Anthropic Letter Details Massive-Scale Effort to Harvest Claude Capabilities
Anthropic has formally alerted U.S. senators that operators linked to Alibaba conducted what it describes as the largest known distillation attack against its models, generating 28.8 million model exchanges through roughly 25,000 fraudulent accounts between April 22 and June 5. The letter, sent June 10 to Sen. Tim Scott and Sen. Elizabeth Warren, frames the activity as a systematic attempt to extract frontier-level capabilities from Claude without incurring the underlying training costs. This development arrives at a moment when U.S. export controls on advanced AI systems are tightening and Chinese firms are accelerating efforts to close performance gaps through alternative means.
The episode underscores a growing asymmetry in AI development: while American labs invest heavily in proprietary training runs, Chinese competitors face incentives to leverage those outputs at industrial scale. Distillation—training smaller models on the responses of larger ones—has long been a legitimate technique, yet Anthropic argues the volume and concealment here cross into illicit territory. The timing also coincides with Alibaba’s separate legal challenge to its Pentagon blacklist designation, creating a two-front contest over technology access and national-security boundaries.
Anatomy of the Reported Distillation Operation
Anthropic’s account specifies that the campaign targeted its Claude models through coordinated, high-volume querying designed to harvest reasoning traces, code generation patterns, and domain-specific outputs. The 28.8 million exchanges equate to sustained, programmatic interaction far exceeding typical user behavior, executed across nearly 25,000 accounts created expressly to evade detection. Anthropic labeled the effort “the largest known distillation attack on Anthropic to date” and tied it directly to Alibaba-affiliated entities and its AI laboratory.
The technical implication is straightforward: repeated exposure to frontier-model outputs allows a recipient to compress capabilities into lighter-weight systems at far lower marginal cost. Anthropic warned that such attacks could accelerate Chinese models toward parity with systems such as Claude Mythos Preview, which already demonstrates advanced vulnerability detection and cybersecurity task performance. Because distillation bypasses the need for equivalent compute clusters or data curation, the practice effectively subsidizes foreign model improvement using U.S. research capital.
Alibaba’s Challenge to the Pentagon’s Military-Company List
Separate from the AI dispute, Alibaba filed suit in federal court in San Jose on June 23 contesting its inclusion on the Department of Defense’s list of Chinese military companies. The designation, expanded this month to encompass Alibaba alongside Baidu, BYD, and others, prohibits new Pentagon contracts and restricts the company’s ability to retain U.S. lobbying counsel. Alibaba contends the listing lacks factual or legal basis, noting its status as a publicly traded firm with major U.S. institutional shareholders including J.P. Morgan, Citigroup, and BlackRock.
The complaint further asserts that the designation violates First Amendment protections by impairing the company’s capacity to petition government. Several lobbying firms have already ceased representation, illustrating immediate commercial consequences. Parallel suits by other listed firms, including WuXi AppTec, suggest a coordinated legal strategy against what Beijing has called discriminatory national-security measures. The Pentagon maintains the list identifies entities contributing to China’s defense industrial base, yet Alibaba emphasizes it maintains no formal ties to military procurement programs.
Price Reductions Timed for U.S. Developer Workflows
While contesting the blacklist, Alibaba has simultaneously moved to expand adoption of its Qwen models through aggressive pricing. On its Qoder agentic coding platform, the company cut the flagship Qwen3.7-Max model by 80 percent and the Qwen3.7-Plus model by 60 percent for international users during the window of 10 p.m. to 8 a.m. Beijing time—corresponding to 10 a.m. to 8 p.m. U.S. Eastern Time. The promotion is explicitly framed as an “off-peak” discount yet aligns with peak American workday hours.
This tactic targets the same developer community that relies on U.S. frontier models for coding assistance. By lowering inference costs during U.S. business hours, Alibaba seeks to insert its models into existing workflows before export controls or usage restrictions fully take effect. The move follows an earlier half-price promotion and reflects a broader pattern of Chinese labs competing on price and accessibility once core capabilities are in place.
Capital Infusion for Domestic AI Hardware
Alibaba’s semiconductor ambitions received fresh resources when its chip-design unit T-Head tripled its registered capital to 1 billion yuan ($148 million). The increase, the first in more than three years, supports integration of custom silicon with Alibaba Cloud and the Qwen model family. T-Head’s expanded mandate aligns with Beijing’s push for self-reliant AI infrastructure amid U.S. restrictions on advanced chip exports.
Full-stack control—from silicon to models—reduces exposure to foreign hardware dependencies and enables tighter optimization between accelerators and inference workloads. The timing suggests Alibaba is preparing for a scenario in which software-only competition becomes constrained by both technical and regulatory barriers.
Intersecting Pressures on Global AI Supply Chains
These developments reveal a feedback loop between capability extraction, regulatory countermeasures, and commercial retaliation. Anthropic’s appeal for coordinated government-industry action on distillation attacks arrives just as the company itself faces new export controls on its latest models. Alibaba’s dual-track response—litigation in U.S. courts paired with price aggression and hardware investment—illustrates how Chinese firms are adapting to restricted access by both legal and technical means. The resulting environment rewards rapid iteration on harvested knowledge while raising the compliance and security costs for U.S. labs seeking to protect their training investments.
Over the longer term, the contest will likely shift from raw model performance toward verifiable provenance of training data and enforceable usage boundaries. Labs that can demonstrate robust detection of distillation campaigns may gain regulatory advantages, while those unable to prevent large-scale extraction risk subsidizing competitors. Policymakers, meanwhile, face pressure to define clearer thresholds between legitimate research access and systematic capability harvesting before the next generation of models reaches deployment.
