Anthropic accuses Alibaba of illegally stealing Claude: 28.8 million conversations, nearly 25k fake accounts, distillation war reaches US Congress

According to a copy of the letter obtained by Bloomberg, Anthropic has sent letters to multiple U.S. senators and White House officials, accusing entities associated with Alibaba's Qwen Lab of using nearly 25k fake accounts to launch 28.8 million conversations with Claude between April and June, systematically stealing core capabilities such as software engineering and agentic reasoning.
(Previous context: GPT-5.5-Cyber cybersecurity capabilities outperform Claude Mythos! Two fates: White House clearance vs. being blocked)
(Background supplement: Would you be willing to teach your most valuable "judgment" to AI when your company asks you to?)

According to the letter copy obtained by Bloomberg, Anthropic accuses entities linked to Alibaba's Qwen AI Lab of using nearly 25k fake accounts to initiate a total of 28.8 million conversations with Claude between April and June this year. The attacks were not random queries but precisely targeted Claude's two most competitive capabilities: software engineering and agentic reasoning.

Agentic reasoning, simply put, is the ability for AI to plan multi-step tasks autonomously and execute complex tasks like an agent. This type of capability is currently a core differentiating selling point for leading frontier models and also the most expensive part of training.

In the letter, Anthropic characterizes this operation as an "adversarial distillation attack," with the formula as follows: large numbers of fake accounts ask questions to Claude → collect answers → use them to train Qwen series models, allowing the latter to replicate the reasoning capabilities of U.S. frontier models without bearing billions of dollars in R&D costs. Anthropic states that this method is identical to the one it named earlier in a blog post regarding DeepSeek and MiniMax—systematic, large-scale, and industrialized.

Currently, Anthropic, OpenAI, and Google have formed a tripartite alliance to share information on detected distillation violations. Concerns within the U.S. industry have evolved from isolated incidents to a collective defensive posture.

The blurry line between legal and illegal

Distillation itself is not a new technology, nor is it entirely illegal. The process of allowing smaller models to "learn thinking methods" from larger models, inheriting capabilities at extremely low cost, is known as model distillation and has been practiced in the AI research community for years. The industry generally permits its use on a smaller scale and for non-competitive development.

The issue lies in scale and intent. When the goal of distillation is to replicate the capabilities of top frontier models, and nearly 25k fake accounts are used for industrialized questioning, this exceeds the scope permitted by the service terms of major AI labs. In the letter, Anthropic clearly points out that such attacks "steal AI capabilities from U.S. frontier labs in an illegal, systematic, and industrial-scale manner, repackaging them as their own products without bearing training and R&D costs."

However, there is also a contradiction that Anthropic itself cannot easily avoid: distillation technology is widely used in the industry, and Anthropic itself admits that the company used distillation on its own earlier models when training Claude. The boundary between "distilling oneself" and "distilling others" remains legally unclear. In the letter, Anthropic explicitly requests the U.S. government to help clarify relevant antitrust guidelines so that major U.S. companies can more freely share intelligence on distillation attacks.

Lawmakers in both chambers of the U.S. Congress have taken action. In the Senate, Republican Bill Hagerty and Democrat Andy Kim plan to propose an amendment to blacklist or sanction Chinese companies that illegally distill U.S. AI outputs; in the House, Bill Huizenga and Sydney Kamlager-Dove are promoting a similar bipartisan bill, both intended to be included in the annual National Defense Authorization Act.