Anthropic says Alibaba ran 28.8M exchanges to clone Claude

Anthropic says operators affiliated with Alibaba generated more than 28.8 million exchanges with its Claude model through almost 25,000 fraudulent accounts between April 22 and June 5, the company told U.S. senators. The allegation, disclosed in a June 10 letter shared ahead of a Senate committee hearing on “AI and the American Dream,” calls the campaign the "largest campaign to illicitly extract Claude’s capabilities we have ever measured."

What exactly did Anthropic say happened?

Anthropic said the campaign, which it tied to Alibaba and Alibaba Qwen, violated Claude’s terms of service and targeted the model’s agentic reasoning, software engineering, and long-horizon task capabilities. The company said operators produced more than 28.8 million exchanges with Claude via almost 25,000 fraudulent accounts during the April 22 to June 5 window. Anthropic framed the activity as an attempt to extract Claude’s capabilities "without incurring the training and R&D costs required to train" a frontier model.

Anthropic also warned the campaign used obfuscation techniques and proxy networks to evade detection and that similar tactics have been used against other U.S. models. The letter links this activity to an emerging "circumvention economy" that could fuel future distillation attacks.

How did Anthropic place this in the wider U.S.-China AI context?

Anthropic pointed out the alleged campaign occurred after U.S. actions meant to curb such attacks, including an April memo from the U.S. government that called cloning attempts "unacceptable." The company contrasted the Alibaba activity with prior incidents, noting a separate campaign it blamed on Chinese firms DeepSeek, Moonshot, and MiniMax that produced "over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts." OpenAI and Google have published similar findings on attacks against their models, Anthropic said.

Anthropic argued these distillation attacks effectively turn U.S. investment and R&D into a subsidy for geopolitical competitors. It recommended Congress update antitrust laws so AI firms can share evolving tactics, expand export controls on chips to limit compute access, and pass penalties that would make it "more difficult and costly" for Chinese labs to rely on distillation attacks. The company did not specify whether the Alibaba campaign materially accelerated China’s capabilities.

Why it matters

Anthropic warned that successful distillation at scale could help China reach "Mythos Preview-level capabilities sooner," which the company said would reduce the time the U.S. has to harden defenses and deploy AI across national security domains. The letter framed the risk in operational terms: faster access to advanced capabilities could enable adversaries to find and exploit vulnerabilities in U.S. systems and release models with weak safeguards that are easily jailbroken.

The stakes are already political and commercial. Alibaba’s models have been downloaded more than 700 million times, and the official People’s Daily recently called Alibaba’s Qwen family "the most popular open-source AI system worldwide." After Anthropic’s accusations became public, Alibaba’s stock fell 3 percent, Yahoo Finance reported.

What to watch

Look for congressional action: Anthropic has urged new laws covering information sharing, export controls, and penalties for illicit distillation. Also watch any formal responses from Alibaba and legal moves: Reuters noted Alibaba filed a lawsuit challenging a U.S. designation it said linked the company to the Chinese military. Finally, monitor whether other AI firms publish corroborating forensic details or quantify how much model performance can be extracted via distillation campaigns.