Anthropic says Alibaba illicitly distilled Claude AI model capabilities

Anthropic has accused the Chinese firm Alibaba of launching the largest attack yet attempting to clone Claude, as China races to match the capabilities of Anthropic’s leading model following Mythos’ release and subsequent restriction from foreign markets.

Reporters obtained a June 10 letter sent to Senators Tim Scott (R-SC) and Elizabeth Warren (D-Mass.) one day ahead of a Senate committee hearing on “AI and the American Dream.” In the letter, Anthropic shared “new, confidential evidence of the largest campaign to illicitly extract Claude’s capabilities we have ever measured.”

The attacks occurred between April 22 and June 5, when “operators affiliated with Alibaba and Alibaba Qwen, Alibaba’s AI lab” allegedly generated “more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts,” Anthropic said. Violating Claude’s terms of service and access restrictions, this campaign “targeted some of Claude’s most valuable capabilities, such as agentic reasoning, software engineering, and long-horizon tasks.”

According to Anthropic, Alibaba evaded detection by “using obfuscation techniques and proxy networks.” As Chinese demand for reliable obfuscation techniques increases, Anthropic warned there’s already “a growing circumvention economy” to fuel an ever-expanding web of future distillation attacks.

Like other Chinese labs attempting to copy US frontier models, Alibaba’s aim, Anthropic alleged, was to extract Claude’s capabilities “without incurring the training and R&D costs required to train” their own frontier model. These attacks have become “widespread” and “turn hundreds of billions of dollars in American investment and R&D into a massive subsidy for our geopolitical competitors,” Anthropic said.

Importantly, Anthropic said, the Alibaba campaign occurred after Donald Trump took steps to curb such illicit distillation attacks and defend US national security. In April, Trump accused China of “industrial-scale” AI theft after Anthropic accused Chinese firms DeepSeek, Moonshot, and MiniMax of using the same tactic as Alibaba allegedly used to generate “over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts.”

OpenAI and Google have published findings on similar attacks on their models, Anthropic said. Anthropic accused Alibaba of “brazenly” racing to make a copycat Claude, seemingly unfazed by Trump’s threats to crack down on foreign efforts to copy US frontier models despite depending on US investors.

“Alibaba is listed on the New York Stock Exchange, maintains business operations in the United States, and is accountable to US investors and regulators,” Anthropic’s letter noted, “yet this activity unfolded in the weeks after” Trump’s memo warned that cloning attempts were “unacceptable.”

Alibaba is already preparing to clash with Trump, though. In a lawsuit filed Tuesday, Alibaba accused the Trump administration of blacklisting the company after falsely linking the company to the Chinese military, Reuters reported. Alibaba is seeking to remove the Trump designation, which they claimed has “no basis in fact or law.”

“Alibaba is governed by an independent board, none of whom has any military affiliation,” Alibaba said. “Its products and services are built for retail, logistics, and enterprise information technology - not weapons, defence, or intelligence.”

AI and The Future of Cyber Defence 2030, a keynote by futurist Matthew Griffin

Anthropic appears unconvinced, however, that Alibaba isn’t working with the Chinese government. In the letter, Anthropic warned that without stronger interventions, these distillation attacks will “help China reach Mythos Preview-level capabilities sooner.”

To keep the US ahead of China, Anthropic recommended that Congress pass legislation with three objectives. First, antitrust laws must be updated to allow AI firms to share information about evolving Chinese tactics to deter more threats.

Second, the US needs more export controls on chips to hamstring Chinese access to advanced compute so that they simply can’t train on US model outputs. That could make conducting distillation attacks pointless, Anthropic suggested.

Finally, Congress should pass laws penalising Chinese labs’ “bad behaviour” so that it’s “more difficult and costly” to rely on distillation attacks to advance Chinese models. Penalties could include limiting Chinese firms from accessing US models or advanced US chips or from relying on data centres outside of China, Anthropic suggested.

Anthropic declined to clarify whether Alibaba’s alleged attacks were significant enough to help meaningfully accelerate China’s AI capabilities or comment on any specific steps taken to thwart the attacks. Instead, a spokesperson provided a statement to Ars, echoing sentiments expressed in the letter to senators.

“We believe combating the threat of illicit distillation requires coordinated action between government and industry, and we will continue working with Congress and the Administration to maintain American AI leadership,” Anthropic said.

Anthropic’s letter positions the AI firm as intent on helping the US hold the line so that China cannot surpass US capabilities.

If that happened, Anthropic warned that China could blindside a defenseless US - suddenly possessing “advanced cyber capabilities to deploy against the US government and American companies and exploit vulnerabilities faster than previously possible.”

It’s important to keep the US as far ahead as possible, Anthropic’s letter said, because “the larger the capability gap,” the “more time the US government will have to harden cyber defences and adopt AI systems across national security domains” as China’s AI advances.

Additionally, Anthropic warned that if the US ignores distillation attacks, China could release advanced AI models “with weak safeguards that are easily jailbroken, enabling other US adversaries to use these models for a wide range of activities that run contrary to US interests.”

Alibaba’s models have been downloaded more than 700 million times and are at the frontier of China’s AI industry. The official newspaper of the Central Committee of the Communist Party of China (CPC), People’s Daily, recently hyped Alibaba’s Qwen family of AI models as “the most popular open-source AI system worldwide.”

The AI firm will likely maintain a defensive posture as US scrutiny escalates, but the company risks hobbling its business the longer its US fights endure. Alibaba’s stock dropped 3 percent after Anthropic’s accusations became public, Yahoo Finance reported.

Anthropic’s suspicions that China is racing to build models to match Claude’s capabilities have been confirmed by at least one major Chinese tech founder. At a cybersecurity conference in Beijing yesterday, 360 Security Technology founder Zhou Hongyi likened Anthropic’s Mythos to a “cyber nuclear weapon,” the South China Morning Post reported.

Zhou told the audience that Mythos’ sudden giant leap in its ability to find cyber security vulnerabilities was a “terrifying change” that had effectively “democratised” cyberattacks, SCMP reported.

For China, having no access to Mythos was a significant disadvantage, Zhou said. He bemoaned that Project Glasswing which granted more than 40 US organisations access to Mythos Preview, to strengthen cyber defences, excluded China.

“This means US organisations can use Mythos to scan your vulnerabilities, but you don’t even have the qualification to catch a glimpse of Mythos,” Zhou said.

China’s only way forward is to create its own Mythos-like model, Zhou said, warning that such a “game-changing weapon in cyber warfare” cannot “be held solely in the hands of others.”

According to Zhou, China must race to copy Mythos’ capabilities so that there’s mutually assured destruction should its rival attempt to seize gains using its advanced AI.

SCMP noted that “Zhou’s remarks marked the first time a prominent Chinese technology founder has publicly warned about the strategic risks posed by the US frontier AI model.”

Right now, Zhou said that Chinese firms are “well short of Mythos-level capabilities,” SCMP reported. He then positioned his own company as developing a solution, which focuses “on AI agent systems that combined existing foundation models with specialist security data sets and vulnerability knowledge bases,” instead of “trying to match the US in frontier model capability and computing power.”

First published on Fanatical Futurist on 24 June 2026.

311 Intelligence

What this means

Analysis by the 311 Strategic Intelligence Unit

The big shift is that access to a frontier AI model is now a national security asset. Anthropic says Alibaba-linked operators used almost 25,000 fraudulent accounts to pull Claude's most valuable skills, and it wants Congress to respond with antitrust changes, chip export controls and penalties. Our Starburst data shows why copying is so tempting: we rate AI Model Distillation, training a smaller or cheaper model on the outputs of a bigger one, an Act now technology that already reached wide use in 2025. We also track Technological Decoupling as a Prepare trend, with wide use by 2028.

What it means by sector.

• AI labs and cloud providers: Anthropic, OpenAI and Google have all published findings on similar attacks. Expect tighter account checks, more monitoring and more information sharing between rivals if antitrust rules change.
• Government and defence: Anthropic argues the larger the capability gap, the more time the US has to harden cyber defences. We track Extraterritorial Export Controls as a Prepare trend, and chip controls are at the centre of Anthropic's plan.
• Every organisation: Zhou Hongyi says Mythos has democratised cyberattacks. We track AI Cyberattacks as a Prepare trend, and Shrinking Patch Window, attackers exploiting flaws faster than they can be patched, as an Act now trend that already reached wide use in 2025.

What to do now.

• If you offer AI models or APIs, watch for mass sign-ups, proxy traffic and unusual query patterns that point to distillation.
• Review where you use Chinese open-source models such as Qwen, and how US scrutiny of Alibaba could affect that supply.
• Shorten your patch cycles now: AI that finds vulnerabilities faster is already in the hands of some organisations.

The Starburst technologies behind this story

From the 311 Technology Starburst (first product, expected wide use and readiness):

Technology	Category	First product	Wide use	Action	TRL
AI Model Distillation	Intelligence	2019	2025	Act now	9
Large Language Models	Intelligence	2020	2024	Act now	9
Agentic Artificial Intelligence	Intelligence	2024	2028	Prepare	8
Robo-Hackers	Security	2018	2032	Explore	7

And the trends they feed, from the 311 Trends Starburst:

Trend	Wide use	Action
Technological Decoupling	2028	Prepare
Extraterritorial Export Controls	2028	Prepare
AI Cyberattacks	2028	Prepare
Shrinking Patch Window	2025	Act now

How this moves the trend

Copying AI models is not new. In 2020 researchers showed that stealing an AI is ridiculously easy. In January 2025 China's DeepSeek tanked US stocks by over $1 trillion with a cheap rival model. Then in April 2026 Anthropic's Mythos found security problems in every major operating system and browser. The Alibaba case shows copying frontier AI has moved from a research curiosity to industrial scale.

Go deeper with 311

• The 311 Starburst Centre: every technology and trend above, with timelines and readiness.
• 311 Vantage: ask what AI model theft means for your organisation and get a plain English executive brief.
• The Exponential Technology Codex and the Annual Trends Codex: the technologies and trends reshaping every industry.
• Book a briefing or keynote on the future of AI and cyber security for your board or leadership team.