News · 2026-06-25
Anthropic says Alibaba ran the biggest 'copy Claude' campaign yet
There is a quiet way to copy an AI model without ever touching its code. You do not break in or steal files. You simply talk to it. You ask the model thousands and thousands of carefully chosen questions, write down every answer, and then use that pile of question-and-answer pairs to train a cheaper model of your own. The new model never saw the original's inner workings, but it learned to imitate its behavior, the way a student who memorizes a brilliant teacher's every response can start to sound like the teacher. The industry calls this distillation, and this week it became the center of a fight between the United States and China.
Anthropic, the company behind the Claude models, sent a letter to U.S. senators and White House officials accusing operators tied to Alibaba's Qwen AI lab of running the largest such campaign it has ever seen. According to reporting on the letter, the operators used nearly twenty-five thousand fake accounts to hold close to twenty-nine million conversations with Claude over about six weeks this spring. The conversations were not random. They zeroed in on the exact things Claude is best at and makes the most money from: writing software and acting as an autonomous agent that can plan and carry out multi-step tasks.
To understand why a company would treat this as an emergency, it helps to know how lopsided the economics are. Training a frontier AI model from scratch costs an enormous amount, in computing time, electricity, and the salaries of rare specialists. Distilling one is cheap by comparison. If a rival can spend a tiny fraction of the original budget and walk away with a model that behaves almost as well, then the years of expensive work that built the original become a lot easier to leapfrog. Anthropic argues that this lets competitors sell cheaper imitations that undercut its prices, and warns that the copies often arrive without the safety guardrails the original was carefully trained to include.
The timing sharpens everything. The accusation lands while Alibaba was recently added to a U.S. Defense Department list of companies it considers linked to the Chinese military, a designation Alibaba is fighting in court. It also lands while Anthropic is reportedly preparing to go public, which means cheaper foreign clones are not just a strategic worry but a financial risk it has to disclose to investors. Anthropic asked the government to spell out clearer rules so companies can share information about these campaigns without running afoul of antitrust law, to keep tight controls on advanced AI chips, and to penalize firms that copy models this way. Lawmakers are reportedly drafting legislation to blacklist or sanction offenders.
Here is where it gets genuinely contested, and where an honest reader has to slow down. Alibaba declined to comment, and its U.S.-listed shares slipped about three percent on the news. Chinese commentators pushed back hard. In one Chinese state-media response, experts framed the accusation as a 'kick away the ladder' move, an attempt by a leader to pull up the rope behind it once it has climbed. Their argument has two parts. First, distillation is an ordinary, widely taught technique for making models smaller and cheaper, used all over the field, not some exotic act of sabotage. Second, they point out that Anthropic itself has faced questions about where its own training data came from, so accusations about copying cut in more than one direction.
And there is a third reading that does not take either side's word for it. The same week, an essay argued that closed American models are being priced like luxury goods, and that 'China fears' can be used to justify keeping prices high rather than competing on cost. Through that lens, 'illicit distillation' is partly a real harm and partly a convenient story, a way to explain away why open models from Chinese labs are so much cheaper. The numbers in Anthropic's letter come from Anthropic's own internal detection, not from a neutral third party, and Alibaba has confirmed none of them.
Why this matters: the U.S.-China AI rivalry has been about chips, talent, and export controls. This moves it into the models themselves, the actual learned behavior that is the product. It also exposes an awkward truth about modern AI. A model that talks to the public for a living cannot fully hide what it knows, because every answer it gives is a small leak of the expertise inside it. Protecting that expertise may turn out to be one of the hardest problems the leading labs face, and it is now tangled up with national security, antitrust law, and a coming wave of export rules redrawing the AI map.
The honest caveat: treat the specific figures as Anthropic's allegation, not established fact. The most important missing piece is independent verification, both of the scale Anthropic describes and of who exactly was behind the accounts. Until a neutral party or a court weighs in, the cleanest way to hold this story is to take the broad pattern seriously while keeping the precise numbers, and the word 'theft,' in quotation marks.