Anthropic has accused Alibaba of using nearly 25,000 fraudulent accounts to extract capabilities from its Claude AI models, describing the alleged operation as the largest known attack of its kind against the company. The claim, set out in a June 10 letter to senior members of the US Senate Banking Committee, says the campaign ran between April 22 and June 5 and generated more than 28.8 million exchanges with Claude.
At the center of the allegation is distillation, a technique in which a less capable AI model is trained on the outputs of a more advanced system. If successful, distillation can allow a rival to replicate some capabilities of a leading model at lower cost and in less time than building a frontier system from scratch. Anthropic said the alleged campaign was conducted by operators affiliated with Alibaba and Alibaba Qwen, the company's AI lab. Alibaba did not immediately respond to a request for comment.
What Anthropic alleges
According to the letter, the alleged operation relied on a large network of fake accounts rather than a single compromised credential or a conventional cyber intrusion. The accounts were used to query Claude repeatedly over roughly six weeks, producing tens of millions of exchanges. That volume matters because distillation depends on scale: the more outputs an attacker can collect, the more training signal is available to shape a competing model.
Anthropic framed the activity as model extraction, a category of abuse that sits somewhere between intellectual property theft and a security breach. The alleged campaign did not involve stealing model weights directly. Instead, it sought to capture behavior - the patterns, reasoning traces, and response styles that make a model useful - through the application programming interface that ordinary customers use.
The company said the alleged campaign could help accelerate China's ability to approach the capabilities of its advanced Mythos Preview model. The allegation lands in an already tense technology environment. AI development has become closely tied to US-China competition, and US officials have stepped up scrutiny of advanced AI systems over concerns that they could be used by military or intelligence users in countries of concern.
The timing also reflects a broader shift in the enterprise AI market. Businesses are adopting generative AI tools across functions including software development, customer support, research, and back-office operations. That adoption puts pressure on vendors to show they can detect misuse while keeping services available to corporate customers. A large-scale extraction campaign, if confirmed, would raise questions about whether those two goals can be balanced.
Prior campaigns and an escalating pattern
Anthropic said the Alibaba allegation is not an isolated data point. In February, the company said it had identified similar campaigns by DeepSeek, Moonshot AI, and MiniMax to extract capabilities from Claude. The alleged activity ranged from more than 150,000 exchanges by DeepSeek to more than 13 million by MiniMax. Viewed together, the incidents suggest that model extraction is becoming more industrial in scale rather than remaining a niche risk.
Analysts said the pattern points to a wider problem for the AI industry. A frontier model is expensive to train, but its outputs can be gathered through ordinary product interfaces. Attackers can spread queries across many accounts to stay below rate limits, rotate access patterns, and make automated traffic look like normal usage. Defenders must then separate legitimate customer activity from coordinated extraction without degrading service for paying enterprises.
A new supply chain risk
If Anthropic's claims are true, the alleged campaign could allow Alibaba to build a comparable model in a short period of time and offer it at a much lower cost, said Anand Joshi, an AI analyst at TechInsights. That prospect turns model extraction into an economic threat as well as a security one. A competitor would not need to repeat the full research and compute burden of training a frontier system if it could learn enough from a rival's outputs.
Analysts said the alleged campaign also points to a broader pattern beyond the two companies. Viewed alongside previous incidents cited by Anthropic, they said, model extraction appears to be escalating rather than remaining an isolated risk.
Sanchit Vir Gogia, chief analyst at Greyhound Research, said the enterprise supply chain no longer ends at software, APIs, and cloud regions. It now includes rented intelligence, and rented intelligence can be copied and redeployed well outside the safety controls it was born with. Gogia said distillation should be a board-level concern because a weaker model trained on a stronger one can inherit its capabilities without the governance and controls around the original system.
For enterprises, the allegations point to a potentially more serious risk than conventional intellectual property theft: reverse engineering at scale. If proven, they would suggest that AI models can be copied systematically, turning model extraction into a new AI supply-chain risk.
Pareekh Jain, CEO of Pareekh Consulting, said a rival that can clone the exact brain of the AI a company relies on could find its blind spots, hack automated systems, or cause the AI vendor to panic and shut down services that a business needs to run every day. That scenario moves the risk from legal departments into operational resilience. An enterprise that depends on a single model provider may face disruption not only from outages or price changes but also from a vendor's response to abuse.
Mitigating the risks
The allegation raises questions about the controls AI vendors have in place and how customers can protect themselves. Jain said vendors should provide verified accounts, smart rate limits, abuse detection, usage monitoring, contractual bans on distillation, incident disclosure, and audit rights. Enterprises should ask how the vendor detects and blocks large-scale model extraction and can demand contracts that guarantee backup plans and financial refunds if the AI service gets attacked or suddenly shut down.
Joshi said enterprise customers should also press vendors for greater transparency around model development and safeguards. Enterprise buyers should ask what training data was used, how it was trained, what guardrails exist, and how they can audit it. Model publishers will have to come up with watermarking technology in models as well as model responses, so if model skills are stolen, they should be able to find the thief.
The alleged Alibaba campaign also highlights the difficulty of proving extraction after the fact. Outputs from a model can be paraphrased, filtered, and mixed with other data before they are used in training. That makes attribution technically challenging and raises the bar for vendors that want to pursue enforcement. Detection may depend on correlating account behavior, query patterns, payment signals, and infrastructure fingerprints long before a competing model appears.
For now, the claims remain allegations. Alibaba did not immediately respond to a request for comment, and the letter does not establish a public finding of wrongdoing. But the dispute has already put a spotlight on the controls that surround commercial AI services and on the willingness of enterprises to depend on models that can be probed at scale. The biggest question may be less about one campaign than about whether the industry can make model extraction expensive, detectable, and contractually risky enough to deter it.
Source: InfoWorld News