Alibaba-linked operators allegedly extracted more than 151 million exchanges from Anthropic’s Claude AI models between May and July 2026 in what Anthropic has described as its largest illicit artificial intelligence distillation campaign to date.
The activity, according to Anthropic, was designed to collect large volumes of information from Claude and potentially use those outputs to improve Qwen, Alibaba’s family of artificial intelligence models. The findings highlight the increasingly aggressive competition among AI companies and growing concerns around the unauthorised use of powerful models to develop rival systems.
Anthropic said the campaign involved a large network of accounts that interacted with Claude at a scale far beyond ordinary user activity. The company characterised the operation as an attempt to systematically extract capabilities from its models rather than simply use Claude for conventional tasks.
The alleged operation demonstrates how advances in automation have made it possible to conduct model-distillation campaigns on an enormous scale. Instead of researchers manually testing an AI model, automated systems can generate thousands or millions of carefully designed prompts and collect the resulting responses.
What is AI distillation?
AI distillation is a technique in which developers use a more capable model, often called a teacher model, to generate information that can help train another model, known as a student model.
The technique itself is not inherently improper. Distillation is widely used in AI development to make models smaller, faster and less expensive while retaining some of the capabilities of larger systems.
The controversy arises when one company’s model is systematically queried to reproduce proprietary capabilities without authorisation or in violation of the provider’s terms.
By sending carefully constructed prompts to a powerful model, developers can collect answers covering coding, mathematics, reasoning, writing and other capabilities. Those responses can then potentially be used as synthetic training data for another model.
The more queries an operator can generate, the more extensive the resulting dataset can become.
Anthropic alleges that the Alibaba-linked activity used this approach at an unprecedented scale.
151 million exchanges in three months
The reported figure of more than 151 million Claude exchanges illustrates the size of the operation.
The activity took place between May and July 2026, according to Anthropic. During that period, thousands of accounts were allegedly used to interact with Claude and gather information from the system.
The objective, Anthropic said, was to extract useful capabilities from Claude that could subsequently contribute to the development of competing AI systems.
The scale of the exchanges is particularly significant because extracting useful information from a sophisticated AI model requires more than asking the same question repeatedly. Distillation campaigns can involve carefully designed prompts intended to test different aspects of a model’s capabilities.
Operators can also vary prompts, compare responses and identify areas where the target model performs particularly well.
Such activity can create a large body of synthetic data in a relatively short period.
Qwen becomes part of the controversy
Alibaba’s Qwen models have become an important part of China’s growing AI ecosystem.
The models are designed for a wide range of applications, including general-purpose text generation, coding, reasoning and enterprise use. Qwen has also gained attention internationally as Chinese technology companies attempt to develop AI systems capable of competing with leading models from US-based companies.
Anthropic’s allegations therefore come at a sensitive time for the global AI industry.
American and Chinese technology companies are competing to develop increasingly capable models while governments on both sides are treating AI as an important strategic technology.
The alleged use of Claude outputs to enhance Qwen highlights one of the industry’s biggest concerns: whether companies can reproduce the capabilities of expensive frontier models without making comparable investments in training.
Automation changes the scale of AI misuse
The alleged campaign also highlights the growing role of automation in AI security.
Traditional misuse might involve an individual creating multiple accounts or repeatedly accessing a model. Automated systems can operate at a completely different scale.
Large numbers of accounts can be coordinated to generate prompts continuously, collect responses and organise the resulting information.
This creates new challenges for AI companies attempting to distinguish legitimate high-volume users from coordinated efforts to extract model capabilities.
The 151 million exchanges cited by Anthropic demonstrate how quickly automated interactions can accumulate.
For model developers, preventing such activity requires monitoring unusual usage patterns while ensuring that legitimate researchers, businesses and users can continue accessing their systems.
Broader concerns for AI companies
The incident raises questions about how AI companies should protect the knowledge embedded in their models.
Training a leading AI system can require enormous investments in computing infrastructure, data and research. If a competitor can obtain large amounts of useful training material simply by repeatedly querying the finished model, some of that investment could potentially be replicated more cheaply.
That makes model access itself a potential security concern.
Companies have traditionally focused heavily on protecting model weights and the infrastructure used to train AI systems. The allegations suggest that model outputs can also become valuable targets.
Even without obtaining the underlying parameters of a model, an attacker may potentially learn significant information about its behaviour through systematic interaction.
Intensifying US-China AI competition
The allegations also arrive amid intensifying technological competition between China and the United States.
Both countries are investing heavily in artificial intelligence, while restrictions on advanced semiconductor technology have made access to computing resources an increasingly important geopolitical issue.
Chinese companies have responded by developing domestic AI models and expanding investment in AI research. US companies, meanwhile, continue to push the capabilities of large foundation models.
As the competitive gap between models becomes commercially and strategically important, techniques that allow one system to learn from another are likely to attract greater scrutiny.
The Anthropic allegations could therefore contribute to a broader debate over how AI companies should define acceptable model use, particularly when competitors are involved.
What happens next?
Anthropic’s findings are likely to increase pressure on AI developers to strengthen safeguards against automated model extraction.
For Alibaba and other companies developing competing AI systems, the allegations also underscore the importance of maintaining clear boundaries around how external AI models are used during training and development.
The episode does not mean that Alibaba obtained Claude’s proprietary model weights. Rather, the allegation centres on the systematic collection of Claude’s responses through a huge number of interactions.
That distinction is significant, but the potential impact is still substantial.
As AI models become more capable, their outputs themselves are becoming valuable assets. The reported 151 million-plus exchanges show the scale at which those outputs can potentially be harvested.
Anthropic’s description of the Alibaba-linked activity as its largest illicit distillation campaign underscores a rapidly evolving challenge for the AI industry. The competition is no longer only about building better models. It is also about protecting those models from attempts to reproduce their capabilities through massive, automated interaction.
With AI development accelerating across both China and the United States, disputes over model distillation, data ownership and technological imitation are likely to become an increasingly important part of the global AI race.
