Anthropic Says Alibaba Ran the Biggest Copy Job It's Caught on Claude. Alibaba Denies It.

Anthropic has told the U.S. Senate that Alibaba ran the largest model copying campaign it has ever caught. The accusation arrives in a letter, not a lawsuit, and the numbers are Anthropic's own. Alibaba says it did nothing of the kind.

The short version: in a June 10 letter to the Senate Banking, Housing, and Urban Affairs Committee, addressed to Chairman Tim Scott and Ranking Member Elizabeth Warren, Anthropic alleged that operators tied to Alibaba and its Qwen AI lab ran more than 28.8 million exchanges through Claude between April 22 and June 5, using close to 25,000 accounts that Anthropic says were fraudulent. Anthropic calls it the largest known distillation attack against its models. Alibaba denies it.

What distillation actually is

Distillation is a training shortcut. You take a strong model, feed it a large number of prompts, collect its answers, and use those answers as training data for a smaller or newer model. The student model learns to imitate the teacher's outputs without anyone needing to know how the teacher was built. It is a normal, well understood technique. Labs distill their own big models into cheaper ones all the time. The original DistilBERT paper that popularized the term is from 2019.

The thing that turns a routine method into an accusation is whose model you point it at, and whether you were allowed to. Anthropic's terms of service forbid using Claude's output to train a competing model. So the claim here is not that distillation happened in some abstract sense. It is that someone working on behalf of a direct competitor pulled tens of millions of answers out of Claude through accounts created to look like ordinary users, specifically to skip the cost of training a frontier model from scratch.

Anthropic says the campaign went after Claude's most expensive capabilities to build: agentic reasoning, software engineering, and long horizon planning. Those are exactly the areas where a cheaper imitator would save the most money by copying instead of training.

What's actually proven, and what isn't

This is where it pays to slow down. Everything above is an allegation in a letter to a Senate committee. Anthropic has not published the underlying methodology, the account list, or whatever it used to attribute roughly 25,000 accounts to Alibaba and Qwen rather than to the general internet. "Affiliated with Alibaba" is doing a lot of work in that sentence, and Anthropic has not shown publicly how it drew the line.

The 28.8 million number is Anthropic's count of exchanges from accounts it flagged. It is a real measurement of activity on Anthropic's own platform. It is not, by itself, proof of who was on the other end or what they did with the results. A company can know that a cluster of accounts looks coordinated and inorganic without being able to prove in court that a specific competitor directed it. Anthropic is asking Congress to act on the first kind of certainty. That is worth keeping in view.

Anthropic quoted itself to the committee on why it found the alleged behavior galling: "Beyond its scale, this campaign was striking for its brazen nature. Alibaba is listed on the New York Stock Exchange, maintains business operations in the United States, and is accountable to U.S. investors and regulators."

The letter is also a policy ask

A letter to the Senate Banking Committee is not a neutral incident report. It is lobbying, and Anthropic was specific about what it wants. The company asked lawmakers to expand intelligence sharing between frontier AI developers and the government, clarify antitrust rules so AI companies can swap information about distillation campaigns without tripping over collusion law, strengthen export controls on advanced chips and compute, close loopholes that let Chinese firms rent overseas data center capacity, and impose penalties on companies caught running large scale extraction.

Several of those would help Anthropic directly. Tighter export controls and penalties on foreign copiers protect the value of the exact thing Anthropic sells. That does not make the underlying concern wrong. It does mean the letter is making a business case and a national security case at the same time, and the second is easier to say out loud.

Anthropic framed the stakes in national security terms: "When PRC labs distill these capabilities from U.S. models, they capture the returns on American investments without bearing the costs or risks associated with training frontier AI models. This inverts the economic logic that underwrites American AI leadership, turning billions of dollars' worth of research and development, compute, and other U.S. investments into a subsidy for our competitors."

An Anthropic spokesperson declined to comment on the letter specifically but told Decrypt the company believes "combating the threat of illicit distillation requires coordinated action between government and industry."

Alibaba's side

Alibaba has flatly denied it. The company says it does not train its models on the outputs of other companies' proprietary models and that its AI work complies with applicable intellectual property law. As of this writing it has not released a detailed technical rebuttal, which is unsurprising. You cannot easily disprove a claim about 25,000 accounts you say were never yours.

This is a sequel

Anthropic made a smaller version of this argument in February, when it claimed that DeepSeek, Moonshot AI, and MiniMax had together run more than 16 million Claude exchanges through about 24,000 fraudulent accounts. That round drew open mockery from people who pointed out that AI companies lean on distillation constantly, including against each other. In April, Elon Musk testified in federal court that xAI had "partly" used OpenAI models while training Grok. The technique is everywhere.

Anthropic's answer to the hypocrisy charge is a line about consent. Distilling your own model is fine. Distilling a model you are allowed to use, under terms that permit it, is fine. Pulling capabilities out of a competitor's frontier model through accounts built to evade detection, in violation of that competitor's terms, is the part Anthropic says is different. Whether that distinction holds up depends entirely on evidence Anthropic has shown Congress but not the rest of us.

The honest summary is narrow. A U.S. AI company has accused a publicly traded Chinese rival of industrial scale copying, put real numbers on it, and asked Congress for trade and antitrust relief in the same breath. The rival denies it. The data that would settle it is sitting inside Anthropic, and so far it is staying there.