Alibaba Used 25K Fake Accounts to Clone Claude

Between April 22 and June 5, Alibaba and its Qwen AI lab allegedly ran 28.8 million conversations with Claude through nearly 25,000 fake accounts — the largest attempt to copy a frontier AI model ever documented, according to a letter Anthropic sent to US senators on June 10. The targets were Claude's most advanced capabilities: agentic reasoning, complex multi-step tasks, and software engineering.

Anthropic told senators the attackers used proxy networks and obfuscation techniques to avoid detection. The core technique is sometimes called 'distillation': if you ask a powerful model enough questions and collect its answers, you can use that data to train a cheaper model that mimics the original without paying for the research behind it. An earlier campaign — attributed to DeepSeek, Moonshot, and MiniMax — used roughly 24,000 accounts to generate over 16 million Claude exchanges. Alibaba's alleged operation nearly doubled that.

Why this technique is so hard to stop

A distillation attack needs no vulnerability in the software and no physical access to hardware. It just needs accounts — thousands of them — and patience. The attackers behave exactly like ordinary users, except at enormous scale. Anthropic's infrastructure can't easily tell the difference between a real developer exploring Claude's capabilities and an automated campaign systematically extracting them. That is why detection requires statistical analysis across millions of sessions, not a simple firewall rule.

Anthropic framed the broader pattern as a structural problem: every successful distillation attack converts hundreds of billions of dollars in American AI research into a free training set for anyone willing to run the operation. The letter urged Congress to pursue three things. First, update antitrust rules so that AI companies can legally share threat intelligence with each other — right now, coordinating defenses across competitors sits in a legal gray zone. Second, tighten export controls on advanced chips to make it harder to train on the collected data. Third, create meaningful legal penalties for labs that conduct these attacks, making the risk-reward calculus less favorable.

What it means for people who build with Claude

If you use Claude through the API or in Claude Code, nothing changes in your day-to-day experience — but the stakes behind the scenes are real. Anthropic's competitive advantage is its research: the careful safety work, the training techniques, the alignment innovations. Distillation attacks let rivals skip that investment and arrive at something similar for a fraction of the cost. That drives up pricing pressure on legitimate users, since Anthropic has to invest more in detection and security, and it accelerates a race dynamic where the most capable models become targets the moment they ship.

Alibaba, for its part, has separately sued the Trump administration over a different designation, arguing the company has no military ties. The distillation allegations and that lawsuit are running on parallel tracks. Anthropic says it has 'confidential evidence' of the campaign — detailed enough to bring to Congress — but has not filed a civil suit as of publication.