Anthropic has accused Alibaba-linked operators of using fraudulent accounts to extract capabilities from Claude, its AI assistant, in a case that highlights the growing risk of model distillation in the global AI race.

According to BBC News and other reports citing Anthropic’s letter to US lawmakers, the company said the activity involved nearly 25,000 fake accounts and around 28.8 million interactions with Claude between 22 April and 5 June 2026. Anthropic said the accounts were used to query Claude at scale, collect the model’s responses and use those outputs to improve rival AI systems.

The allegation focuses on Alibaba and its Qwen AI lab, one of China’s most visible artificial intelligence projects. Alibaba has not publicly confirmed Anthropic’s claim, and the details remain based on Anthropic’s account and subsequent reporting. But the pattern described by Anthropic is already familiar to anyone watching the darker side of AI competition: use another company’s model as a hidden teacher, then train from the answers.

The technical term is model distillation. In normal use, a company may use a powerful model it owns to help train a smaller model it also owns. That can make AI cheaper and faster. The problem begins when a rival secretly uses a competitor’s frontier model as the teacher. The outside model does not need to be hacked. Its code does not need to be stolen. Its data center does not need to be breached. The attacker only needs access, volume and patience.

That is what makes this kind of case so uncomfortable. Claude is useful because users can ask it questions. Every answer reveals something: how the model reasons, how it structures code, how it follows instructions, how it handles uncertainty, how it summarizes complex information. One answer is just a response. Millions of answers can become training material.

If Anthropic’s description is accurate, Alibaba did not need to walk through the front door and announce itself. Thousands of accounts could spread the activity out. Automated prompts could make the traffic look less obvious. The knowledge could be gathered quietly, piece by piece, until the victim realizes that its own product has been used as a pipeline for someone else’s model development.

This is why companies such as Anthropic are in a difficult position. They can ban accounts, improve abuse detection and tighten access rules. But they cannot completely close the door without damaging the product itself. Claude exists to answer questions. A model that refuses broad use becomes less useful. A model that allows broad use becomes easier to exploit.

There is also a geopolitical layer that should not be ignored. Alibaba is not operating in a vacuum. China’s major technology companies exist inside a system where private innovation and national strategic goals are closely linked. When a Chinese AI lab is accused of extracting capability from an American frontier model, it is not merely a dispute between two companies. It raises the question of whether America is paying the research cost while its rivals try to copy the result through the interface.

This is the cruel part of the AI race. The victim may know what happened. The pattern may be obvious. The scale may look unreasonable. But the attacker can hide behind accounts, routing, jurisdictions and technical uncertainty. By the time the activity is detected, the useful knowledge may already have moved. In the old world, theft often left a broken lock. In AI, the theft can look like normal usage until the numbers become impossible to ignore.

Some readers may want a perfectly neutral conclusion. But reality is not always neutral. If a company builds a frontier AI model with years of research, billions in compute and thousands of hours of engineering work, and a rival uses mass fake-account access to copy the model’s behavior, most ordinary people would understand what that is. It is taking another side’s hard work and turning it into your own advantage.

The Alibaba-Claude dispute is a warning for the entire industry. Frontier AI companies are not only competing against each other’s products. They are defending their systems from being studied, copied and drained through the same public access that makes them valuable. That defense will only get harder as models become more capable and the incentives to imitate them become larger.

For America, the lesson is simple: advanced AI is strategic technology. It should be protected like strategic technology. If US companies build the most capable systems and adversarial competitors can quietly extract their behavior through millions of prompts, then the country is giving away part of its advantage one answer at a time.