Alibaba Executed 28.8 Million-Exchange Distillation Attack on Claude AI, Anthropic Tells US Senate

Anthropic has formally accused Alibaba and its AI research division, Alibaba Qwen, of conducting the largest known distillation attack on its Claude AI platform to date. In a letter dated 10 June 2026 and addressed to the US Senate Banking Committee, Anthropic detailed a coordinated campaign that generated more than 28.8 million exchanges with Claude through nearly 25,000 fraudulent accounts over a 45-day period running from 22 April to 5 June 2026.

The attack targeted the most commercially valuable and technically advanced capabilities within the Claude platform, including software engineering proficiency and agentic reasoning, the core competencies of Anthropic's most powerful model, Mythos Preview. The technique used is known as adversarial distillation, a method in which a less capable AI model is trained on the outputs of a more powerful one, allowing the attacker to replicate advanced capabilities at a fraction of the cost and time required to develop them independently.

What Adversarial Distillation Actually Does

Distillation in legitimate AI development refers to the process of training a smaller, more efficient model to approximate the behaviour of a larger one. Adversarial distillation uses the same technical mechanism but applies it without authorisation, systematically querying a target model at scale and using the responses to train a competing system. At 28.8 million exchanges, the Alibaba operation dwarfs the previous attacks Anthropic had disclosed publicly.

In February 2026, Anthropic revealed three earlier distillation campaigns by Chinese AI developers. DeepSeek's operation involved more than 150,000 exchanges with Claude. Moonshot AI conducted over 3.4 million exchanges. MiniMax carried out more than 13 million. The Alibaba campaign surpasses all three combined, and represents what Anthropic described as a systematic and unauthorised attempt to exploit US AI development at industrial scale.

Anthropic noted in the letter that models built through adversarial distillation frequently lack the safety guardrails embedded in the original system. An AI model trained on Claude's outputs at this scale would absorb Claude's capability profile without inheriting the constitutional AI constraints, usage policies, and safety mitigations that Anthropic has spent years developing. The security implications extend beyond intellectual property theft: capability proliferation without safety architecture creates a category of risk distinct from simple model copying.

The Regulatory and Policy Context

The letter was sent to Senator Tim Scott and Senator Elizabeth Warren, the chair and ranking member of the Senate Banking Committee, ahead of a scheduled hearing on artificial intelligence. Alibaba's US-listed shares fell more than three percent following the disclosure.

The timing of the campaign is notable. Anthropic's letter states that the Alibaba operation ran after a White House memo issued in April 2026 by science adviser Michael Kratsios, which specifically warned that the administration would move to impose costs on Chinese distillation activities and characterised large-scale output exploitation as a national security concern. The Alibaba campaign continued after that signal, a fact Anthropic highlighted in its letter as evidence of deliberate disregard for US policy.

Two days after Anthropic sent the letter, on 12 June, the Commerce Department imposed export control restrictions on Anthropic's most advanced Mythos and Fable models, citing concerns that they could be accessed by military intelligence users in China and other countries of concern. The restrictions required Anthropic to disable global access to those models. The sequence of events, a distillation campaign targeting Mythos followed by government restrictions on Mythos access, illustrates the interconnected nature of the AI security, trade, and intellectual property challenges now playing out between the US and China.

Alibaba was added to the Pentagon's list of alleged Chinese military-linked companies on 8 June 2026, a designation it is challenging in court. Alibaba had not responded to requests for comment at the time of publication.

Implications for GCC Enterprises and Regional AI Strategy

For enterprise and government technology leaders across the UAE, Saudi Arabia, and the wider Gulf, the Alibaba disclosure carries several direct implications that go beyond the US-China dimension of the story.

First, the Mythos and Fable model restrictions that followed this attack are the same restrictions that disrupted access for enterprise users across the GCC. GCC banking and financial services organisations that had been evaluating Mythos Preview for compliance, fraud detection, and agentic workflow automation found themselves without access to those systems following the 12 June export control order. The Alibaba distillation campaign is now confirmed as part of the sequence that prompted that restriction.

Second, the distillation attack highlights a vulnerability category that applies to any organisation deploying AI APIs at scale. Fraudulent accounts systematically querying an enterprise AI deployment to extract its fine-tuned behaviour, domain-specific responses, or proprietary prompt architecture represent a threat vector that most enterprise security frameworks have not yet addressed. For GCC organisations building internal AI tools on top of foundation model APIs, the Alibaba campaign provides a concrete case study for why API access governance, anomaly detection on query patterns, and terms-of-use enforcement need to be treated as security controls, not administrative matters.

Third, the geopolitical dimension of adversarial distillation is now a factor in how Gulf states assess their AI vendor relationships and infrastructure partnerships. The UAE's AI strategy has been built substantially around partnerships with US technology companies, including through the Stargate UAE infrastructure programme. Saudi Arabia's SDAIA has similarly anchored its AI governance frameworks to US-aligned standards. The escalating pattern of Chinese AI labs targeting US frontier models through distillation, and the US government's response through export controls and model access restrictions, creates supply-side uncertainty that GCC technology and procurement teams need to factor into their AI roadmaps.

The question of which GCC financial institutions retain access to frontier AI models under the new restrictions has become a live compliance and competitive issue, not a hypothetical one. The Alibaba disclosure makes clear that those restrictions are not the result of a policy miscalculation but of a documented, large-scale attack on the intellectual property and security architecture of the models in question.