Anthropic Accused Alibaba of 28.8 Million Fraudulent Claude Queries

Anthropic told the Senate Banking Committee that operators linked to Alibaba and its Qwen AI lab ran the largest known distillation attack in frontier AI history — 28.8 million exchanges with Claude through roughly 25,000 fraudulent accounts between April 22 and June 5. The campaign targeted the capabilities that make Claude worth buying: agentic reasoning, software engineering, and long-horizon decision-making. Washington spent the same month shutting Anthropic's own models off worldwide. The thief kept querying.

The scale: Distillation is simple in theory — feed a frontier model crafted prompts, collect the answers, train a cheaper rival on the output. Illicit when done at industrial scale against a competitor's terms of service. In February, Anthropic documented three separate Chinese lab campaigns — DeepSeek, Moonshot, and MiniMax — that together generated 16 million exchanges through 24,000 fake accounts. The Alibaba operation alone exceeded that total.

• 28.8 million exchanges with Claude, per Anthropic's June 10 letter to Sens. Tim Scott and Elizabeth Warren
• ~25,000 fraudulent accounts, April 22–June 5
• Targets: software engineering, agentic reasoning, complex multi-step tasks
• Attribution: operators affiliated with Alibaba and Alibaba Qwen

Bloomberg first reported the letter; CNBC and the BBC confirmed it on June 24–25. Alibaba did not respond to comment requests.

The policy backdrop: Two months earlier, White House OSTP Director Michael Kratsios issued NSTM-4 — the administration's first formal memo naming "adversarial distillation" of American frontier models a national security threat. The memo warned that foreign actors were running "deliberate, industrial-scale campaigns" using "tens of thousands of proxies." Anthropic's letter says Alibaba proceeded anyway — that the campaign "ignored the Trump Administration's warnings."

The timing is not subtle. The distillation window overlapped with Washington's export-control crackdown on Anthropic itself. Commerce Secretary Howard Lutnick's June 12 directive forced Fable 5 and Mythos 5 offline globally — nominally to block foreign access to frontier cyber capabilities. Meanwhile, per Anthropic, a NYSE-listed Chinese conglomerate was extracting those same capabilities through the API front door.

Why it matters beyond IP:

• Safety stripping. Anthropic's February research warned that illicitly distilled models "lack necessary safeguards" — reasoning without the alignment work that took years to build.
• Export-control bypass. Chip restrictions limit who can train at scale; distillation lets rivals harvest what American labs already built, at a fraction of the cost.
• Market signal. Reporting linked the allegations to a same-day slide in Alibaba ADRs — on top of the Pentagon's June 8 designation of Alibaba as a Chinese military-linked company, which the firm is now suing to overturn.

What Anthropic wants: Penalties for industrial-scale distillation. Antitrust clarity so U.S. labs can share attack intelligence without collusion risk. Continued chip export controls. Senators Bill Hagerty and Andy Kim are reportedly preparing a defense-bill amendment to sanction Chinese labs caught distilling American models; a parallel House measure from Reps. Bill Huizenga and Sydney Kamlager-Dove is in committee.

The quote that frames it: In its letter, Anthropic wrote that "distillation attacks turn hundreds of billions of dollars in American investment and R&D into a massive subsidy for our geopolitical competitors." Kratsios framed the same threat in April: "There is nothing innovative about systematically extracting and copying the innovations of American industry."

The awkward mirror: Anthropic is simultaneously the lab Washington dimmed and the lab asking Congress to punish the lab that allegedly copied it. Both fights are about the same question — who controls access to frontier capability — but the enforcement tools point in opposite directions. Export orders shut down models for everyone. Distillation lets adversaries keep learning from them until someone catches the pattern.

Convina's view: The API is the unguarded border of the AI economy. Washington proved it can kill-switch a deployed frontier model in a single evening; it has not yet proved it can stop 25,000 proxy accounts from vacuuming that model's outputs for six weeks. Until distillation defense matches export-control aggression, every American frontier lab is subsidizing its rivals one query at a time — and the labs asking for protection are the same ones whose products stay offline while the copying continues.