Anthropic Accuses Alibaba's Qwen Lab of the Largest AI Distillation Attack on Record

The Allegation

Anthropic has accused operators affiliated with Alibaba's Qwen AI lab of running what it describes as the largest known distillation attack against its Claude models. In a letter sent to US senators and White House officials, Anthropic alleged that the operators used approximately 25,000 fraudulent accounts to generate roughly 28.8 million interactions with Claude between April 22 and June 5, 2026.

What a Distillation Attack Actually Is

Distillation is a legitimate machine learning technique where a smaller "student" model is trained to mimic the outputs of a larger "teacher" model, often used by the same company to make its own models cheaper to run. It becomes a distillation attack when a third party systematically queries someone else's proprietary model at scale, without authorization, specifically to harvest training data for a competing system. Anthropic's filing alleges the campaign targeted Claude's capabilities in software engineering and agentic reasoning, two of the areas AI labs currently compete on most fiercely.

Not the First Accusation, But the Biggest

This isn't Anthropic's first public accusation of this kind. The company previously disclosed distillation attempts in February 2026 linked to other Chinese AI labs, including DeepSeek, Moonshot, and MiniMax. The Alibaba allegation marks a significant escalation, both in the scale described, 28.8 million interactions dwarfs the previously disclosed cases, and in the prominence of the company being accused. Alibaba's Qwen models are among the most widely used open-weight model families globally, and a finding of large-scale unauthorized distillation from a frontier US lab would be a serious allegation with real competitive and diplomatic stakes.

The Regulatory Aftershock

Two days after Anthropic's letter was sent, the US Commerce Department imposed strict export control restrictions on Anthropic's own Mythos and Fable AI models, a development that underscores how intertwined AI competition, national security policy, and US-China tech tensions have become. Whether that timing reflects a direct response to Anthropic's allegations or a coincidental policy move remains unclear.

What's Unresolved

Alibaba has not issued a detailed public rebuttal addressing Anthropic's specific figures, and as with prior distillation accusations in this fast-moving AI rivalry, the claims rest on Anthropic's own usage-pattern analysis rather than an independent third-party audit. Readers should treat the 25,000-account and 28.8-million-interaction figures as Anthropic's own allegations pending any further verification or response from Alibaba.

What Model Distillation Is and Why It Matters

Model distillation is a legitimate and widely used technique in AI development. It involves training a smaller, faster model to mimic the behaviour of a larger, more capable "teacher" model by using the teacher's outputs as training targets. In legitimate use, a company trains a smaller model on its own larger model's outputs to create a cheaper, faster version for deployment.

The accusation Anthropic is making is that Alibaba's Qwen team used Claude as a teacher model without Anthropic's permission — systematically generating outputs from Claude across a broad range of tasks, then using those outputs to train Qwen to replicate Claude's reasoning style and capabilities. This would be a terms-of-service violation (Anthropic prohibits using Claude outputs to train competing models) and potentially a copyright issue, though the latter is legally unsettled.

Why the Evidence Matters

Anthropic's evidence — the 25,000 accounts and 28.8 million interactions — comes from its own usage monitoring systems. The company identified unusual query patterns consistent with systematic extraction rather than normal user behaviour: highly structured prompts across a very wide range of topics, sent at machine-speed cadences, from accounts with suspicious registration patterns.

Independent verification is difficult without access to Anthropic's internal data or Alibaba's training pipeline. Alibaba has denied the allegations. The case highlights a broader problem in the AI industry: detecting unauthorised distillation is technically possible (the signatures are identifiable in API logs) but proving intent and causation is harder.

What the Industry Precedent Would Be

If Anthropic pursues legal action and succeeds, it would establish that model distillation using a competitor's commercially deployed model without permission is actionable — even when the outputs themselves are generated legitimately (the user pays for API access). This would have significant implications for open-source AI development, where distillation from frontier models is widespread and mostly uncontested.