable and expensive to build, the incentive to copy them grows. The alleged methods may vary, but the underlying logic is similar. A rival can try to capture useful behavior from a leading system without obtaining the underlying model weights or source code.

That distinction matters. Traditional intellectual property theft often involves taking a file, a design or a piece of code. Model extraction is different because it can happen through ordinary API interactions. The stolen asset is not a single document but a pattern of behavior. Detection therefore depends on spotting unusual usage across many accounts, prompts and sessions rather than finding a copied file on a server.

A new supply-chain risk for enterprises

If Anthropic’s claims are true, the alleged campaign could allow Alibaba to build a comparable model in a short period of time and offer it at a much lower cost, said Anand Joshi, an AI analyst at TechInsights. That prospect is unsettling for enterprises that depend on frontier AI systems and assume their vendor’s model will remain differentiated.

Analysts said the alleged campaign also points to a broader pattern beyond the two companies. Model extraction appears to be escalating rather than remaining an isolated risk. “The enterprise supply chain no longer ends at software, APIs, and cloud regions,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. “It now includes rented intelligence, and rented intelligence can be copied and redeployed well outside the safety controls it was born with.”

Gogia said distillation should be a board-level concern because a weaker model trained on a stronger one can inherit its capabilities without the governance and controls around the original system. That creates a new kind of dependency risk. A company may believe it has vetted one AI vendor, only to find that a downstream or competing model has absorbed behavior from that vendor without the same safety testing, auditing or incident-response commitments.

For enterprises, the allegations point to a potentially more serious risk than conventional intellectual property theft: reverse engineering at scale. If proven, they would suggest that AI models can be copied systematically, turning model extraction into a new AI supply-chain risk. The concern is not only that a competitor gains an advantage. It is that cloned or distilled systems may inherit weaknesses, bias or unsafe behavior without the controls that surrounded the original model.

“If a rival can clone the exact brain of the AI your company relies on, they can easily find its blind spots, hack your automated systems, or cause the AI vendor to panic and shut down services that your business needs to run every day,” said Pareekh Jain, CEO of Pareekh Consulting.

What vendors and buyers can do

The allegation raises questions about the controls AI vendors have in place and how customers can protect themselves. “Vendors should provide verified accounts, smart rate limits, abuse detection, usage monitoring, contractual bans on distillation, incident disclosure, and audit rights,” Jain said. “Enterprises should ask how the vendor detects and blocks large-scale model extraction and can demand contracts that guarantee backup plans and financial refunds if the AI service gets attacked or suddenly shut down.”

Joshi said enterprise customers should also press vendors for greater transparency around model development and safeguards. “Enterprise buyers should ask what training data was used, how it was trained, what guardrails exist, how they can audit it, and so on,” Joshi said. “Model publishers will have to come up with watermarking technology in models as well as model responses. So if the model ‘skills’ are stolen, they should be able to find the thief.”

In practice, procurement teams may need to treat AI models less like ordinary software subscriptions and more like strategic infrastructure. That means asking about model provenance, data handling, safety testing and the vendor’s ability to detect coordinated abuse. It also means building contingency plans for service disruption, whether the cause is a security incident, a regulatory action or a commercial dispute.

Contracts can help, but they are not a complete defense. A vendor can prohibit distillation in its terms of service, yet enforcement depends on detection. An enterprise can demand audit rights, but audits may not reveal activity that occurred across thousands of fake accounts. The strongest safeguards combine technical controls, contractual obligations and independent verification.

Geopolitical and market context

The dispute also lands in the middle of a wider debate about AI competition and national security. US officials have become more vocal about the risks of advanced AI falling into the hands of military or intelligence users in countries of concern. AI developers, meanwhile, are under pressure to show that they can prevent misuse while still serving global customers.

For AI vendors, the commercial stakes are high. Accusations of model extraction can damage trust with enterprise customers and regulators. They can also intensify calls for tighter export controls, API restrictions or mandatory safety testing. For customers, the lesson is that model quality is only one part of vendor risk. Resilience, transparency and security controls matter just as much.

The alleged campaign also highlights how quickly AI competition can shift from building models to protecting them. As more companies rely on generative AI for customer service, software development, analytics and internal operations, the integrity of the underlying model becomes an operational concern. A disruption or a security failure is no longer just an IT issue. It can affect revenue, compliance and customer trust.

What remains unresolved

Anthropic’s allegations remain unproven in public. The company has described the scale and method of the alleged campaign, but it has not presented a full public evidence trail. Alibaba has not responded publicly, and independent verification would require access to account records, usage logs and technical analysis that are not available to outside observers.

What is clear is that the incident has widened the debate over how AI models should be protected and how enterprises should assess the risks of depending on them. The outcome may shape how vendors design abuse detection, how contracts allocate responsibility and how regulators approach model extraction. As of publication, Alibaba had not immediately responded to a request for comment.

Source:InfoWorld News