Anthropic Accuses Alibaba of Large-Scale Claude Model Extraction

Anthropic has accused Alibaba of using nearly 25,000 fraudulent accounts to extract capabilities from its Claude AI models, describing the alleged operation as the largest known attack of its kind against the company. The campaign is said to have run between April 22 and June 5 and to have generated more than 28.8 million exchanges with Claude. Anthropic set out the allegation in a June 10 letter to senior members of the US Senate Banking Committee.

Key facts at a glance

• Anthropic alleges that operators affiliated with Alibaba and Alibaba Qwen, Alibaba's AI lab, ran the campaign.
• The alleged activity involved nearly 25,000 fake accounts.
• The campaign is said to have produced more than 28.8 million exchanges with Claude between April 22 and June 5.
• Anthropic described the technique as distillation, in which a less capable model is trained on outputs from a more advanced system.
• The company sent its allegation in a June 10 letter to senior members of the US Senate Banking Committee.
• Anthropic previously identified similar campaigns by DeepSeek, Moonshot AI and MiniMax.
• Alibaba did not immediately respond to a request for comment.

The allegation comes as businesses adopt generative AI tools across business functions, putting pressure on vendors to show they can detect misuse while keeping services available for corporate customers. The dispute also comes as AI development becomes more closely tied to US-China technology tensions. Anthropic said the alleged campaign could help accelerate China's ability to reach the capabilities of its advanced Mythos Preview model, while US officials have stepped up scrutiny of advanced AI systems over fears they could be used by military or intelligence users in countries of concern.

At the center of the dispute is distillation, a technique in which a less capable AI model is trained on the outputs of a more advanced system. The approach can be used for legitimate research and model improvement, but it can also allow rivals to replicate some capabilities at lower cost and with less development work. For AI developers, the concern is not simply that outputs are being collected. The deeper risk is that a model's behavior, reasoning patterns and specialized skills can be approximated by another system without the same investment in training, safety testing or governance.

Anthropic said the alleged campaign involved operators affiliated with Alibaba and Alibaba Qwen. The scale described in the letter is notable: nearly 25,000 fake accounts and more than 28.8 million exchanges over a period of several weeks. Those figures suggest a coordinated effort rather than isolated misuse, and they point to the challenge AI vendors face in distinguishing ordinary high-volume customers from networks designed to extract model capabilities.

The allegation also fits into a wider pattern. In February, Anthropic said it had identified similar campaigns by DeepSeek, Moonshot AI and MiniMax to extract capabilities from Claude. The alleged activity ranged from more than 150,000 exchanges by DeepSeek to more than 13 million by MiniMax. Viewed alongside the new allegation involving Alibaba, the earlier incidents suggest that model extraction is escalating rather than remaining an isolated risk.

Analysts said the alleged campaign points to a broader pattern beyond the two companies. If Anthropic's claims are true, the alleged campaign could allow Alibaba to build a comparable model in a short period of time and offer it at a much lower cost. That possibility matters for AI vendors, enterprise customers and policymakers because it challenges the assumption that advanced model capabilities can be protected mainly through access controls and terms of service.

The enterprise supply chain no longer ends at software, APIs and cloud regions, according to industry analysts. It now includes rented intelligence, and rented intelligence can be copied and redeployed well outside the safety controls it was born with. That framing helps explain why distillation should be a board-level concern. A weaker model trained on a stronger one can inherit capabilities without the governance and controls around the original system.

For enterprises, the allegations point to a potentially more serious risk than conventional intellectual property theft: reverse engineering at scale. If proven, they would suggest that AI models can be copied systematically, turning model extraction into a new AI supply-chain risk. A company that relies on an AI model for customer service, software development, security monitoring or automated decision-making may not be exposed only to the theft of code or data. It may also face risks tied to the cloning of model behavior.

Industry analysts warn that if a rival can clone the exact brain of the AI a company relies on, that rival can more easily find its blind spots, attack automated systems or cause the AI vendor to shut down services that the business needs to run every day. The risk is not limited to the model developer. Enterprises that build workflows around a third-party AI service can inherit operational, security and compliance exposure when the underlying model is targeted.

The allegation raises questions about the controls AI vendors have in place and how customers can protect themselves. Vendors should provide verified accounts, smart rate limits, abuse detection, usage monitoring, contractual bans on distillation, incident disclosure and audit rights. Enterprises should ask how the vendor detects and blocks large-scale model extraction, and they can demand contracts that guarantee backup plans and financial refunds if the AI service is attacked or suddenly shut down.

Enterprise customers should also press vendors for greater transparency around model development and safeguards. Buyers should ask what training data was used, how the model was trained, what guardrails exist and how they can audit it. Model publishers will have to come up with watermarking technology in models as well as model responses, so that if model skills are stolen, they can trace the thief.

The policy dimension is equally significant. The letter to senior members of the US Senate Banking Committee places the allegation within debates over advanced AI, national security and technology competition. US officials have increased scrutiny of frontier AI systems because of concerns that advanced capabilities could be used by military or intelligence users in countries of concern. Anthropic's claim that the alleged campaign could help accelerate China's ability to reach the capabilities of its advanced Mythos Preview model gives those concerns a concrete example.

At the same time, the allegation remains disputed in the sense that Alibaba did not immediately respond to a request for comment. That leaves open questions about what Alibaba will say, whether the accounts can be traced to specific operators, and how Anthropic's detection systems identified the activity. Those questions matter because model-extraction claims can have commercial, reputational and geopolitical consequences. They also raise the bar for evidence and disclosure.

For AI vendors, the incident underscores the need to monitor usage patterns at scale. A single suspicious account may look like abuse, but thousands of coordinated accounts can resemble ordinary demand unless the provider has systems that detect shared behavior, repeated probing and abnormal extraction patterns. Verified accounts, rate limits and abuse detection are not merely trust-and-safety features. They are part of the commercial infrastructure that keeps AI services available to legitimate customers.

For enterprise buyers, the lesson is to treat model access as a supply-chain dependency that requires due diligence. Contracts should address what happens if a model provider detects extraction, restricts access or changes service terms. Buyers should ask whether the vendor has incident disclosure obligations, audit rights and continuity plans. They should also ask whether the vendor can trace model outputs and detect signs that a competitor is trying to reproduce proprietary behavior.

Watermarking could become an important part of that response. If model publishers can mark both models and responses, they may be better positioned to identify unauthorized copying and to support investigations. But watermarking is not a complete solution. It must be paired with account verification, usage monitoring, legal terms and technical controls that make large-scale extraction harder to carry out without detection.

The broader significance of Anthropic's allegation is that model extraction is moving from a theoretical concern to a practical risk for AI developers and their customers. The combination of fake accounts, high-volume exchanges and distillation techniques shows how access to a leading model can be abused at scale. It also shows why AI vendors must design misuse detection into their services from the start rather than treating it as an afterthought.

For businesses adopting generative AI, the dispute reinforces the need to ask harder questions about vendor resilience and model provenance. Enterprises should know how their AI providers detect extraction, how quickly they respond to abuse and what remedies are available if service is disrupted. They should also understand whether their own use of AI creates exposure if a model is cloned or if a vendor's safety controls are circumvented.

As AI development becomes more closely tied to US-China technology tensions, allegations of model extraction are likely to be scrutinized not only by the companies involved but also by lawmakers and regulators. The June 10 letter to the US Senate Banking Committee signals that AI model security is now part of the broader policy conversation about advanced technology, national security and commercial competition. The outcome of the Alibaba allegation may shape how AI vendors disclose attacks, how enterprises negotiate contracts and how policymakers think about protecting frontier model capabilities.

The immediate commercial takeaway is that rented intelligence carries hidden dependencies. Enterprises may rely on an AI model without owning it, controlling its training process or understanding all of its vulnerabilities. If that model can be copied, probed or forced offline through large-scale extraction, the business impact can extend well beyond the vendor's own losses. That is why model extraction is increasingly being treated as a supply-chain risk rather than a narrow security incident.

Vendors and customers now face a shared challenge: proving that AI services can be used productively without becoming easy targets for systematic copying. The controls that matter include identity verification, rate limiting, anomaly detection, contractual restrictions and audit trails. The companies that can demonstrate those controls may be better placed to win enterprise trust as AI systems become more deeply embedded in daily operations. That shift would turn model provenance and extraction detection into core procurement criteria rather than niche security concerns.

Source:InfoWorld News