Did Alibaba Steal Claude? Anthropic’s 28.8 Million-Chat AI Espionage Bombshell
Anthropic says Alibaba-linked operators used nearly 25,000 fake accounts to extract Claude’s capabilities. Is this industrial espionage, normal AI competition, or the first public battle over model distillation?
Anthropic has dropped one of the most explosive accusations yet in the global AI race: Chinese tech giant Alibaba, through operators allegedly linked to its Qwen ecosystem, carried out a massive “distillation attack” designed to extract the capabilities of Claude without paying the true cost of building them.
The numbers are striking. According to reporting on Anthropic’s letter to U.S. lawmakers, nearly 25,000 fraudulent accounts allegedly generated around 28.8 million interactions with Claude between April 22 and June 5, 2026. Anthropic says the purpose was not ordinary product testing. It says the campaign was designed to harvest Claude’s reasoning, coding, and problem-solving behavior at industrial scale, then use those outputs to train competing Chinese models.
This is where the AI war becomes harder to understand than a chip embargo. A missile can be counted. A GPU shipment can be blocked. But model capability can leak through conversation. If one company asks another company’s model millions of carefully designed questions, captures the answers, and trains a rival system on them, is that theft, reverse engineering, competition, or something new that existing law does not yet know how to handle?
Anthropic calls it unauthorized extraction. Critics of China call it industrial espionage. Chinese AI defenders may argue that American companies trained on the open internet for years, absorbing code, books, papers, forums, and human output without asking everyone’s permission. That does not make alleged account fraud acceptable. But it does complicate the moral argument. The AI industry was built in a gray zone, and now the biggest players are discovering that gray zones can be used against them.
The geopolitical layer is impossible to ignore. Claude is blocked in China, yet Anthropic alleges Alibaba-linked actors found ways around access controls. Other Chinese AI companies, including DeepSeek, Moonshot AI, and MiniMax, have also been mentioned in broader warnings about model extraction. For Washington, this supports a familiar argument: China is not simply competing; it is absorbing U.S. research faster than America can protect it. For Beijing, the counterargument is just as familiar: the United States wants to keep the best AI models, chips, and cloud infrastructure under American control while calling that “security.”
The real question is whether frontier AI can be protected at all. If a model is available through an API, it can be queried. If it can be queried, it can be probed. If it can be probed millions of times, some part of its behavior can be copied. Rate limits, identity checks, watermarks, legal threats, and government controls may slow the process. They may not stop it.
This is why the Anthropic-Alibaba clash matters beyond one company. It reveals a future where the most valuable asset in the world may not be oil, gold, or even chips, but behavior: how an advanced model reasons, writes code, plans attacks, solves problems, and responds under pressure. Once that behavior is observable, it becomes vulnerable.
There is also a risk of overstatement. A distillation attack does not magically copy a frontier model’s entire brain. Training data, architecture, compute, reinforcement learning, safety tuning, and internal tools all matter. A rival model trained on Claude outputs may imitate certain behaviors without reproducing the full system. But in a race where a few months of advantage can matter, even partial extraction is valuable.
So what happens now? Anthropic wants urgent action. Policymakers will likely discuss tighter cloud identity checks, penalties for model extraction, and restrictions on foreign access to frontier AI services. But those tools raise new questions. How much surveillance of users is acceptable? Who decides which countries can access powerful models? Will smaller developers be locked out while only the biggest firms can afford compliance?
The headline says China stole AI from Anthropic. The deeper story is that artificial intelligence has entered the era of strategic leakage. Models do not need to be hacked in the old sense to be copied in the new one. The war for AI is no longer only about who builds the smartest system. It is about who can stop everyone else from learning from it.