25,000 Fake Accounts Used in 'Largest Known Distillation Attack' on Claude AI

For cybersecurity professionals, the Anthropic-Alibaba case is a wake-up call: the attack surface of frontier AI has expanded beyond traditional data breaches to include industrial-scale distillation. The operational sophistication required to orchestrate 29 million exchanges through 25,000 fake accounts signals a well-resourced, persistent threat actor exploiting API gateways and identity verification gaps. This incident demands a reassessment of how AI providers authenticate users, monitor anomalous query patterns, and defend against intellectual property extraction that operates at machine speed.

Anthropic, a leading U.S. artificial intelligence lab, has leveled explosive accusations against Chinese e-commerce and technology giant Alibaba, claiming the company orchestrated a 'brazen' and systematic campaign to illicitly extract knowledge from its frontier AI model, Claude. In a letter dated June 10, 2026, obtained by The Wall Street Journal and addressed to Senators Tim Scott and Elizabeth Warren, Anthropic detailed what it describes as 'the largest known distillation attack' against the company to date. The campaign allegedly involved the creation of nearly 25,000 fake accounts that were used to conduct approximately 29 million exchanges with Claude, a model that is not officially available to entities in China. Anthropic's letter asserts that Alibaba targeted some of Claude's most advanced capabilities, including agentic reasoning, software engineering, and long-horizon task execution, essentially siphoning off proprietary intelligence developed through billions of dollars in U.S. investment.

“

In a letter dated June 10, 2026, obtained by The Wall Street Journal and addressed to Senators Tim Scott and Elizabeth Warren, Anthropic detailed what it describes as 'the largest known distillation attack' against the company to date.

The practice of distillation—training a less capable AI model on the outputs of a more advanced one—has become a central flashpoint in the escalating technological rivalry between the United States and China. While distillation can be a legitimate technique for improving model efficiency, its use to clone frontier capabilities without authorization raises profound intellectual property and national security concerns. Anthropic's accusations are not without precedent; the company had previously warned in a February 2026 blog post that it had identified industrial-scale campaigns by Chinese AI laboratories to extract Claude's outputs. This latest disclosure, however, provides the most granular public accounting yet, with specific figures that underscore the industrialized nature of the alleged operation. The letter explicitly frames the incident as a subsidy for geopolitical competitors, stating that distillation attacks are effectively turning American R&D into an involuntary transfer of technology.

The implications of this incident are multifaceted. For the AI industry, it highlights the vulnerability of even the most sophisticated models to coordinated extraction efforts, challenging the effectiveness of existing access controls and usage monitoring. Companies like Anthropic, which have invested heavily in safety and governance, may now face pressure to implement more stringent defenses, potentially including on-device processing, hardened API gateways, and behavioral biometrics to detect and thwart fake account farms. The scale of 25,000 fake accounts and nearly 29 million exchanges suggests a highly automated operation, likely leveraging botnets and sophisticated account creation techniques—a level of adversarial investment that could only be mustered by a resource-rich actor. The operational cost and technical expertise required point convincingly to state-sponsored or state-facilitated activity, a point underscored by the Trump administration's April 2026 memorandum that explicitly identified foreign entities, principally based in China, as engaging in industrial-scale distillation of U.S. frontier AI systems.