Preface

Context: Anthropic, a prominent AI developer, has publicly accused operators connected to Alibaba of conducting the largest documented campaign to extract capabilities from its Claude model. The company frames this activity — known as model distillation or extraction — as more than an intellectual-property dispute. In a June 10 letter to Senate committee leaders, Anthropic urged Congress to adopt stronger safeguards, including tighter export controls, expanded intelligence sharing, and penalties for firms that carry out large-scale unauthorized model extraction. This article summarizes Anthropic's claims, the technical and policy issues at stake, and the recommendations it presented to U.S. lawmakers.

Lazy bag

Key takeaway: Anthropic alleges that Alibaba-affiliated actors ran a massive distillation campaign against Claude, using tens of thousands of fraudulent accounts to generate millions of exchanges. Anthropic is urging Congress to tighten export controls, broaden intelligence sharing with AI firms, clarify antitrust rules for information sharing, close data-center access loopholes, and penalize large-scale extraction. The company frames the problem as both an economic and national security concern.

Main Body

Anthropic's June 10 letter to the Senate Banking, Housing, and Urban Affairs Committee described what the company calls the largest-known distillation campaign targeting a U.S. frontier AI model. According to Anthropic, operators affiliated with Alibaba and its Qwen AI lab generated roughly 28.8 million interactions with the Claude chatbot between April 22 and June 5. The company alleges these interactions were produced using nearly 25,000 accounts that it classifies as "fraudulent," meaning they did not represent legitimate, organic users.

Technically, the operation Anthropic describes is a distillation or extraction attack: adversaries query a powerful model intensively to observe its responses and then use those responses to train or tune their own systems. Anthropic asserted that the queries specifically targeted Claude's advanced capabilities — including agentic reasoning, software engineering assistance, and long-horizon planning — capabilities that would be costly and time-consuming to develop independently in a frontier model.

From Anthropic's perspective, the concern has three principal dimensions. First is the economic imbalance: when external actors capture frontier-model behavior without investing the compute, data, and research required to train such a system, they reap the returns of U.S. investments without bearing the associated costs. Anthropic argues this inverts the economic logic that underpins American leadership in AI and effectively subsidizes competitors.

Second is national security: Anthropic framed large-scale distillation as a potential accelerant for adversarial military and cyber capabilities. If actor A extracts advanced reasoning or planning capabilities from a U.S.-developed model and incorporates them into systems used by state-aligned labs, that could narrow or reverse the technological lead that the United States and its partners currently hold.

Third are legal and ethical concerns: Anthropic alleges these operations violated its terms of service and intellectual property rights. The company acknowledged that distillation and model compression are legitimate techniques within the industry for creating smaller or more efficient models, but it drew a distinction between conventional, consensual distillation and large-scale extraction using fraudulent access methods.

To address these concerns, Anthropic set out several requests for legislative and regulatory action. It urged Congress to:

• Strengthen export controls on advanced AI chips and compute resources, making it harder for foreign actors to obtain the hardware necessary to run or train large models.


• Expand and formalize intelligence sharing between frontier AI firms and U.S. government agencies so threats such as distillation campaigns can be identified and countered more quickly.


• Clarify antitrust rules to permit responsible information sharing about distillation and abuse without triggering anticompetitive scrutiny, enabling firms to coordinate defensive measures.


• Close loopholes that allow foreign companies to access overseas data centers or other infrastructure that can facilitate large-scale extraction.


• Impose penalties on companies found to have engaged in large-scale, unauthorized model extraction.

Anthropic emphasized the need for coordinated action between industry and government, arguing that technical defenses alone are insufficient when campaigns involve large volumes of queries and sophisticated evasion of detection. The company also pointed to prior allegations it made earlier in the year accusing several Chinese AI developers — DeepSeek, Moonshot AI, and MiniMax — of generating over 16 million Claude interactions using roughly 24,000 fraudulent accounts.

Critics of Anthropic’s claims have noted that distillation and related techniques are established practices within AI research and industry development. Some observers contend that companies sometimes rely on outputs from other models during training and that the line between accepted model compression and illicit extraction can be ambiguous. Anthropic responded by distinguishing legitimate, permissioned distillation from what it describes as large-scale, unauthorized capture of frontier-model capabilities through deception.

The debate has broader implications. In April, testimony in federal court indicated that xAI had partially used OpenAI models when training its Grok system, underscoring how commonplace cross-model influences can be. Policymakers must therefore weigh competing objectives: protecting intellectual property and national security interests while preserving legitimate research practices and innovation flows.

Washington has been taking steps to protect U.S. AI leadership. For example, an executive order this month expanded AI-powered cybersecurity initiatives, a move that follows broader concerns about maintaining a competitive edge against China. Anthropic’s appeal to Congress is part of this evolving policy conversation: it asks legislators to recognize large-scale model extraction as a strategic risk and to deploy legal, regulatory, and technical tools to address it.

Any legislative response will have to navigate difficult trade-offs. Tightening export controls can slow adversaries but also affect international collaborations and commercial supply chains. Expanding information sharing among private firms raises antitrust and privacy questions that regulators will need to clarify. And determining appropriate penalties for distillation requires precise definitions of what constitutes unauthorized extraction versus legitimate model training and improvement.

Anthropic’s letter and public statements aim to shape that conversation by presenting distillation at scale as an urgent problem that merits congressional attention. Whether lawmakers adopt Anthropic’s full set of recommendations remains to be seen, but the episode highlights how operational security, trade policy, and national security considerations are converging around frontier AI technologies.

Key Insights Table