Anthropic wants Congress to punish Alibaba over 28.8 million Claude queries

Anthropic accused Alibaba this week of copying the parts of Claude that cost the most to build. In a letter to US senators, the lab said operators tied to Alibaba’s Qwen AI team ran 28.8 million Claude exchanges through almost 25,000 fraudulent accounts between April and June. Alibaba hasn’t confirmed any of it.

That’s a serious charge, and it’s also a contested one. So before anyone declares a winner, it helps to understand what “extracting model capabilities” even means, why a company that spends hundreds of millions training a model would treat 25,000 throwaway accounts as a five-alarm fire, and what Anthropic is actually asking Washington to do about it. The short version: this is a fight about a training technique called distillation, and it sits right on the fault line of the US-China AI race.

What Anthropic says happened

Anthropic laid out the allegation in a letter dated June 10 to Senators Tim Scott and Elizabeth Warren, the chair and ranking member of the Senate Banking Committee, ahead of an AI hearing. The company described what it called the largest known distillation attack on Anthropic to date, and accused Alibaba of acting “brazenly” and “illicitly.”

The numbers are specific. Nearly 25,000 fake accounts. Roughly 28.8 million conversations with Claude over about six weeks. According to the letter, the activity zeroed in on Claude’s most valuable functions, software engineering and agentic reasoning, the things that make a frontier model expensive and hard to replicate. Anthropic frames the effort as adversarial distillation: an attempt to rebuild those capabilities at a fraction of the cost by harvesting Claude’s answers at scale.

This is not the first time Anthropic has gone public with this kind of complaint. Back in February, the company said it had caught three “industrial-scale” distillation campaigns from other Chinese labs: DeepSeek with more than 150,000 exchanges, Moonshot AI with over 3.4 million, and MiniMax with more than 13 million. By that yardstick, the Alibaba figure dwarfs all three combined. Whether that scale reflects a bigger operation or just better detection on Anthropic’s side is one of the open questions here.

What distillation actually means

Strip away the jargon and distillation is simple. You take a strong, expensive model, ask it millions of questions, and use its answers as a textbook to train a smaller, cheaper model. The cheap model never sees the original’s code or its trained weights. It just learns to imitate the outputs. Think of it as a student copying a brilliant tutor’s worked examples until the student can fake the same answers. You don’t need the tutor’s brain, only their homework.

Labs do this on purpose with their own models all the time. It is how you ship a fast, small model that behaves a bit like the big flagship. The problem starts when you point the technique at someone else’s model. Most frontier labs, Anthropic included, ban using their API outputs to train a competing model. So the contested part is not the math. It is whether feeding a rival’s chatbot 28.8 million prompts through fake accounts crosses from “clever training trick” into “violating a contract and copying a trade secret.”

That distinction matters because distillation against a competitor is a terms-of-service violation, not a clearly defined crime. There is no settled body of law that says “you may not learn from another model’s outputs.” Anthropic is effectively arguing that the law should catch up, which is why the letter went to Congress and not just to a courtroom.

Why frontier labs fear it

Here is the economics that keeps lab executives up at night. Training a top-tier model can run into the hundreds of millions of dollars in compute, data, and talent. Most of that spend buys you the hard stuff: long-horizon reasoning, reliable coding, the agentic behavior Anthropic just shipped in its newest Claude releases. If a competitor can approximate those behaviors by paying for API calls and harvesting the answers, the cost gap between building a frontier model and copying one collapses.

That’s the real fear. Not that someone reads Claude’s mind, but that the moat, the thing that justifies the spend, turns out to be cheap to climb over. A rival can stay one generation behind at a tiny fraction of the price, forever. For a company whose entire pitch to investors is that frontier capability is hard and defensible, “it distills out through the API” isn’t a PR problem. It’s an existential one.

There is a counterweight worth naming. Distillation only copies what the teacher model can already do. It cannot leapfrog the original or invent capabilities the teacher lacks. Critics of the alarm point out that every lab benefits from learning off everyone else’s published work, and that “we found 25,000 suspicious accounts” is not the same as proving a specific rival model was trained on the harvested data. Anthropic has shown a pattern of access, not yet a smoking-gun training run.

How this fits the China backdrop

Timing is the tell. The letter landed days before a Senate hearing, and it frames a private platform-abuse problem as a national-security one. That is a deliberate move. Anthropic asked lawmakers to penalize foreign firms that extract US model capabilities at scale, seeking a policy response as much as a legal one.

The backdrop is a year of tightening US controls on AI flowing to China, and Chinese capability flowing back. Washington has already been weighing how hard to clamp down on Chinese frontier labs, and the chip side of the same fight runs through export curbs on advanced AI silicon. On June 12, the Commerce Department restricted Anthropic’s own Mythos and Fable models over concerns about military and intelligence use abroad, and Anthropic disabled global access to them. So the same lab is simultaneously a target of export policy and a petitioner asking for more of it. That is not a contradiction so much as a sign of how tangled the AI-IP question has become.

Read with a skeptical eye, the framing is convenient for Anthropic. A terms-of-service dispute with a Chinese competitor becomes a reason for the US government to build a regulatory wall, one that happens to protect Anthropic’s business. That doesn’t make the underlying claim false. It does mean the national-security packaging deserves the same scrutiny as the technical one.

What this means for you

If you build on these APIs, treat this as the moment terms-of-service enforcement gets teeth. Labs are now scanning for distillation patterns, account farms, and bulk harvesting, and false positives will catch legitimate heavy users in the net. Read the output-use clauses in your provider contracts before you fine-tune anything on model responses, even your own provider’s. If you follow the policy side, watch the Senate Banking Committee and Commerce for whether “model extraction” gets written into export or trade rules, because that is the precedent that would outlast this one spat. And keep the hedge in mind: Anthropic has shown scale, Alibaba has stayed silent, and “suspicious access” is not the same as a proven copy. The next real signal is whether Anthropic produces evidence tying the harvested data to a shipped Qwen model, or whether this stays a letter to Congress.