Anthropic is pressing lawmakers to treat alleged AI model cloning as a national security problem, not just a terms-of-service violation. In a June 10 letter to Senators Tim Scott (R-SC) and Elizabeth Warren (D-Mass.), the company accused operators affiliated with Alibaba and Alibaba Qwen of running what it described as the largest campaign it has measured to extract Claude’s capabilities.
The allegation centers on a technique Anthropic calls illicit distillation: using a frontier model’s outputs to help another model gain similar skills without bearing the same training and R&D costs. Anthropic says the campaign targeted high-value Claude capabilities, including agentic reasoning, software engineering, and long-horizon tasks.
What Anthropic says happened
According to Anthropic, the activity took place between April 22 and June 5. During that period, the company says operators affiliated with Alibaba and Alibaba Qwen generated more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts.
Anthropic told the senators that the campaign violated Claude’s terms of service and access restrictions. The company also said the operators tried to avoid detection by using obfuscation techniques and proxy networks.
The scale matters because Anthropic frames the incident as part of a broader pattern. It says similar tactics have been used by Chinese firms DeepSeek, Moonshot, and MiniMax, which it previously accused of generating over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts. Anthropic also said OpenAI and Google have published findings on similar attacks on their models.
For Anthropic, the core concern is not only that a rival company may have broken platform rules. It is that repeated extraction attempts could turn American AI investment into a shortcut for foreign competitors.
Why Alibaba is central to the dispute
Anthropic’s letter argues that Alibaba’s alleged activity is especially significant because the company is tied to US markets and US oversight. The letter noted that Alibaba is listed on the New York Stock Exchange, maintains business operations in the United States, and is accountable to US investors and regulators.
Anthropic also pointed to timing. The alleged campaign unfolded after Donald Trump took steps to curb illicit distillation attacks and defend US national security. In April, Trump accused China of “industrial-scale” AI theft after Anthropic made earlier claims about Chinese firms using similar tactics.
Alibaba, meanwhile, is already in conflict with the Trump administration on another front. In a lawsuit filed Tuesday, Alibaba accused the administration of blacklisting the company after falsely linking it to the Chinese military, according to Reuters. Alibaba is seeking to remove the designation, which it said has “no basis in fact or law.”
“Alibaba is governed by an independent board, none of whom has any military affiliation,” Alibaba said. “Its products and services are built for retail, logistics, and enterprise information technology—not weapons, defense, or intelligence.”
Ars could not immediately reach Alibaba for comment on Anthropic’s allegations. Anthropic, however, appears unconvinced that stronger scrutiny is unnecessary.
The policy agenda Anthropic is pushing
Anthropic’s letter does more than describe an alleged attack. It asks Congress to change the rules around how AI companies and the US government respond to suspected model extraction.
The company recommended legislation with three main goals:
- Information sharing: Anthropic wants antitrust laws updated so AI firms can share information about evolving Chinese tactics.
- Export controls: It called for more controls on chips to limit Chinese access to advanced compute.
- Penalties: It urged Congress to make Chinese labs’ “bad behavior” more difficult and costly.
Anthropic suggested penalties could include limiting Chinese firms from accessing US models, advanced US chips, or data centers outside of China. The company’s argument is that if labs cannot easily train on US model outputs, distillation attacks become less useful.
Anthropic declined to say whether Alibaba’s alleged campaign was enough to meaningfully accelerate China’s AI capabilities. It also declined to discuss specific steps taken to stop the attacks. Instead, a spokesperson emphasized coordination between government and industry.
“We believe combating the threat of illicit distillation requires coordinated action between government and industry, and we will continue working with Congress and the Administration to maintain American AI leadership,” Anthropic said.
Why Claude and Mythos are part of a larger race
Anthropic’s concerns are tied to the wider competition around frontier AI systems. The company warned that without stronger interventions, distillation attacks could help China reach Mythos Preview-level capabilities sooner.
That matters, Anthropic argues, because advanced AI capabilities could affect cybersecurity. The company warned that China could gain “advanced cyber capabilities to deploy against the US government and American companies and exploit vulnerabilities faster than previously possible.”
Anthropic also said the larger the capability gap, the more time the US government has to harden cyber defenses and adopt AI systems across national security domains. Its view is that slowing unauthorized capability transfer buys time for preparation.
The company raised a second concern: if advanced AI models are released with weak safeguards and are easily jailbroken, other US adversaries could use them for activities contrary to US interests.
What happens next
Alibaba’s AI work is already highly visible. The source article says Alibaba’s models have been downloaded more than 700 million times and are at the frontier of China’s AI industry. People’s Daily recently described Alibaba’s Qwen family of AI models as “the most popular open-source AI system worldwide.”
The controversy may also affect Alibaba’s US-facing business. Yahoo Finance reported that Alibaba’s stock dropped 3 percent after Anthropic’s accusations became public.
Anthropic’s message to lawmakers is clear: it wants alleged model extraction campaigns treated as a serious strategic threat. Whether Congress accepts that framing will shape how far the US goes in restricting access to models, chips, and compute infrastructure in the name of AI security.