Anthropic Says Alibaba Siphoned 28.8 Million Claude Chats to Distill It. The Subtext Is the Qwen on Your Hard Drive.

TL;DR

In a June 10, 2026 letter to senior members of the U.S. Senate Banking Committee, later flagged to White House officials, Anthropic accused operators affiliated with Alibaba's Qwen AI lab of running nearly 25,000 fraudulent accounts to generate 28.8 million exchanges with Claude between April 22 and June 5, 2026. Anthropic says the goal was distillation: harvesting a frontier model's outputs to train a cheaper rival that mimics it. Anthropic calls it the largest known attack of its kind against it. Alibaba had not responded to the allegations as of publication. There is no proven link yet between this campaign and any shipped Qwen checkpoint, but the accusation lands squarely on the lab whose open weights a lot of you are running tonight.

What distillation actually is

Distillation is not hacking. Nobody stole weights. The technique is almost boring in its mechanics: you feed carefully constructed prompts to a strong "teacher" model, collect its responses, and fine-tune a smaller "student" model on those input-output pairs until the student approximates the teacher's behavior. It is a legitimate, widely used method when you distill your own model. It becomes a terms-of-service problem when the teacher is a competitor's paid API and you are quietly farming it at scale.

The reason labs treat it as theft: a frontier model costs hundreds of millions to train, and its real moat is the post-training (the RLHF, the data mixture, the behavior). Distillation lets a rival skip most of that bill and buy the polished behavior wholesale, one API call at a time. That is the whole worry in one sentence.

The numbers, and why they are plausible

28.8 million exchanges across nearly 25,000 accounts over a 44-day window works out to roughly 650,000 exchanges a day, or about 1,150 per account before the run was cut off. That cadence is exactly what you would build if you were trying to stay under per-account rate limits while still pulling a training-scale corpus: spread the load thin enough across enough identities that no single account trips an abuse flag.

For scale, Anthropic frames this as bigger than the campaigns it flagged back in February 2026, which it attributed to operators linked to DeepSeek, Moonshot AI, and MiniMax. Reports differ on the exact prior totals, but the consistent claim is that this single Alibaba-linked effort exceeded those earlier ones combined. Treat the comparison as directional, not a clean leaderboard.

Why this one is about you, not just two giant labs

The other recent distillation accusations named labs most Western builders never touch directly. This one is different: Qwen is arguably the most-downloaded open-weight family on the planet, the default local model on countless homelab rigs, the base a huge share of fine-tunes start from. If the lab behind your local daily-driver was, as alleged, training on Claude's outputs, the uncomfortable question is whether some of the "personality" and instruction-following you like in an open model was distilled out of a closed one you are not paying for.

Be precise about what is and is not claimed. Anthropic is alleging a campaign of API abuse, nearly 25,000 fake accounts evading its terms. It has not published evidence tying this corpus to a specific released Qwen checkpoint, and "trained on" is not the same as "is a copy of." A distilled student is still its own architecture, its own training run, its own weights. The accusation is about how the training data was sourced, not about a model being a clone.

What Anthropic is actually asking for

The letter is a policy move, not a lawsuit. According to reporting, Anthropic asked Washington for three things:

• Clearer antitrust guidance so frontier labs can share signals about distillation campaigns with each other without tripping collusion concerns.
• Continued export controls on advanced AI chips, the familiar hardware-leverage argument.
• Penalties for firms caught extracting capabilities this way.

Read between the lines and it is also a competitive narrative: if a rival's model is good partly because it distilled yours, you would very much like that framed as theft rather than as your own moat being thinner than advertised. Both things can be true at once.

The practical takeaway for builders

Two things matter for your stack. First, API terms of service are now an enforcement surface: programmatic harvesting of a model's outputs to train a competitor is exactly the behavior providers are now actively detecting and cutting off, so if your pipeline scrapes a frontier API at volume, assume it can be fingerprinted and killed. Second, this is going to sharpen the open-weights provenance conversation. Expect more pressure for labs to document what their training data did and did not include, and expect "distilled from a closed model" to become a real line item in how people evaluate open releases. None of this makes Qwen worse to run today. It does mean the supply chain behind your favorite open model is about to get a lot more scrutiny.

Key Takeaways

• Anthropic told U.S. senators that operators tied to Alibaba's Qwen lab used nearly 25,000 fake accounts to pull 28.8 million Claude exchanges from April 22 to June 5, 2026.
• Distillation means training a cheaper student model on a frontier teacher's outputs. No weights are stolen; the outputs are the harvested asset.
• The volume (~650,000 exchanges a day, spread thin across accounts) is consistent with a deliberate effort to dodge per-account rate limits.
• Anthropic calls it its largest known distillation attack, bigger than its February 2026 accusations against DeepSeek, Moonshot AI, and MiniMax combined.
• Crucially, there is no published evidence tying this corpus to any specific shipped Qwen model, and Alibaba had not responded as of publication.
• The letter asks Washington for antitrust clarity, export controls, and penalties, so treat it as policy and narrative as much as fact.

Sources: CNBC, Tom's Hardware, InfoWorld, The Next Web