Anthropic’s letter, dated June 10 and sent to Senator Tim Scott and Senator Elizabeth Warren, lays out a precise sequence of events. Between April 22 and June 5, 2026, nearly 25,000 fraudulent accounts generated 28.8 million exchanges with Claude.
The attacks were not random. Anthropic claims they were tightly focused on Claude‘s most valuable commercial features: software engineering capabilities and agentic reasoning — the ability to plan multi-step tasks and execute them autonomously. The method is what Anthropic calls “adversarial distillation”: using a stronger model’s outputs to train a less capable one, effectively copying reasoning patterns without paying for the underlying research and development.
Anthropic said the campaign was conducted by operators affiliated with Alibaba and Alibaba Qwen, its AI lab. Alibaba has not publicly responded.
The Familiar Pattern
Anthropic has used this playbook before. In February, the company publicly accused DeepSeek, Moonshot AI, and MiniMax of similar industrial-scale extraction campaigns. DeepSeek‘s operation involved over 150,000 exchanges, while MiniMax was over 13 million.
This is the escalation. 28.8 million exchanges — more than double the previous largest identified campaign — suggests the practice is not diminishing. Anthropic has now identified multiple such campaigns, all targeting its most advanced models, all using the same playbook: thousands of accounts, massive query volumes, and a narrow focus on the capabilities that cost the most to develop.
The Distillation Dilemma
Model distillation is not illegal. It is a standard machine learning technique — training a smaller model on a larger one’s outputs — and it is widely used across the AI industry. Anthropic itself has acknowledged distilling its own earlier models to produce smaller, cheaper versions.
The legal boundary is not about the technique. It is about the scale and the intent. Using thousands of fraudulent accounts to generate tens of millions of queries, targeting a competitor‘s most valuable capabilities, and using the outputs to train a competing product — that crosses a line. But the line is still blurry. Anthropic’s letter explicitly asks the U.S. government to help clarify antitrust and IP guidelines so that companies can share threat intelligence without fear of liability.
The Timing That Complicates Everything
The letter was sent on June 10. Two days later, on June 12, the Commerce Department imposed controversial restrictions on Anthropic‘s latest Mythos and Fable AI models because officials feared they could be deployed by military intelligence users in China and other countries of concern. The restrictions resulted in Anthropic disabling access to the models globally.
Anthropic is now simultaneously asking the government to protect its IP and dealing with a government that has effectively made its flagship models unavailable outside the U.S. The company that asked for protection is now subject to control. The same government that received the evidence also imposed the restrictions.
The Legislative Response
U.S. lawmakers are already moving. Senator Bill Hagerty and Senator Andy Kim are preparing a bipartisan amendment to sanction or blacklist Chinese companies that engage in unauthorized distillation of U.S. AI outputs. A similar effort is underway in the House. Both are expected to be attached to the annual National Defense Authorization Act.
Alibaba was added to the Pentagon‘s Chinese military companies list earlier this month, a designation it has said it will challenge. Meanwhile, the Commerce Department has held off placing DeepSeek on a trade blacklist despite an interagency committee deeming it a national security risk, in an effort to avoid escalating tensions.
What This Actually Means
This is the third time Anthropic has made this kind of accusation. The numbers are larger, the targets are more specific, and the legislative response is gaining momentum. But the pattern is consistent.
Anthropic is building a record — not just of the alleged behavior, but of its own cooperation with the U.S. government. The company has positioned itself as the source of intelligence on what it describes as industrial-scale IP theft. Whether that intelligence is actionable is another question. The Commerce Department restricted Anthropic‘s own models two days after the letter. The company that asked for help is now a case study in how quickly the tables can turn.
P.S. Anthropic says Alibaba used 25,000 fake accounts to query Claude 28.8 million times. It’s the third time Anthropic has made this kind of accusation. At some point, the pattern stops being a coincidence and becomes a strategy. Two days after the letter, the government restricted Anthropic‘s own models. The company that asked for protection is now subject to control. That’s the real tension in this story.
