Anthropic accused operators linked to Alibaba and its AI lab of generating 28.8 million Claude interactions through roughly 25,000 fraudulent accounts between April 22 and June 5, according to a letter Anthropic sent to senators. It’s the largest known model distillation campaign against Claude to date.
The scale dwarfs everything before it. In February, Anthropic identified three Chinese labs: DeepSeek, Moonshot AI, and MiniMax that collectively generated more than 16 million Claude interactions through roughly 24,000 fraudulent accounts. The Alibaba campaign surpassed that combined total in six weeks.
Model distillation sends carefully designed prompts to a target model, captures its responses as training data, then trains a smaller model to mimic the original. Think of it as copying every answer from the smartest student in class, at industrial scale. Detection is hard: a distillation query looks identical to a legitimate API call. The only signals are pattern: massive volume, repetitive structures, hundreds of coordinated accounts firing in sequence.
That’s the real cost for founders building on Claude or any commercial API. Anthropic’s Head of Policy Sarah Heck told senators the attacks were “carried out illicitly, systematically, and at industrial scale to harvest U.S. AI capabilities across frontier labs and repackage them as their own without incurring the training and R&D costs.” If adversarial distillation becomes routine, every API call is a potential intelligence transfer. Access controls start costing as much as training.
There’s a safety dimension beyond the commercial one. Distillation copies reasoning patterns but not safety guardrails. The months Anthropic spent making Claude refuse harmful requests don’t transfer to the copy. Dangerous capabilities do.
Senators Bill Hagerty and Andy Kim are pushing an amendment to defense legislation to blacklist or sanction entities running such campaigns. Alibaba hasn’t commented.
Nathan Zakhary