Anthropic vs Alibaba — 28.8 Million Stolen Conversations

Anthropic sent a letter to US senators Tim Scott and Elizabeth Warren on June 10 accusing entities linked to Alibaba’s Qwen lab of running 28.8 million unauthorized exchanges with Claude through approximately 25,000 fraudulent accounts between April 22 and June 5, 2026. Bloomberg broke the story on June 24. Anthropic calls it the largest known distillation attack against the company to date — and the numbers back that up.

TL;DR

• What: Alibaba-linked operators ran 28.8M Claude interactions through ~25,000 fake accounts in 45 days — the largest documented distillation attack on a US AI lab
• Targeted: Agentic reasoning, software engineering proficiency, and long-horizon task completion — Claude’s highest-value differentiators
• Context: Dwarfs the combined February disclosures (DeepSeek, Moonshot AI, MiniMax at ~16M total)
• Action: If you chose a Qwen-tier model based on benchmark parity with Claude, revisit that assumption

What Happened

Between April 22 and June 5, operators linked to Alibaba’s Qwen lab used commercial proxy services to mask their geographic origin and bypass Anthropic’s China access restrictions. They created roughly 25,000 fake accounts and systematically queried Claude at industrial scale — not for general-purpose outputs, but specifically targeting agentic reasoning, software engineering, and long-horizon task completion. Those are precisely the capabilities where frontier Claude models separate themselves from the rest of the field, and precisely the capabilities Qwen needed to close the gap.

This is not the first time Anthropic has disclosed this kind of attack. In February 2026, the company reported three Chinese labs running similar operations: DeepSeek at over 150,000 interactions, Moonshot AI at over 3.4 million, and MiniMax at over 13 million — roughly 16 million combined. Alibaba’s campaign nearly doubled that total in under seven weeks.

A “distillation attack” does not mean stealing model weights or source code. It means querying a model at massive scale with carefully designed prompts to harvest reasoning patterns and output structures. The resulting data becomes training material that can close benchmark gaps at a fraction of real R&D cost.

The timing is notable. The White House OSTP released NSTM-4, titled “Adversarial Distillation of American AI Models,” on April 23, 2026 — one day after the Alibaba campaign began. Whether the campaign was rushed to beat an anticipated crackdown or was simply already underway when the memo dropped, the practical result is the same: public warnings did nothing to prevent the largest extraction operation yet.

Separately, the Trump administration issued an export control directive earlier in June ordering Anthropic to suspend access to its latest Claude models, Fable 5 and Mythos 5. The distillation letter and the export controls are converging into a single policy trajectory — one that will directly affect which models you can use and where.

Why This Matters

I have been covering the Kimi/Qwen price war for months. We have written about Kimi K2.7’s benchmark scores, Qwen’s shift toward closed weights, and Kimi Code K2.6 challenging Claude Code on cost. The running narrative — mine included — has been that efficient training and architectural innovation explain how Chinese labs close the gap with frontier models at a fraction of the API price.

That narrative is incomplete. It might still be partially true, but 28.8 million targeted Claude interactions is not an efficiency breakthrough. It is an industrial extraction program.

Consider what was targeted: not trivia, not summarization, not the commodity capabilities that any decent model handles. The operators specifically went after agentic reasoning and long-horizon task completion — the exact capabilities that show up in benchmarks where Qwen and Kimi models have recently posted impressive scores. When a model’s benchmark performance is partially trained on systematically harvested outputs from the model it is being compared against, the benchmark comparison becomes circular. You are not measuring independent capability. You are measuring how well the student reproduced the teacher’s answers.

This does not mean every Qwen or Kimi benchmark score is fraudulent. It means the scores cannot be taken at face value without knowing the composition of the training data — and that information is never disclosed for these models.

For teams that have already made procurement decisions based on benchmark parity — swapping Claude API calls for Qwen endpoints to cut costs — this disclosure changes the risk calculus. Not because the cheaper model suddenly stops working. It might perform fine for your use case. But the basis on which you evaluated it (benchmark scores showing near-parity with Claude) is now contaminated by the possibility that those scores were achieved through extraction rather than independent research.

The compliance angle matters too. Anthropic is urging Congress for tighter anti-distillation enforcement. Export controls on Fable 5 and Mythos 5 already restrict which Claude models can be accessed from certain jurisdictions. If enforcement escalates — and the political trajectory suggests it will — teams using Chinese-origin models may face supply chain questions from enterprise customers and regulators. Not today, but the direction is clear.

There is also a competitive dynamics problem that rarely gets discussed honestly. If distillation at this scale is tolerated, it creates a perverse incentive structure: labs that invest billions in frontier research become involuntary training data providers for competitors who invest primarily in extraction infrastructure. Anthropic spent the R&D budget. Alibaba spent the proxy service bill. The benchmark chart shows them converging. That convergence is not the market working efficiently — it is the market being gamed.

The Take

I am not going to pretend the benchmark comparisons we have been citing were worthless — they measured real output quality on real tasks. But I am going to be more careful about what I conclude from them. When Kimi K2.7 posts an 81% MCP score or Qwen closes the gap with Claude on coding benchmarks, the question is no longer just “is this number real?” It is “where did the training data come from that produced this number?”

My recommendation: if your team chose a Qwen-tier or Kimi-tier model as a Claude replacement based primarily on benchmark parity plus lower cost, audit that decision. Not panic — audit. Test the model on your actual workloads, not published benchmarks. If it performs well on tasks specific to your codebase, the provenance of its training data matters less for your immediate needs. But do not cite public benchmarks as your justification anymore. Those numbers are compromised.

The broader signal here goes beyond Alibaba. Three disclosures in four months, four Chinese labs named, nearly 45 million total extracted interactions. This is not a series of isolated incidents. It is a systematic capability transfer program, and it is reshaping the competitive landscape that every model procurement decision sits on top of. Price the risk accordingly.