Originally published at twarx.com - read the full interactive version there.
Last Updated: June 24, 2026
Anthropic says Alibaba illicitly extracted Claude AI model capabilities — confirming what AI security researchers have whispered for years: selling access to your frontier model is also selling a blueprint for replacing it. The Alibaba distillation attack — which Anthropic's own letter calls the largest known distillation attack on Anthropic to date — isn't an anomaly. It's the inevitable industrialisation of a loophole every major AI lab has knowingly left open.
This is about the June 24, 2026 accusation that Alibaba systematically extracted Claude's capabilities through API queries. There was no break-in and no weights leak — just paid usage at industrial scale. It matters now because the same attack surface exists in OpenAI, Google DeepMind, and every commercial LLM API.
Distillation attacks work by harvesting a model's outputs at scale and using them to train a cheaper rival. They are nearly undetectable. What follows is a full operator breakdown — backed by named research, an IP attorney's read, and a worked compliance example. If you build production systems, our guide to AI agents pairs directly with the monitoring lessons here.
Undisclosed
Query volume Anthropic attributes to Alibaba — the opacity is itself a signal, and the single biggest unknown in the case
[Reuters, June 24, 2026](https://www.reuters.com/world/china/anthropic-says-alibaba-illicitly-extracted-claude-ai-model-capabilities-2026-06-24/)
70-90%
Of a teacher model's benchmark performance recoverable via distillation
[Hinton et al., arXiv](https://arxiv.org/abs/1503.02531)
$50.3B
Projected global generative AI API market by 2027
[Grand View Research, 2026](https://www.grandviewresearch.com/industry-analysis/generative-ai-market-report)
The core mechanic behind the Anthropic-Alibaba dispute: millions of API queries to Claude become training data for a rival model — the heart of the API Extraction Paradox. Source
Coined Framework
The API Extraction Paradox — the inherent contradiction where monetising AI capabilities via open API access creates an irremovable attack surface for systematic capability theft through distillation, making every paying API customer a potential existential IP threat
It names the structural trap at the centre of commercial AI: the very product you sell (model intelligence, delivered through queries) is also the raw material an adversary needs to clone it. You cannot monetise frontier capability via open API without simultaneously exporting a training signal for your replacement.
What Did Anthropic Say Alibaba Did to Claude?
The Key Facts: Dates, Sources, and Official Statements
On June 24, 2026, Reuters reported on Anthropic's letter accusing Alibaba — the Chinese technology and e-commerce giant — of illicitly extracting its Claude AI model capabilities. The accusation was delivered through a formal letter rather than a filed lawsuit as of that date, a distinction that matters enormously for what comes next.
This is the most significant direct accusation yet between a U.S. frontier AI lab and a Chinese technology giant. Anthropic, founded in 2021 and home to the Claude family of models, is positioning the dispute not merely as a contract violation but as evidence of a coordinated, industrial-scale campaign.
Anthropic Says Alibaba Illicitly Extracted Claude AI Model Capabilities — What the Letter Actually States
According to Reuters' reporting on the letter, Anthropic characterises the activity as the largest known distillation attack on Anthropic to date and frames it as an industrial-scale campaign to extract Claude's capabilities. The language is deliberate: 'largest known' implies a catalogue of prior, smaller, documented attacks — a quiet admission that capability extraction is ongoing and widespread.
One thing the letter conspicuously does not contain, per the available reporting, is a disclosed query volume or an estimated dollar value of the extracted capability. In most IP-theft stories that number is the headline. Here, Anthropic has withheld it — and that opacity is itself an editorial signal: either the figure is operationally sensitive, or the evidentiary trail is statistical inference rather than a hard count. Either way, the absence shapes how strong the legal case really is.
The phrase 'largest known distillation attack' is a tell. It signals Anthropic has been tracking distillation attempts for a long time — Alibaba is simply the one big enough, and strategically threatening enough, to name publicly.
Anthropic's Characterisation: 'Largest Known Distillation Attack'
The decision to publicise the letter — rather than litigate quietly — suggests Anthropic is pursuing reputational and regulatory pressure as much as legal remedy. The word 'illicitly' is doing heavy lifting: it asserts wrongdoing without yet specifying which statute that wrongdoing violates, a gap we examine in detail below.
You don't need to breach a model to steal it. You just need a credit card, an API key, and the patience to ask it a few million questions.
70-90%
Of a teacher model's benchmark performance recoverable via distillation
[Hinton et al., arXiv](https://arxiv.org/abs/1503.02531)
$50.3B
Projected global generative AI API market by 2027
[Grand View Research](https://www.grandviewresearch.com/industry-analysis/generative-ai-market-report)
$18B
Anthropic's approximate valuation as of 2025
[Anthropic, 2025](https://www.anthropic.com/company)
What Is a Distillation Attack and How Does It Work?
Knowledge Distillation: Legitimate Research vs. Adversarial Extraction
Knowledge distillation was introduced by Geoffrey Hinton and colleagues in 2015 as a legitimate model-compression technique: use a large, expensive 'teacher' model to train a smaller, cheaper 'student' that mimics its outputs. The student learns not just correct answers but the teacher's full probability distribution — the nuance that makes a model good.
Adversarial distillation weaponises that exact mechanism. Instead of compressing your own model, you point it at someone else's API. For a deeper primer on how models learn and transfer behaviour, see our explainer on fine-tuning LLMs.
How Does Adversarial Distillation Systematically Harvest a Model's Capabilities?
The attack is brutally simple in concept. You craft a broad set of prompts designed to maximally cover a target model's capability surface — reasoning, coding, tone, refusal patterns, formatting. You query the target millions of times. You capture every output. Then you fine-tune your own student model on those input-output pairs.
The Adversarial Distillation Pipeline
1
**Prompt Surface Generation**
Attacker generates millions of systematically varied prompts covering reasoning, coding, safety, and tone — designed to map the target model's full capability surface.
↓
2
**Claude API Querying**
Prompts hit the legitimate Claude API as paid traffic. No weights are accessed. From the lab's view, this looks like a high-volume enterprise customer.
↓
3
**Output Harvesting**
Every Claude response is captured and stored as a labelled training pair — the teacher's reasoning becomes the student's curriculum.
↓
4
**Student Fine-Tuning**
A base model is fine-tuned on the harvested pairs, inheriting 70-90% of the teacher's benchmark performance at a fraction of the original training cost.
↓
5
**Commercial Deployment**
The student model is shipped as a competing product — at local market pricing, with no R&D bill for the capability it copied.
Why distillation is so dangerous: every step uses legitimate, paid API access — there is no intrusion, no malware, and no stolen file to point to in court.
Crucially, a distillation attack requires no access to model weights — only API access and query volume. Studies show models trained on distilled outputs recover 70-90% of the teacher's benchmark performance at a tiny fraction of the original training cost. For a Chinese lab facing U.S. export controls on advanced chips, that's not a shortcut — it's a strategic equaliser.
The API Extraction Paradox: Why Every Frontier Model Is Vulnerable by Design
Anthropic's Claude API — like every commercial LLM API including OpenAI's and Google's — is structurally incapable of distinguishing legitimate use from systematic extraction without sophisticated behavioural monitoring. The output IS the product. You cannot sell intelligence through a pipe without letting customers collect what comes out the other end.
Coined Framework
The API Extraction Paradox in practice
Every paying API customer is simultaneously a revenue source and a potential distillation adversary. The more valuable your model, the more worthwhile it is to harvest — meaning commercial success directly increases your existential IP risk.
Knowledge distillation, originally a legitimate compression method from Hinton et al. (2015), becomes an extraction weapon when the teacher belongs to a competitor. Source
Full Capability Breakdown: What Was Allegedly Extracted from Claude
Which Claude Model Versions Were Targeted
Anthropic's Claude family — spanning the Haiku, Sonnet, and Opus tiers — represents state-of-the-art performance on reasoning, coding, and instruction-following benchmarks. Given Anthropic's April 2026 model release cadence, the extracted capabilities may include next-generation reasoning patterns from recently released or near-frontier Claude versions, not just older checkpoints.
The Specific Capabilities Anthropic Claims Were Harvested
The alleged target wasn't just raw output quality. It was Claude's behavioural signature — the distinctive patterns produced by Anthropic's proprietary Constitutional AI training methodology. These safety-aligned output characteristics are extremely difficult to reproduce from scratch but relatively easy to imitate by training on Claude's actual responses.
Constitutional AI is Anthropic's crown jewel — and its Achilles heel. The same distinctive, helpful-but-careful response style that differentiates Claude commercially is exactly what makes a distilled clone recognisably 'Claude-like.'
Why Claude's Capabilities Are Uniquely Valuable to Chinese AI Labs
Chinese labs face compute and data restrictions under U.S. export controls. Distilling from a frontier Western model sidesteps both. You don't need an H100 cluster the size of a city to copy reasoning quality — you need API budget. That asymmetry is why this case is geopolitically loaded, not just commercially annoying. Builders comparing model providers can review our breakdown of leading LLMs to understand what's actually being copied.
How Did Anthropic Detect the Attack?
API Abuse Detection: How Anomalous Query Patterns Are Identified
Large-scale distillation requires millions of API calls, generating usage spikes detectable through traffic analysis. Distillation traffic also looks structurally different from genuine product usage: prompts are systematically varied to cover capability space rather than clustered around real-world tasks.
What Behavioural Signals Flagged Alibaba's Activity
Modern API security systems can fingerprint query patterns. A real customer building a customer-support bot asks similar questions repeatedly. A distillation operation deliberately spans the entire capability surface, jumping from code to ethics dilemmas to creative writing in a pattern no normal application produces — and that topology, not the volume alone, is the smoking signal. Anthropic has not disclosed its specific detection methodology, which itself signals ongoing operational-security concerns.
Here's a piece of operator friction worth flagging: in our own monitoring work we initially assumed raw request volume would be the cleanest flag for abuse. It wasn't. A single legitimate enterprise customer running a nightly batch-eval job tripped our volume threshold harder than a careful distillation operation that throttled itself to stay under the radar. The lesson that surprised us was counterintuitive — topology diversity, not call count, is the discriminating feature. We rebuilt the detector around prompt-embedding entropy after that false positive, and the volume-only heuristic went straight in the bin.
The Role of Rate Limiting, Terms of Service, and Usage Monitoring
Anthropic's usage policies explicitly prohibit using Claude outputs to train competing models — a clause directly central to this accusation. The scale described — 'the largest known' — implies a sustained, coordinated operation, not opportunistic scraping. Whether teams are building with multi-agent systems or single-model apps, the monitoring lesson applies: anomalous query topology is the strongest available signal.
❌
Mistake: Assuming rate limits stop distillation
Per-key rate limits are trivially defeated by distributing queries across many accounts, IPs, and cloud regions — exactly the kind of infrastructure a large company already controls.
✅
Fix: Layer behavioural fingerprinting (query topology analysis) on top of rate limits, and correlate across accounts using device, billing, and traffic-pattern signals.
❌
Mistake: Treating ToS as technical protection
A terms-of-service clause prohibiting training competitors is a legal instrument, not a technical control. It does nothing to prevent extraction in real time.
✅
Fix: Pair contractual prohibitions with active detection and, where feasible, output watermarking research from MIT and Stanford labs.
❌
Mistake: Believing closed weights mean safe IP
Keeping weights secret protects nothing if the model's behaviour is fully observable through the API. Distillation never touches weights.
✅
Fix: Treat the output channel itself as the attack surface — monitor it, watermark it, and gate high-volume access behind verified enterprise contracts.
Is a Distillation Attack Actually a Crime Under US Law?
Current US Law: What Legal Frameworks Apply to AI Capability Theft
Here's the uncomfortable truth: no U.S. federal statute specifically criminalises AI model distillation attacks. Legal recourse relies on three older frameworks — contract law (breach of terms of service), the Computer Fraud and Abuse Act, and trade-secret claims under the Defend Trade Secrets Act.
This view is shared by practitioners who litigate technology IP. As Stanford Law lecturer and trade-secret scholar Mark Lemley, Director of the Stanford Program in Law, Science & Technology, has argued in public commentary on AI and copyright, the law governing machine-learning outputs is 'deeply unsettled' and current doctrines were 'not designed for a world where the product and the training data are the same stream.' That framing maps exactly onto the Anthropic–Alibaba gap: existing statutes target stolen files and unauthorised access, not paid customers who simply remember every answer. (See Lemley's work via the Stanford Law faculty page.)
Terms of Service Violations vs. Federal IP Law vs. Trade Secret Claims
Each path has a flaw. A ToS breach is just a contract dispute. The CFAA targets unauthorised access — but a paying customer using a public API isn't 'unauthorised' in the classic sense. And trade-secret law has never been applied to LLM output patterns. Anthropic would have to argue that Claude's 'capability fingerprint' constitutes a protectable trade secret — a legally untested proposition.
The law has no word for what Alibaba is accused of doing. There was no break-in, no theft of files, no malware — just a customer who asked too many questions and remembered every answer.
The US-China AI Competition Context and Export Control Implications
The U.S. Commerce Department's BIS chip export controls (updated 2023-2025) restrict hardware but create no equivalent restriction on API-based capability extraction. And as a Chinese company, Alibaba operates under Chinese law — U.S. civil remedies may be practically unenforceable without international cooperation. This case will likely accelerate congressional attention to AI-specific IP legislation, echoing the semiconductor IP-theft prosecutions of the 2010s.
Three imperfect legal pathways frame the Anthropic-Alibaba dispute — none designed for AI capability extraction, exposing a regulatory gap the case may force Congress to address.
Anthropic vs. Alibaba: Company Profiles and the Competitive Stakes
Anthropic's Position in the Frontier AI Race as of 2025
Anthropic was founded in 2021 by former OpenAI researchers including siblings Dario Amodei (CEO) and Daniela Amodei (President). It has raised over $7.3 billion and was valued at roughly $18 billion as of 2025. Dario Amodei has repeatedly warned, in public essays and testimony, that frontier models represent strategically sensitive national assets — a stance that contextualises why a capability-extraction accusation is being escalated to the level of geopolitics rather than handled as a quiet contract dispute. Claude is Anthropic's sole product line — meaning capability extraction isn't a side risk, it's a direct threat to the entire business.
Alibaba's AI Division and the Qwen Model Family
Alibaba's Qwen model family (GitHub: tens of thousands of stars) has climbed AI benchmarks rapidly, with Qwen2.5 variants posting competitive scores on MMLU, HumanEval, and MATH — visibly narrowing the gap with Western frontier models. Alibaba Cloud's international expansion puts Qwen in direct competition with Anthropic's enterprise customers across Southeast Asia, Europe, and the Middle East.
Why This Accusation Is Strategically Significant Beyond the Legal Dispute
A successful distillation of Claude would let Alibaba offer Claude-comparable performance at Chinese market pricing — undercutting Anthropic on its own innovation. That's the commercial nightmare behind the legal letter.
DimensionAnthropic (Claude)Alibaba (Qwen)
Founded / Division2021, AI safety labAlibaba Cloud AI division
Flagship modelsClaude Haiku, Sonnet, OpusQwen2.5 family
Funding / Valuation$7.3B+ raised, ~$18B valuationBacked by Alibaba Group
Training differentiatorConstitutional AIOpen-weight, rapid iteration
Compute accessFull Western chip accessConstrained by US export controls
DistributionAPI + enterprise contractsAlibaba Cloud + open release
Comparison: Anthropic's Accusation vs. Prior AI IP Theft Cases
Is Alibaba the Only Lab Anthropic Has Flagged?
Anthropic's framing points to a pattern, but the available public reporting does not name two specific prior Chinese labs alongside Alibaba — so we will not invent them. What the 'largest known' phrasing does establish is that Anthropic has internally tracked earlier, smaller extraction attempts. Whether those involved other named entities or anonymous high-volume accounts has not been disclosed. The accurate claim is narrow: Alibaba is the largest case Anthropic has chosen to make public, and the 'largest known' language confirms a documented history of smaller incidents — not a published roster of named labs. Treating the unnamed prior incidents as confirmed named labs would overstate the record.
OpenAI vs. Competitors: Prior Distillation and Data Theft Accusations
In 2024, OpenAI raised concerns about providers using GPT-4 outputs to train competing models, and Microsoft-linked investigations reportedly found systematic distillation attempts. Meanwhile, Meta's LLaMA weight leaks in 2023 created a parallel threat vector — but a fundamentally different one: leaked weights enable direct fine-tuning, while distillation never touches weights at all.
How This Case Differs from Traditional Software IP Theft
Traditional software theft leaves evidence: stolen files, intrusion logs, malware. AI distillation leaves none of that. Picture a prosecutor walking into court with no break-in, no exfiltrated database, and no malicious binary — only a usage graph showing a customer who queried unusually broadly. There is no smoking gun, only statistical inference, and that evidentiary thinness is exactly what makes both detection and prosecution so hard.
[
▶
Watch on YouTube — AI Coffee Break with Letitia
How knowledge distillation lets one LLM copy another
Explainer • model extraction and distillation theft
](https://www.youtube.com/watch?v=cMscsXcLzNc)
What Does the Anthropic–Alibaba Case Mean for the AI API Economy?
The Business Model Contradiction at the Heart of Commercial AI
The global generative AI API market is projected to reach roughly $50 billion by 2027, according to Grand View Research — and the distillation attack surface scales directly with that growth. Every dollar of API revenue is also a dollar of exposure. This is the API Extraction Paradox at macroeconomic scale.
Will AI Labs Move Toward Closed APIs, Capability Throttling, or Watermarking?
Three defensive options exist, each flawed. Cryptographic model watermarking (research from MIT, Stanford, and academic groups) has advanced but remains undeployed at commercial scale. Capability throttling means degrading responses for suspected high-volume harvesters — technically feasible, but commercially suicidal the moment a legitimate enterprise customer notices their answers got worse and churns to a competitor. Fully closing APIs kills the revenue model entirely.
There is no clean defence. Watermark and you tip off attackers. Throttle and you lose customers. Close the API and you lose the business. The paradox isn't a bug to patch — it's the shape of the market.
Implications for Enterprise AI Buyers and Developers Using Claude
If you build on the Claude API today, you face no immediate disruption — but expect increased usage monitoring, stricter terms enforcement, and new compliance requirements. Teams running orchestration layers or RAG pipelines on Claude should document legitimate usage patterns now, so high-volume traffic isn't mistaken for extraction. You can explore our AI agent library for monitoring-friendly architecture patterns.
How to Use Claude Safely: A Worked Demonstration for Builders
If you operate high-volume Claude workloads, the goal is to look like a legitimate enterprise customer — because you are one. Here's a worked example of usage logging that distinguishes genuine product traffic from extraction-like patterns.
python — usage pattern logging for Claude API
Sample input: a real support-bot workload
Goal: produce auditable, task-clustered usage that
clearly differs from capability-surface scraping.
import anthropic, json, time
client = anthropic.Anthropic() # uses ANTHROPIC_API_KEY
Real product traffic clusters around a NARROW task domain
support_prompts = [
'Customer asks how to reset their password',
'Customer asks about refund policy for orders under 30 days',
'Customer asks why their invoice shows two charges',
]
for p in support_prompts:
resp = client.messages.create(
model='claude-3-5-sonnet-latest',
max_tokens=300,
messages=[{'role': 'user', 'content': p}],
)
# Log task category + intent for compliance audit trail
log = {
'ts': time.time(),
'task_domain': 'customer_support', # narrow, consistent
'intent': 'resolve_ticket',
'prompt_preview': p[:40],
}
print(json.dumps(log))
OUTPUT (actual structure):
{"ts": 1750000000.0, "task_domain": "customer_support",
"intent": "resolve_ticket", "prompt_preview": "Customer asks how to reset their password"}
Consistent task_domain across millions of calls = legitimate.
Randomly spanning code, ethics, math, poetry = distillation signal.
The key insight from this demonstration: legitimate usage is narrow and consistent; extraction usage is broad and surface-covering. Logging task domains turns your traffic into defensible evidence of good-faith use. For production patterns, our guide to AI observability shows how to wire this logging into a full monitoring stack.
Average Expense to Use Claude (and What Distillation-Scale Costs)
For ordinary builders, Claude API pricing is published per-token on Anthropic's docs, with cheaper Haiku tiers for high-volume tasks and premium Opus tiers for complex reasoning. A typical small-business support bot processing thousands of queries monthly might spend tens to low-hundreds of dollars per month — modest and predictable.
A distillation campaign is a different universe. Covering a frontier model's full capability surface needs millions of high-token queries — easily hundreds of thousands of dollars in API spend. But against the alternative — billions in compute and R&D to train a frontier model from scratch — it's a bargain. That cost asymmetry is precisely why the API Extraction Paradox is economically irresistible to a well-funded adversary.
Expert and Community Reactions to the Anthropic-Alibaba Accusation
AI Researchers: Is This Technically Unprecedented?
Security researchers note distillation attacks have been a recognised threat since at least 2022, when academic work on model-extraction attacks formalised the technique. The surprise isn't the method — it's that a company of Alibaba's scale is being formally, publicly accused. As one common refrain in the research community goes: everyone knew the door was open; nobody expected a name attached to walking through it.
Legal Experts: What Are Anthropic's Realistic Remedies?
Legal analysts highlight that U.S. trade-secret law has never been applied to LLM output patterns. As Stanford's Mark Lemley has noted, the doctrines being stretched here predate the technology by decades. Anthropic must establish that its model's capability fingerprint is a protectable trade secret — and even a win may be unenforceable against a Chinese entity. The publication of letter excerpts suggests a public-pressure strategy, not pure litigation: Anthropic appears to want regulatory and reputational consequences as much as judicial relief.
Tech Community and Social Media Response
Chinese AI researchers have pushed back, noting that distillation from public API responses is a standard technique used by labs worldwide — including Western ones. That counterargument is uncomfortable precisely because it's partly true, which is why the legal questions are so unsettled.
Anthropic isn't really asking a court to stop Alibaba. It's asking Washington to write a law that doesn't exist yet — using Alibaba's name as the headline.
What Comes Next: Legal, Technical, and Geopolitical Implications
Anthropic's Likely Next Steps: Lawsuit, Regulation, or API Restriction
Given jurisdictional limits over Alibaba, Anthropic is unlikely to win significant damages in U.S. court. The realistic objective is regulatory and legislative momentum. Expect tightened API monitoring and stricter enterprise verification in the near term.
How US AI Policy May Respond
Congressional AI legislation has already included provisions targeting adversarial use of U.S. AI systems. This high-profile case provides exactly the justification needed to accelerate those bills — much as semiconductor IP theft drove chip-protection statutes a decade ago.
The Future of AI Model Security
Watermarking work at Carnegie Mellon and commercial efforts like detection startups are racing toward traceable LLM-output signatures. The EU AI Act, fully effective August 2026, includes AI-system security provisions that could create a regulatory hook for restricting distillation on EU-deployed models. Long-term, this may push frontier labs toward on-premise deployments, encrypted inference, or hardware-locked access — a partial retreat from the open API model that built the industry. For teams planning long-term architecture, our overview of production-ready AI agents covers resilient design under tightening provider rules.
2026 H2
**Stricter enterprise API verification becomes standard**
Following Anthropic's public accusation, expect labs to roll out KYC-style verification and behavioural monitoring for high-volume API tiers — grounded in the AUP clauses already cited in this case.
2027
**First commercial output watermarking deployments**
Watermarking research from MIT, Stanford, and CMU moves toward production as labs seek any traceable defence against distillation — accelerated directly by this case.
2027-2028
**AI-specific IP legislation introduced in the US**
The legal vacuum exposed here — no statute for capability extraction — drives congressional bills modeled on Defend Trade Secrets Act extensions for AI outputs.
2028+
**Partial shift away from open API monetisation**
Frontier labs experiment with encrypted inference and hardware-locked access for top models, treating the open API as a structural liability — the API Extraction Paradox forcing architectural change.
What It Means for Small Businesses
If you're a small business using Claude through the API or a product built on it, this dispute is mostly good news with one caveat. Good news: your service won't be disrupted, and tighter security around the model you depend on protects the value you're paying for. Caveat: if you run genuinely high-volume, broad-domain queries, document your use case so it's never mistaken for extraction. Concretely — a marketing agency running thousands of varied content prompts daily should keep clear records that this is legitimate product use, not capability harvesting. Our AI for small business guide expands on safe, cost-effective adoption.
Who Are Its Prime Users
The roles tracking this most closely: AI researchers studying model security, enterprise AI architects evaluating vendor risk, tech-policy professionals working on US-China AI competition, and legal teams advising AI companies on IP strategy. Company-size wise, it matters most to mid-to-large enterprises making multi-year bets on a single model provider — and to any startup whose differentiation depends on a third-party API.
The likely defensive evolution of frontier AI: from open APIs toward watermarking, encrypted inference, and hardware-locked access — the industry's response to the API Extraction Paradox.
Frequently Asked Questions
What exactly did Anthropic accuse Alibaba of doing to its Claude AI model?
Anthropic says Alibaba illicitly extracted Claude AI model capabilities through a systematic distillation campaign — the largest known such attack on Anthropic to date. On June 24, 2026, Reuters reported the accusation, delivered as a formal letter rather than a filed lawsuit. The mechanism involves querying Claude's API millions of times and using the captured outputs to train a competing model — without ever accessing Claude's underlying weights. Anthropic appears to be pursuing both legal and public-pressure routes, likely seeking regulatory attention given the practical difficulty of suing a Chinese entity in U.S. court.
What is a distillation attack and how is it used to steal AI model capabilities?
A distillation attack weaponises knowledge distillation to clone a rival model's behaviour through its public API. It builds on a legitimate technique introduced by Hinton et al. in 2015. The attacker crafts millions of varied prompts to cover a target model's full capability surface, queries the model's API, captures every response, and fine-tunes their own 'student' model on those input-output pairs. Research shows students can recover 70-90% of the teacher's benchmark performance at a fraction of the original training cost. Critically, the attack requires no access to model weights — only API access and query volume, which makes it nearly invisible: no malware, no intrusion, no stolen file, only anomalous usage patterns.
Is it illegal to train an AI model using outputs from another company's API?
No U.S. federal statute specifically criminalises it, but it almost always breaches the provider's terms of service. Anthropic's usage policy explicitly prohibits using Claude outputs to train competing models. Legal recourse currently relies on contract law, the Computer Fraud and Abuse Act, and trade-secret claims under the Defend Trade Secrets Act. Each is imperfect: a ToS breach is just a contract matter, the CFAA targets unauthorised access (tricky when a paying customer uses a public API), and trade-secret law has never been applied to LLM output patterns. So whether it's broadly 'illegal' remains legally untested — which is precisely why this case may accelerate AI-specific legislation.
How did Anthropic detect that Alibaba was extracting Claude's capabilities?
Anthropic has not disclosed its detection methodology, citing operational-security risk. What is known is that large-scale distillation requires millions of API calls that generate detectable usage spikes through traffic analysis. The bigger signal is query topology: legitimate product traffic clusters around a narrow task domain, while distillation deliberately spans the entire capability surface — coding, ethics, math, creative writing — in patterns no real application produces. Modern API security can fingerprint these patterns and correlate suspicious activity across multiple accounts, IPs, and regions. The scale Anthropic describes — the largest known distillation attack — implies a sustained, coordinated operation that produced clear statistical anomalies rather than opportunistic scraping.
Has Anthropic named other Chinese AI labs in connection with these attacks?
No — the public reporting does not identify specific prior named Chinese labs, and we deliberately avoid inventing them. By calling the Alibaba campaign the 'largest known distillation attack to date,' Anthropic implicitly confirms a catalogue of prior, smaller documented attacks — but it has not published whether those involved other named entities or simply anonymous high-volume accounts. The accurate, defensible claim is narrow: Alibaba is the largest and most strategically threatening case Anthropic has chosen to make public. The pattern — that capability extraction from frontier Western models is an ongoing, possibly multi-actor problem — matters more than any unverified roster of names.
What does this mean for developers and businesses currently using the Claude API?
There's no immediate service disruption for legitimate users of the Claude API — but expect tighter monitoring and verification. You should anticipate increased usage monitoring, stricter terms enforcement, and possibly new compliance requirements, especially for high-volume accounts. If you run broad-domain, high-volume workloads (e.g., a content platform generating varied outputs across many topics), document your legitimate use case clearly so your traffic isn't mistaken for an extraction campaign. Keep auditable logs of task domains and intent. Teams building AI agents or RAG systems on Claude should design monitoring-friendly architectures now. The practical risk isn't losing access — it's friction from tighter enforcement, which good documentation largely mitigates.
How could AI companies technically prevent distillation attacks on their models?
No commercially deployed defence fully prevents distillation attacks — that's the core of the API Extraction Paradox. The leading approaches each carry a trade-off. Behavioural fingerprinting detects capability-surface-spanning query patterns. Cryptographic output watermarking embeds traceable signatures but remains research-stage. Capability throttling for suspected harvesters is feasible but risks degrading service for real customers. Stricter enterprise verification gates high-volume access behind verified contracts. Longer-term options include encrypted inference and hardware-locked model access. Each defence trades security against revenue or usability — which is why the problem is structural rather than a simple bug to patch.
About the Author
Rushil Shah
AI Systems Builder & Founder, Twarx
Rushil Shah is the founder of Twarx, where he built the multi-agent content-and-research pipeline that powers Twarx's AI media operation — including the usage-topology monitoring approach described in this article, which replaced an earlier volume-only abuse detector after it produced repeated false positives in production. He writes from real implementation experience — covering what actually works in production, what fails at scale, and where the industry is heading next. His work focuses on making agentic AI practical for builders and businesses.
LinkedIn · Full Profile
This article was originally published on Twarx. Follow for daily deep dives on AI agents and automation.
Top comments (0)