Anthropic is urging Congress to bolster protections against AI model distillation, citing what it describes as the largest known effort to extract capabilities from its Claude chatbot, allegedly carried out by operators affiliated with Alibaba.
In a letter dated June 10 to Senate Banking, Housing, and Urban Affairs Committee Chairman Tim Scott and Ranking Member Elizabeth Warren, Anthropic detailed allegations that Alibaba and its Qwen AI lab-linked operators engaged in over 28.8 million interactions with Claude between April 22 and June 5. These exchanges reportedly involved nearly 25,000 “fraudulent accounts,” meaning they did not represent genuine, organic users.
Anthropic characterized this activity as a “distillation attack,” stating that the operations specifically targeted Claude’s abilities in agentic reasoning, software engineering, and long-horizon planning. Such attacks, the company explained, allow competitors to replicate advanced model behaviors without incurring the substantial costs associated with training a frontier AI system from scratch.
“Beyond its scale, this campaign was striking for its brazen nature,” Anthropic wrote in the letter. “Alibaba is listed on the New York Stock Exchange, maintains business operations in the United States, and is accountable to U.S. investors and regulators.”
The AI firm asserted that the campaign extended beyond intellectual property concerns, framing large-scale model distillation as a national security issue. Anthropic warned that such practices could accelerate China’s military and cyber AI capabilities, thereby diminishing the United States’ technological advantage.
This appeal comes as Washington intensifies its focus on safeguarding U.S. leadership in artificial intelligence. Earlier this month, President Donald Trump signed an executive order aimed at expanding AI-powered cybersecurity initiatives, a measure he had previously delayed amid concerns it could compromise America’s competitive standing against China.
“When PRC labs distill these capabilities from U.S. models, they capture the returns on American investments without bearing the costs or risks associated with training frontier AI models,” Anthropic stated. “This inverts the economic logic that underwrites American AI leadership, turning billions of dollars’ worth of research and development, compute, and other U.S. investments into a subsidy for our competitors.”
Anthropic proposed several actions for lawmakers, including expanding intelligence sharing between frontier AI developers and the U.S. government, clarifying antitrust regulations to permit AI companies to share information about distillation attacks, strengthening export controls on advanced AI chips and computing power, closing loopholes that enable Chinese firms to access overseas data centers, and implementing penalties for companies involved in large-scale model extraction.
A spokesperson for Anthropic declined to comment on the specifics of the letter but told Decrypt, “We believe combating the threat of illicit distillation requires coordinated action between government and industry, and we will continue working with Congress and the administration to maintain American AI leadership.”
The letter builds upon previous claims made by Anthropic in February, where it alleged that Chinese AI developers DeepSeek, Moonshot AI, and MiniMax had generated over 16 million Claude exchanges using approximately 24,000 fraudulent accounts.
Those earlier allegations drew criticism from some observers who pointed out that AI companies themselves employ similar techniques during the training of their own systems. Anthropic has maintained that conventional distillation is a legitimate method for creating smaller, more cost-effective models. However, it argues that the unauthorized extraction of frontier model capabilities through fraudulent access constitutes a violation of its terms of service.
The broader discourse surrounding AI model distillation has grown increasingly complex in recent months. In April, Elon Musk testified in federal court that his company xAI had “partly” utilized OpenAI models in the training of its Grok chatbot. This testimony underscored that distillation is an established industry practice, even as companies continue to debate the boundaries between legitimate model training and unauthorized model extraction.
Leave a Reply