Anthropic says Alibaba ran the largest Claude cloning attack yet

Anthropic has accused Alibaba of orchestrating the largest campaign yet to clone Claude. In a June 10 letter to two US senators, the company said operators tied to Alibaba and its Qwen AI lab generated more than 28.8 million exchanges with Claude through roughly 25,000 fraudulent accounts between April 22 and June 5. The allegations land the same week the US is finalizing a trusted-partner framework for releasing Anthropic's Mythos 5 model.

The letter, which Ars Technica obtained, was sent to Senators Tim Scott (R-SC) and Elizabeth Warren (D-Mass.) one day ahead of a Senate committee hearing on AI and the American Dream. It carries some of the most specific public accusations Anthropic has made against a single foreign lab. The 28.8 million exchanges, the letter said, targeted what Anthropic considers Claude's most valuable capabilities: agentic reasoning, software engineering, and long-horizon tasks. The attacks did not use traditional exploits. They used prompt-driven conversations designed to extract high-quality outputs that could be used to train a competing model.

Anthropic's account is that the operators evaded detection by cycling through obfuscation techniques and proxy networks, and that the volume of accounts is the largest the company has measured in any single distillation campaign to date. The framing matters. The number is not just a vanity metric. It is the basis for Anthropic's claim that the campaign "turns hundreds of billions of dollars in American investment and R&D into a massive subsidy for our geopolitical competitors," the letter said. The implicit argument is that the cost of training a frontier model in 2026 is rising sharply, and that systematic extraction is the fastest path for a competitor to close the gap.

The 28.8 million exchanges Anthropic says Alibaba ran

The mechanics of the alleged campaign are a more granular version of what Anthropic has accused other Chinese labs of doing. In April, Anthropic publicly accused DeepSeek, Moonshot, and Minimax of running a similar pattern that generated over 16 million exchanges with Claude through about 24,000 fraudulent accounts. The Alibaba figure, on Anthropic's accounting, is nearly double that scale in roughly half the time. The campaign was active from April 22 to June 5, and it overlapped with the period when Anthropic was negotiating with the US Commerce Department over how to release its Mythos 5 model to foreign partners without ceding capability to adversaries.

The letter's specific targeting list is the most consequential detail. Anthropic singled out agentic reasoning, software engineering, and long-horizon tasks as the capabilities under attack. All three are exactly the capabilities that the Claude Mythos system card and the Claude platform have emphasized as the differentiator between the latest Claude generation and the public API. The choice of targets is consistent with a competitor trying to close the gap on the parts of Claude that are hardest to replicate from open-weight alternatives, rather than the parts where open-weight models have already closed the gap.

The Chinese-language campaign details in the letter also serve a tactical purpose. Anthropic does not allege in the letter that Alibaba's leadership ordered the campaign. It says the operators were "affiliated with Alibaba and Alibaba Qwen." That phrasing is consistent with the way Anthropic has described the DeepSeek, Moonshot, and Minimax allegations, and it preserves the option of a downstream enforcement action or sanctions designation without requiring Anthropic to make a public attribution that it cannot defend in court. The opacity is the point.

Why Anthropic wants Congress to act on distillation

The legislative asks in the letter are more specific than anything Anthropic has proposed publicly before. The company is calling on Congress to do three things. First, update antitrust law so AI firms can share information about evolving Chinese distillation tactics with each other and with the government without exposing themselves to collusion liability. Second, tighten chip export controls to make it harder for Chinese labs to train on the outputs of US models at the scale the letter describes. Third, pass statutes that make distillation attacks meaningfully more expensive for the labs that run them, through restrictions on US model access, on advanced US chips, or on the use of data centers outside China.

The first ask is the most industry-specific. US frontier AI labs compete fiercely with each other, and they have so far had limited ability to share information about attack patterns because of the antitrust exposure that doing so would create. Anthropic's framing in the letter is that distillation is not a competitive issue but a national security one, and that the usual antitrust posture should be relaxed in this domain. The second and third asks are standard export-control arguments, but the letter couples them to a specific incident rather than to a generic threat, which is the kind of coupling that tends to move legislative action.

Anthropic's interest in this moment is not coincidental. The same week the letter was reported, the Commerce Department was negotiating the terms under which trusted US partners would be allowed to access Mythos 5, a model that Anthropic says is too dangerous to release to most foreign entities. A high-profile distillation accusation, with named senators, a specific incident, and a concrete list of legislative asks, is the kind of material that helps Anthropic argue for tighter controls on the foreign release of its own models. The company is essentially asking Washington to do for distillation what export controls already do for chips: turn a competitive problem into a regulatory one.

Where the Anthropic case fits the US-China AI fight

The Alibaba allegation lands inside a US-China AI competition that has shifted visibly in 2026. On the policy side, the Trump administration has already moved to restrict Chinese access to advanced chips and to publicly accuse Chinese labs of industrial-scale AI theft. On the commercial side, Chinese model labs have closed parts of the gap with US frontier labs in open-weight benchmarks, but they have struggled to match US labs on the agentic and long-horizon reasoning capabilities that enterprise buyers say they care about. Distillation attacks are a way to accelerate that catch-up without paying the full R&D bill.

The specific timing of the Anthropic letter, two days before the Mythos trusted-partner framework became public, also gives Anthropic a way to put a number on the threat. The 25,000 accounts and 28.8 million exchanges are not just a complaint about a single incident. They are a number that supports Anthropic's case for why Mythos 5 should be released only to a narrow set of trusted partners under US government supervision, and why distillation should be regulated as a national security issue rather than as a competitive annoyance. For more on the Mythos context, the earlier AIntelligenceHub coverage of parts of the NSA losing access to Anthropic's Mythos 5 walks through the export-control side of the same fight, and the enterprise AI governance checklist for 2026 lays out the broader compliance picture for buyers trying to keep their own model usage inside the new rules.

Alibaba's response, so far, is to challenge the political frame rather than the technical one. Reuters reported earlier this week that Alibaba filed suit against the Trump administration on Tuesday, alleging that a Trump-era blacklist linking the company to the Chinese military has "no basis in fact or law." The company is publicly arguing that it has an independent board, no military affiliation, and a US listing on the New York Stock Exchange. Anthropic's response, in turn, is that a US listing and a US-distillation campaign are not mutually exclusive, and that the threat model is what matters. Both arguments will be tested in the next round of hearings, the next round of export controls, and the next round of frontier model releases. The Anthropic letter is the opening move in that fight, not the close.