Anthropic Says Alibaba-Linked Operators Used 25,000 Accounts to Mine Claude for Qwen

Why it matters

Anthropic is turning model distillation from a terms-of-service dispute into a policy fight over who can access US frontier AI, how cloud accounts are verified, and whether cheaper Chinese models are competing on original capability or harvested outputs.

Dario Amodei's Anthropic accused operators linked to Alibaba's Qwen AI lab of using nearly 25,000 fraudulent accounts to extract Claude capabilities between April 22 and June 5, 2026, according to a June 10 letter described by Bloomberg and separately seen by Reuters.

The claim, amplified Wednesday in a thread on X, puts Alibaba inside the argument Anthropic has been building for months: that the frontier AI race is no longer just about who can buy chips or hire researchers, but who can prevent rivals from using high-end model outputs as training data. Anthropic says the Alibaba-linked campaign generated more than 28.8 million exchanges with Claude and focused on software engineering and agentic reasoning, two of the capabilities that make Claude commercially useful for developers and enterprise workflows.

Amodei and his sister, Daniela Amodei, co-founded Anthropic in 2021 after leaving OpenAI, and the company has consistently tried to frame its commercial model business as a national-security project as much as a software business. That framing matters here. Anthropic is not merely saying an account farm violated its terms. It is arguing that a major Chinese technology company used Claude outputs to accelerate the development of Qwen, Alibaba's foundation-model family, while bypassing Anthropic's decision not to offer commercial Claude access in China.

Reuters reported that Anthropic described the operation as the largest known distillation attack against the company to date. The letter was sent to Senate Banking Committee Chair Tim Scott and ranking member Elizabeth Warren, according to Reuters, before a scheduled hearing on AI. That audience was not incidental. Anthropic has been pressing the case that model distillation is an export-control problem: if a restricted entity can reach a frontier model through proxy accounts, the practical effect can resemble gaining indirect access to the underlying capability.

What Anthropic says happened

Distillation is a common technique inside AI labs: a smaller or cheaper model is trained on the outputs of a stronger model. Used within one company, it can make models faster, cheaper, or easier to deploy. Anthropic's allegation is narrower and more pointed. It says outside operators used fraudulent accounts and proxy-like access patterns to generate high volumes of Claude responses that could be used to train or improve another model.

Anthropic laid out the same playbook in a February post on detecting and preventing distillation attacks. In that earlier disclosure, Anthropic accused DeepSeek, Moonshot AI, and MiniMax of running industrial-scale campaigns that produced more than 16 million Claude exchanges through more than 24,000 fraudulent accounts. The company said those campaigns targeted agentic reasoning, tool use, coding, computer vision, and chain-of-thought-like reasoning traces.

The Alibaba allegation is larger by volume than the February cases Anthropic disclosed. Reuters' account of the June 10 letter says the campaign ran for roughly six weeks and generated 28.8 million Claude exchanges through almost 25,000 accounts. Bloomberg Law reported that Anthropic said the Alibaba-linked activity targeted Claude's prized capabilities, including software engineering and agentic reasoning.

Those are not abstract benchmark categories. Coding and agentic reasoning are where model vendors are trying to turn general chatbots into systems that can write software, call tools, execute multi-step tasks, and hold a workflow together across many actions. If a rival can cheaply harvest examples in those categories, it can reduce the amount of original training and reinforcement-learning work needed to ship a competitive model.

Why Qwen is the obvious flashpoint

Alibaba has made Qwen central to its AI push. Alibaba Cloud Model Studio markets access to Qwen, Wan, and other models for developers and enterprises, and Alibaba's commercial AI strategy depends on getting Qwen into the workflows that OpenAI, Anthropic, Google, DeepSeek, MiniMax, and Moonshot are also chasing. That makes Qwen both a product line and a distribution wedge for Alibaba Cloud.

Anthropic's accusation does not prove that Qwen's published capabilities came from Claude. It says operators affiliated with Alibaba and Alibaba Qwen ran the extraction campaign. That distinction matters: the public record described by Bloomberg and Reuters is Anthropic's allegation, not an adjudicated finding, and the letter itself is not a technical report with reproducible evidence.

Still, the timing is useful. The alleged campaign ran from April 22 to June 5, 2026, after Anthropic had already publicly warned that Chinese AI labs were using account networks to mine Claude. If Anthropic's account is accurate, the prior disclosure did not deter the behavior. It may have simply moved the fight from named specialist labs to a larger platform company with a cloud business, a model family, and a direct incentive to lower the cost of competing with US frontier labs.

The policy play is as important as the technical claim

Anthropic's February post argued that distillation attacks reinforce the case for export controls because extraction at large scale still requires compute, orchestration, and infrastructure. The June 10 letter extends that argument into Congress with a more politically legible target: Alibaba, a Chinese technology giant rather than a smaller AI lab.

That is the strategic layer under the accusation. Anthropic benefits if policymakers treat model access, cloud-account verification, and frontier-model outputs as part of the same control surface as chips. Alibaba benefits if Qwen can close performance gaps quickly and cheaply while remaining broadly available through Alibaba's own cloud channels. Developers benefit from cheaper, capable models, but the economics that make those models cheap are exactly what frontier labs are now asking regulators to scrutinize.

The unanswered question is attribution. Anthropic says it can identify distillation campaigns through IP correlation, request metadata, infrastructure indicators, account behavior, and corroboration from partners. Those methods may be strong enough for account bans and government briefings. They are not the same as a public forensic record tying a model's weights or benchmark gains to Claude-derived data.

That gap does not make the claim irrelevant. It defines the next phase of the AI platform fight. Frontier labs are selling access to models that are themselves training-data generators. Every API call can be a customer interaction, an enterprise workflow, or an attempt to turn one company's expensive capability into another company's cheaper model. Anthropic's Alibaba accusation is the clearest sign yet that model vendors now see access control as product strategy, policy strategy, and IP defense at the same time.