Anthropic Accuses Alibaba of Stealing Claude's Intelligence With 25,000 Fake Accounts

28.8 Million Messages, 25,000 Fake Accounts

Between April 22 and June 5, 2026, Anthropic's systems were quietly under siege. Thousands of accounts — now identified as fraudulent — were methodically querying Claude, asking it to reason through complex software engineering problems and agentic tasks, then collecting its outputs. When Anthropic investigated, they traced the operation directly to operators linked to Alibaba's Qwen AI lab.

The tally: 28.8 million exchanges across roughly 25,000 fraudulent accounts, making it what Anthropic now calls the largest known data-extraction campaign by a Chinese entity against a U.S. AI company.

What "Adversarial Distillation" Actually Means

The technique is called adversarial distillation: instead of training a model from scratch or licensing one's competitors' work, you repeatedly prompt a frontier model and harvest its outputs. The goal is to teach your own model to mimic the reasoning patterns of the target — in this case, Claude's most commercially valuable capabilities in software engineering and multi-step agentic tasks.

It's not a new idea, but Alibaba's alleged operation was unusual in its sheer scale and the brazenness of circumventing Anthropic's geographic restrictions, which explicitly prohibit access from within China.

Anthropic Goes Public — and Political

Rather than simply blocking the accounts and moving on, Anthropic took its findings to U.S. senators and White House officials, sending a formal letter disclosing the scope of the campaign. The move signals that Anthropic is treating this not just as a terms-of-service violation but as a national security concern worth escalating.

The timing is significant. The incident occurred during the same period that the Trump administration's AI Executive Order was under discussion, and AI policy debates about frontier model access and Chinese competition were already running hot in Washington.

As of this writing, Alibaba has not issued a public response. The company's Qwen AI lab continues to develop competitive open-weight models, and Anthropic's Bloomberg disclosure is the only detailed account currently available.

Why This Matters Beyond Anthropic

The bigger issue is what this episode reveals about AI's competitive dynamics. Distillation attacks are difficult to defend against without degrading the model for legitimate users — you can't simply refuse to answer hard questions. Detection requires behavioral analysis at scale, and by the time patterns emerge, substantial capability has already been extracted.

For the AI industry broadly, this is a signal that frontier reasoning capability is worth stealing at enormous operational scale — and that companies holding it need to treat security not just as an infrastructure problem but as an intelligence problem.

Anthropic detected it, blocked it, and went public. That's the right response. What happens next — in courts, in Congress, or in future models — will be worth watching closely.