Anthropic contended that operators linked to Alibaba conducted the most extensive AI model distillation campaign targeting Claude.
The company is urging Congress to tighten export controls, broaden intelligence sharing, and impose penalties on firms involved in large‑scale model extraction.
The letter arrives as lawmakers deliberate legislation aimed at preventing unauthorized access to U.S. frontier AI models.
Anthropic is urging Congress to bolster protections against AI model distillation, following its claim that Alibaba‑affiliated operators executed the most extensive effort to extract capabilities from its Claude chatbot.
In a June 10 letter to Senate Banking Committee Chairman Tim Scott and Ranking Member Elizabeth Warren, Anthropic alleged that Alibaba‑affiliated operators, in collaboration with its Qwen AI laboratory, conducted over 28.8 million exchanges with Claude between April 22 and June 5, employing roughly 25,000 “fraudulent” accounts that did not represent genuine users.
Anthropic described the activity as a distillation attack that focused on Claude’s agentic reasoning, software‑engineering, and long‑horizon planning abilities, enabling competitors to replicate advanced model behavior without incurring the expense of training a frontier AI system.
Anthropic noted that, beyond its magnitude, the campaign was notable for its brazen nature, adding that Alibaba is listed on the New York Stock Exchange, operates within the United States, and is answerable to U.S. investors and regulators.
Anthropic argued that the campaign transcended mere intellectual‑property concerns, characterizing large‑scale model distillation as a national‑security risk that could hasten China’s military and cyber AI capabilities and diminish the United States’ technological advantage.
The letter arrives as Washington intensifies its efforts to safeguard U.S. AI leadership, including President Donald Trump’s recent executive order expanding AI‑driven cybersecurity initiatives after a brief postponement over concerns about competitive disadvantage against China.
Anthropic wrote that when PRC labs distill these capabilities from U.S. models, they reap the benefits of American investments without shouldering the costs or risks of training frontier AI models, thereby inverting the economic logic that underpins American AI leadership and effectively subsidizing competitors with billions of dollars of research, compute, and other resources.
Anthropic urged legislators to broaden intelligence sharing between frontier AI developers and the government, clarify antitrust rules to permit AI firms to discuss distillation attacks, tighten export controls on advanced AI chips and compute, close loopholes enabling Chinese firms to access overseas data centers, and impose penalties on companies engaged in large‑scale model extraction.
A spokesperson for Anthropic declined to comment specifically on the letter but told Decrypt that combating illicit distillation requires coordinated action between government and industry, and the company will continue collaborating with Congress and the administration to preserve American AI leadership.
The letter also builds on Anthropic’s February claims that Chinese AI developers DeepSeek, Moonshot AI, and MiniMax conducted over 16 million Claude exchanges using approximately 24,000 fraudulent accounts.
Those allegations have drawn criticism from observers who note that AI companies employ similar techniques in their own training. Anthropic counters that conventional distillation is a legitimate method for creating smaller, more affordable models, whereas unauthorized extraction of frontier model capabilities through fraudulent access violates its terms of service.
The broader debate over distillation has become increasingly complex in recent months. In April, Elon Musk testified before a federal court that xAI had “partly” incorporated OpenAI models into the training of Grok, highlighting that distillation is an established industry practice while companies continue to dispute the boundary between legitimate model training and unauthorized extraction.
