Anthropic accuses Alibaba of stealing Claude AI secrets through 28.8 million fraudulent queries

Anthropic accuses Alibaba of copying Claude by asking it millions of questions -- and sets the stage for a new AI war

Anthropic has accused groups linked to Alibaba and its Qwen AI lab of carrying out a massive campaign to extract capabilities from Claude just by asking it a lot of questions, as first reported by Reuters. The AI developer wrote a letter to U.S. lawmakers alleging that Alibaba used nearly 25,000 fraudulent accounts to generate more than 28.8 million interactions and glean detailed, proprietary information about Claude. Alibaba has not publicly responded to the allegations, and there has been no independent confirmation of Anthropic's claims, but simply leveling them has potentially enormous consequences. The sheer volume of accounts and interactions is eye-catching, but it's even more fascinating how it reveals a vulnerability in AI models that can give away their secrets. AI developers may now have to worry that rivals can learn from those models without ever seeing the underlying code or training data through a technique known as model distillation. Essentially, AI models will inadvertently share deliberately obscured facts about themselves if a huge number of the right questions are asked. As an analogy, imagine taking a test about a book, but instead of reading the book, you ask the author one million questions about their life, their thinking, their experience writing the book, and several hundred thousand more questions. You'd probably have a pretty good chance of knowing everything they might have written without once cracking the covers. Can you copy an AI just by talking to it? Model distillation is a common technique used by AI companies to build variations of their models, especially smaller, faster options. But no company would be okay with a rival using their model to train the competition. But that's what Anthropic alleges. The fake accounts supposedly asked Claude a ton of very complex and detailed questions related to its advanced software engineering and agentic reasoning features. The responses filled in a picture of the model's workings, accelerating Alibaba's own development of competing AI systems, Anthropic claimed. The conundrum is obvious. Large language models are designed to answer questions. Every answer teaches the user something about how the model behaves. You can't interact with an AI model, or a person, without giving up some information about yourself. Normally, that wouldn't matter, but at the scale Anthropic is claiming, conversations become reverse engineering. It's not the first time Anthropic has alleged illicit model distillation. Anthropic levied similar claims against DeepSeek, Moonshot AI, and MiniMax earlier this year. And other companies, including OpenAI, have expressed concern that they have also been victims of the technique. The glaring irony that the companies that used enormous collections of publicly available information, including licensed material, to train their AI models are now arguing about how those same models are valuable intellectual property is hard to ignore. AI arms race AI developers see their models' behavior as crucial to competing with rivals. If another company can reproduce much of that behavior by asking enough carefully designed questions, spending billions of dollars training frontier models starts to seem like a waste. Anthropic claims model distillation can effectively transfer years of work on their part to another company for almost nothing. Anthropic asked lawmakers to take action and combat this problem as soon as possible. If leading models can be imitated so easily, there won't be much incentive to innovate, and the AI competition will only be about beating copycats. And picking the best models will be difficult, as a new AI model that matches an existing one's capabilities might be born of years of original research or simply copying an existing option. Whether Anthropic ultimately proves its allegations, they have revealed that the next great AI battle may not be about building the smartest model. It may be about stopping somebody else from talking to your model and learning how it operates, one question at a time. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Anthropic Accuses Alibaba Of Running 29 Million Fake Queries to Clone Claude | PYMNTS.com

Anthropic accused operators affiliated with Alibaba and its AI lab of conducting the largest known distillation campaign against its Claude models to date, CNBC reported. The alleged operation ran from April 22 to June 5 and generated more than 28.8 million interactions with Claude through roughly 25,000 fraudulent accounts. The scale puts the alleged campaign in a different category from what came before. In February, Anthropic named three Chinese AI labs -- DeepSeek, Moonshot AI and MiniMax -- as having collectively generated more than 16 million Claude interactions through roughly 24,000 fraudulent accounts in a February blog post. The alleged Alibaba campaign dwarfs that combined total in just six weeks. How 25,000 Fake Accounts Extracted Claude's Core Intelligence The way distillation works is simple. A campaign sends large volumes of carefully designed prompts to a target model and captures its responses. Those responses become training data. The competing model learns to reason and respond in ways that replicate the original, without paying for the research behind it. It is less like hacking a system and more like sitting next to the best student in class and copying every answer they write, at industrial scale. Detection is hard. A distillation query looks identical to a legitimate one. A developer asking Claude to help debug a function and a campaign systematically extracting Claude's coding behavior send the same kind of request. The only signal is pattern: massive volume, repetitive structures and prompts targeting the same narrow capabilities, arriving from hundreds of coordinated accounts in sequence. "As organizations increasingly integrate LLMs into their core operations, the proprietary logic and specialized training of these models have emerged as high-value targets," Google's Threat Intelligence Group warned in a February blog post, PYMNTS reported. There is a safety dimension beyond the commercial one. When a lab distills a frontier model without permission, the copy does not inherit the safety guardrails built into the original. The dangerous capabilities transfer through the outputs. The months spent making the model refuse harmful requests do not. Distillation itself is a legitimate and widely used technique. Companies routinely use it to compress their own large models into smaller, faster versions that run more cheaply. The line Anthropic is drawing is between using it on your own models, which is standard practice, and using it on a competitor's model without permission. Anthropic Wants Congress to Make Model Theft Illegal In a letter to senators, Anthropic's Head of Policy Sarah Heck said the attacks were carried out "illicitly, systematically, and at industrial scale to harvest U.S. AI capabilities across frontier labs and repackage them as their own without incurring the training and R&D costs," Business Insider reported. House Republicans are seeking sanctions on Chinese companies that copy American-made AI models, PYMNTS reported. Sen. Bill Hagerty and Sen. Andy Kim are moving to add an amendment to defense legislation that would blacklist or sanction entities found conducting such campaigns, according to CNBC. The White House Office of Science and Technology Policy issued a memorandum in April warning of industrial-scale foreign distillation of U.S. AI models. The structural problem goes beyond any single campaign. A distillation query is indistinguishable from a legitimate one. The only way to fully close the gap is to restrict who can access the model. That conflicts directly with the commercial logic of selling AI as a service. If adversarial distillation becomes routine, AI labs may find themselves spending as much on access controls and identity verification as they do on training, treating every API call as a potential intelligence transfer rather than a revenue event.