Anthropic has disclosed to the US government that Chinese technology giant Alibaba executed what it describes as the largest known distillation attack on its Claude AI model, generating 28.8 million exchanges through nearly 25,000 fraudulent accounts between April and June 2026. Source: Bloomberg
The revelation, first reported by Bloomberg, comes as Anthropic's export restrictions on its Mythos model continue to create tension in global AI markets. Asian AI startups have already begun launching Mythos-like models, and the allegation against Alibaba — one of China's largest technology companies — escalates the AI sovereignty conflict from trade policy into active industrial espionage territory.
Alibaba's stock has already fallen 31% year to date, and the distillation attack disclosure adds regulatory risk to an already pressured position. Anthropic's letter to the government reportedly details the scale and sophistication of the operation, which exploited the fundamental asymmetry of AI services: every legitimate user interaction looks identical to an attacker's interaction when the goal is model extraction.
The incident raises uncomfortable questions about the defensibility of frontier AI models when access is the product. If 25,000 accounts can generate 28.8 million high-quality training examples, the economics of distillation start to look alarmingly favourable for determined adversaries.
Analysis
The Alibaba-Anthropic confrontation isn't just a trade dispute — it's the first shot in what will become the defining conflict of the AI era: model security as national security. Anthropic's disclosure is strategically timed, coming just as it lobbies Washington to maintain export controls on Mythos. But the uncomfortable truth is that distillation attacks are not hacking — they're using the product exactly as designed, just at industrial scale and with fraudulent accounts. Every frontier model company faces this same structural vulnerability, and the industry has no good answer beyond rate-limiting and KYC, both of which degrade the user experience for legitimate customers. The real loser here may be open-weight models: if the US government concludes that API access alone enables effective model theft, the regulatory pendulum could swing hard toward restricting what models can be served to whom — a far more consequential outcome than one company accusing another of bad behaviour.
