Anthropic has accused Alibaba-affiliated operators of using nearly 25,000 fraudulent accounts to extract capabilities from its Claude artificial intelligence models, an alleged campaign the US AI developer describes as the largest known attack of its kind against the company.

The activity is said to have unfolded between April 22 and June 5 and generated more than 28.8 million exchanges with Claude. According to a June 10 letter sent to senior members of the US Senate Banking Committee, the effort involved a technique known as distillation, in which a less capable AI model is trained on the outputs of a more advanced system.

Anthropic said the alleged campaign was conducted by operators affiliated with Alibaba and Alibaba Qwen, the company's AI lab. Alibaba did not immediately respond to a request for comment.

Key facts at a glance

• Anthropic accused Alibaba-affiliated operators of using nearly 25,000 fake accounts to scrape Claude.
• The alleged campaign ran from April 22 to June 5 and produced more than 28.8 million exchanges.
• Anthropic described the activity as the largest known attack of its kind against the company.
• The alleged method was distillation, which trains a weaker model on a stronger model's outputs.
• Anthropic raised the allegations in a June 10 letter to senior members of the US Senate Banking Committee.
• Alibaba did not immediately respond to a request for comment.

The allegation lands as generative AI spreads across business functions and vendors face growing pressure to prove they can detect misuse while keeping services available for corporate customers. It also arrives at a moment when AI development is increasingly entangled with US-China technology tensions.

Anthropic said the alleged campaign could help accelerate China's ability to reach the capabilities of its advanced Mythos Preview model. US officials have stepped up scrutiny of advanced AI systems over concerns that they could be used by military or intelligence users in countries of concern.

The disclosure is not Anthropic's first warning about model extraction. In February, the company said it had identified similar campaigns by DeepSeek, Moonshot AI and MiniMax to extract capabilities from Claude. The alleged activity ranged from more than 150,000 exchanges by DeepSeek to more than 13 million by MiniMax.

Viewed together, the incidents suggest that model extraction is becoming a persistent operational risk rather than an isolated security event. The alleged scale of the Alibaba-linked campaign, if confirmed, would dwarf the earlier cases cited by Anthropic and would put model distillation squarely on the agenda for AI vendors, enterprise customers and policymakers.

A new supply chain risk

If Anthropic's claims are true, the alleged campaign could allow Alibaba to build a comparable model in a short period and offer it at a much lower cost, said Anand Joshi, an AI analyst at TechInsights. That prospect is especially troubling for enterprises that rely on third-party AI models as core infrastructure.

Analysts said the alleged campaign points to a broader pattern beyond the two companies. Model extraction appears to be escalating rather than remaining an isolated risk. The enterprise supply chain no longer ends at software, APIs and cloud regions, according to Sanchit Vir Gogia, chief analyst at Greyhound Research. It now includes rented intelligence, he said, and rented intelligence can be copied and redeployed well outside the safety controls it was born with.

Gogia said distillation should be a board-level concern because a weaker model trained on a stronger one can inherit its capabilities without the governance and controls around the original system. That concern extends beyond intellectual property. It touches on security, vendor continuity and the integrity of automated decision-making systems that businesses increasingly depend on.

For enterprises, the allegations point to a potentially more serious risk than conventional intellectual property theft: reverse engineering at scale. If proven, they would suggest that AI models can be copied systematically, turning model extraction into a new AI supply-chain risk.

Pareekh Jain, CEO of Pareekh Consulting, framed the risk in stark terms. If a rival can clone the exact brain of the AI a company relies on, he said, that rival can easily find its blind spots, hack automated systems, or cause the AI vendor to panic and shut down services that a business needs to run every day.

The scenario puts pressure on AI vendors to demonstrate that they can identify coordinated abuse before it reaches industrial scale. It also puts pressure on enterprise buyers to treat model access as a supply-chain relationship rather than a simple software subscription. A service that powers customer support, fraud detection, software development or financial analysis can become a single point of failure if the model behind it is compromised, cloned or withdrawn.

Why model extraction is difficult to police

Distillation is a legitimate technique in many AI development workflows. Developers often use outputs from larger models to improve smaller models for cost, latency or deployment reasons. The dispute is not about the technique itself but about alleged unauthorized use at scale and the creation of fake accounts to evade controls.

Large-scale extraction is difficult to detect because it can look like ordinary usage spread across many accounts. Attackers can rotate identities, vary prompts and distribute queries to avoid rate limits. Defenders must distinguish between genuine customer demand, automated testing, research activity and coordinated scraping. That challenge grows as models become more capable and as the commercial value of their outputs rises.

Anthropic's allegations also highlight the tension between openness and abuse prevention. AI services need to be accessible to developers and businesses, but broad access creates opportunities for misuse. Vendors must balance verification, rate limiting and monitoring without imposing friction that drives away legitimate customers.

For buyers, the lesson is that model access is not just a procurement decision. It is a risk-management decision that should include questions about how the vendor detects extraction, what contractual protections exist and how quickly the vendor can restore service if an attack disrupts operations.

Mitigating the risks

The allegation raises questions about the controls AI vendors have in place and how customers can protect themselves. Jain said vendors should provide verified accounts, smart rate limits, abuse detection, usage monitoring, contractual bans on distillation, incident disclosure and audit rights.

Enterprises should ask how the vendor detects and blocks large-scale model extraction, Jain said. They can also demand contracts that guarantee backup plans and financial refunds if the AI service is attacked or suddenly shut down.

Joshi said enterprise customers should press vendors for greater transparency around model development and safeguards. Buyers should ask what training data was used, how the model was trained, what guardrails exist and how they can audit it.

Model publishers will also need to invest in watermarking technology for both models and model responses, Joshi said. If model skills are stolen, vendors should be able to identify the source. Watermarking is not a complete solution, but it can improve attribution and deter some forms of misuse.

Legal and contractual protections are likely to become more important as well. Enterprises may seek warranties, indemnities and service credits tied to security incidents. They may also ask for evidence of independent audits and for commitments around incident notification. For AI vendors, those demands could raise costs, but they also create differentiation in a market where trust is a competitive asset.

Regulators are watching closely. The letter to senior members of the US Senate Banking Committee signals that AI model extraction is no longer only a technical or commercial issue. It is becoming part of the broader policy debate over advanced AI, national security and technology competition.

Anthropic's allegations against Alibaba-affiliated operators remain allegations, and Alibaba has not responded publicly. But the case has already sharpened a question that enterprises will face with or without a formal finding: how much of their business depends on a model they cannot audit, control or replace quickly if the vendor's defenses fail.

Source:InfoWorld News