25,000 fake accounts used in 28.8M API exchanges to steal Claude's AI capabilities

Security teams parsing Anthropic's disclosure will recognize the operation as a textbook large-scale API abuse, where thousands of synthetic identities bypass rate limits to siphon proprietary model outputs. The 28.8 million exchanges amassed in just six weeks represent a staggering data exfiltration event—and a wake-up call for AI firms to implement stronger authentication, behavioral analytics, and adversarial detection to protect their models from distillation-as-a-service attacks.

Anthropic has publicly accused Chinese technology giant Alibaba of conducting the largest known illicit extraction of its Claude AI model capabilities, a sophisticated campaign that generated over 28.8 million exchanges with the model through nearly 25,000 fraudulent accounts between April 22 and June 5, 2026. The accusation was detailed in a letter sent on June 10 to U.S. Senate Banking Committee leaders, Senators Tim Scott and Elizabeth Warren, ahead of a scheduled hearing on artificial intelligence. The technique used, known as distillation, involves training a less capable model on the outputs of a more powerful one, effectively cloning capabilities without authorization. Anthropic described the operation as an effort to accelerate China's ability to reach the level of its advanced Mythos Preview capabilities.

“

It follows a February 2025 disclosure by Anthropic of a similar, though smaller-scale, campaign by Chinese AI startup DeepSeek, which involved over 150,000 exchanges and sent shockwaves through the tech world with its low-cost model.

The incident marks a sharp escalation in the ongoing AI intellectual property conflict between the United States and China. It follows a February 2025 disclosure by Anthropic of a similar, though smaller-scale, campaign by Chinese AI startup DeepSeek, which involved over 150,000 exchanges and sent shockwaves through the tech world with its low-cost model. The Alibaba campaign, attributed to operators affiliated with Alibaba and its AI lab Qwen, is reported to have been active over a six-week period, dwarfing prior known distillation attacks in both scale and sophistication. The letter's timing, just two months after the White House accused China of stealing U.S. AI intellectual property on an industrial scale, underscores the geopolitical dimension.

The implications are multifaceted. For Anthropic, the breach represents a significant challenge to the commercial value of its proprietary Claude models, as distillation can enable competitors to close the performance gap at a fraction of the cost. Alibaba, which has invested heavily in its Qwen family of large language models, could gain unfair advantage in the fiercely competitive global AI market, particularly in enterprise and cloud applications. The incident also raises questions about the effectiveness of existing API usage policies and the difficulty of detecting sophisticated automated extraction at massive scale—Anthropic noted the use of thousands of fraudulent accounts to bypass rate limits.

From a regulatory standpoint, the letter to the Senate Banking Committee signals a push for government intervention. Anthropic expressed support for threat-intelligence sharing partnerships between the government and private AI labs, potentially paving the way for new export controls or federal mandates around model security. The choice of the Banking Committee, rather than a purely tech-focused panel, suggests that financial regulation and sanctions mechanisms may be invoked against entities engaging in such extraction, given the dual-use nature of advanced AI and its economic significance.