Anthropic accuses Alibaba of distilling Claude

The reason this accusation matters far beyond one corporate grievance is the mechanism behind it. Distillation is the practice of copying a model's behavior by querying it at scale and training a smaller model on its answers - no source code, no model weights, and no breached servers are involved. In Anthropic's telling, operators linked to Alibaba generated roughly 28.8 million exchanges with Claude using nearly 25,000 fraudulent accounts over about six weeks ^[1], deliberately steering the queries toward Claude's most commercially valuable capabilities, software engineering and agentic reasoning ^[2]. One industry analysis estimates that volume of conversation could yield on the order of 14.4 billion tokens of teacher output ^[1]- effectively a training corpus assembled one prompt at a time.

The strategic punchline is that this route sidesteps the entire architecture of U.S. export controls. Those rules govern the sale of advanced chips and model weights; they say nothing about asking a publicly available model a few million questions. As one commentary put it, current controls focus on hardware and model weights, but distillation extracts capability through API access alone ^[1]. Anthropic says the operators even used commercial proxy services to evade the geographic restrictions that bar Chinese entities from Claude ^[4]. If you think of frontier capability as something that normally requires enormous compute to create, distillation is a way to import that capability as finished cognition rather than as regulated silicon - compute laundering through the API.

The loudest reaction to Anthropic's letter has not been agreement - it has been a counter-accusation. Developer communities on Reddit skewed strongly skeptical of Anthropic and sympathetic to Alibaba, with the dominant framing being that a company built on scraping the open internet and ingesting copyrighted books is poorly placed to complain that its own outputs were copied. The recurring refrain is some version of you stole it first. That same skepticism shows up among high-profile voices: Hugging Face CEO Clement Delangue has called distillation a very common practice that everyone is using and suggested Anthropic itself may have relied on it, and Elon Musk has publicly accused Anthropic of stealing data to train Claude in the first place.

Underneath the point-scoring is a genuine legal and ethical boundary that the technical community keeps drawing. Distillation as a machine-learning technique is legitimate and widely used; deep-dive coverage of the dispute lands on the view that the real issue is not distillation but the alleged fraudulent access - fake accounts, proxy services, and terms-of-service violations. In other words, learning from a model's public outputs may be defensible, while deceiving your way past access controls to do it at industrial scale is the part that looks indefensible. Anthropic's framing collapses those two things into a single act of theft ^[2]; many of its critics insist they must be kept apart.

Anthropic did not sue - it wrote to the Senate Banking Committee, and the choice of venue is itself an argument. The letter, authored by policy head Sarah Heck, casts the campaign as an effort to harvest US AI capabilities across frontier labs and repackage them as China's own without incurring the training and R&D costs required to train US frontier models ^[3], and it asks lawmakers to treat large-scale distillation as a distinct category of IP theft, paired with tighter export controls, penalties, and runtime-access governance such as identity gating, query-volume thresholds, and cross-provider reporting ^[3]. Anthropic also alleged Chinese government complicity and warned that, if successful, such attacks could pose an existential threat to the U.S. and its allies ^[4]- and that the Alibaba campaign continued even after administration warnings to Chinese labs ^[2].

This is where the contrarian read gets sharp. Several of the same Reddit threads characterize Anthropic's policy asks as anti-competitive - a bid to use national-security language to lock rivals out of a capability that is, technically, just very good text. The proposed remedies (volume caps, identity gating, cross-provider reporting) would raise the cost of competing with Claude for everyone, not only for accused bad actors. Whether you read the letter as a legitimate security alarm or as regulatory moat-building depends largely on whether you accept Anthropic's framing that learning from Claude's outputs is theft at all.

The most uncomfortable question for Anthropic comes not from Beijing but from within the skeptics' own camp. If a frontier model's hardest-won capabilities - agentic reasoning, software engineering - can be substantially reconstructed by reading a few thousand dollars' worth of paid outputs, then the accusation doubles as an admission about how thin the moat actually is. One commenter distilled the irony directly: if your product can be copied by reading a few thousand paid outputs, maybe it is not really worth that much. The point lands harder because Anthropic is simultaneously arguing the capability is so valuable that copying it threatens national security and so exposed that 25,000 fake accounts could extract it.

The market gave its own ambivalent verdict. Anthropic's allegations are unverified and Alibaba has denied wrongdoing, yet Alibaba's American depositary receipts still fell more than three percent, dropping below $100, with some reporting noting a 16-month low ^[2]. That is a reaction to legal and reputational risk, not to any confirmed wrongdoing. The deeper signal worth watching is structural: if capability really can be siphoned through inference, the long-run defensibility of a closed frontier lab may rest less on the model itself and more on distribution, trust, and the very runtime controls Anthropic is now asking Congress to mandate.