Anthropic sent a letter dated June 10, 2026 to Senators Tim Scott and Elizabeth Warren — chair and ranking member of the Senate Banking Committee — accusing operators linked to Alibaba's Qwen AI lab of running the largest known AI model extraction campaign against a US company. The letter also went to White House officials. Anthropic made it public on June 24. Alibaba's stock dropped roughly 3%.

The numbers: approximately 25,000 fraudulent accounts, 28.8 million exchanges with Claude, across a seven-week window from April 22 to June 5. The targeted capabilities: Claude's software engineering and agentic reasoning — the model's most commercially valuable skills.

The technique is called adversarial distillation: repeatedly prompt a more capable model, harvest its outputs, train a cheaper local model on those outputs. The cheaper model absorbs the expensive one's reasoning patterns without paying for the research behind them. Not technically illegal under current US law. Which is exactly why Anthropic is writing to Congress.

Why 28.8 million is the number that actually matters

This needs context, because the raw number doesn't land without comparison.

In February 2026, Anthropic disclosed three prior distillation campaigns — all by Chinese AI labs:

• DeepSeek: 150,000 exchanges
• Moonshot AI: 3.4 million exchanges
• MiniMax: 13 million exchanges

Combined: roughly 16.5 million exchanges. Alibaba's Qwen operation produced 28.8 million — nearly 75% more than all three prior campaigns combined. This isn't a comparable attack. It's a different order of magnitude of organization.

What Anthropic is actually asking for

Three things, according to reporting on the letter and AI Weekly's coverage:

1. Clarify antitrust guidelines so US AI companies can share threat intelligence about distillation attacks more freely without running into competition law problems. Right now, sharing that information across companies looks like a potential antitrust issue. Anthropic wants explicit carve-out language.

2. Strengthen export controls on advanced AI chips — a position Anthropic has held for a while and is reiterating here with fresh evidence.

3. Create penalties against firms that use adversarial distillation to extract US AI model capabilities.

The legislative response moved fast. Senators Bill Hagerty and Andy Kim plan to introduce an amendment to must-pass defense legislation that would blacklist or sanction Chinese firms found to be improperly accessing US AI model outputs. A bipartisan House bill from Representatives Bill Huizenga and Sydney Kamlager-Dove is also circulating. Whether either survives to the final version of the defense bill is uncertain — these things often don't. But the direction of travel is clear.

Source spread

• CNBC — "Brazenly and illicitly extract AI capabilities" — safety. Best primary coverage of the letter's contents and Anthropic's specific policy asks.
• Benzinga — Exchange counts and comparison data — safety. Good on the prior-campaign comparison numbers (DeepSeek, Moonshot, MiniMax vs Alibaba).
• The Deep Dive — Congressional response — builder. Best coverage of the Hagerty/Kim amendment and Huizenga/Kamlager-Dove House bill.
• AI Weekly — Qwen lab context — builder. Good background on what Qwen is and why Alibaba's AI lab is the specific entity named.

Pros & cons

What's real:

• The scale is genuinely unprecedented in disclosed cases. 28.8 million targeted exchanges isn't casual scraping — it's organized, sustained, and specifically aimed at Claude's highest-value capabilities.
• The account count (~25,000 fraudulent accounts) implies organizational infrastructure. Creating and managing 25,000 accounts that evade Anthropic's geographic restrictions takes coordination.
• Anthropic's prior disclosures give the numbers credibility. They've disclosed three campaigns before this one with specific figures. That's not how you build a credibility record if you're planning to exaggerate.
• The legislative response shows this landed. Bipartisan Senate and House movement in the same week as the disclosure is not nothing.

What deserves scrutiny:

• We have Anthropic's account. Alibaba has not publicly responded with their own version. Absent Alibaba's response, these are allegations, not established facts.
• "Adversarial distillation" isn't obviously illegal, and Anthropic knows this. The letter is calibrated to create pressure for legislation that doesn't exist yet — which is a policy move, not a legal complaint.
• The accounts-to-exchanges ratio is worth examining. 25,000 accounts producing 28.8 million exchanges averages ~1,152 exchanges per account. That's consistent with automated tooling, not human usage. But automated tooling against an API isn't novel — it's how many legitimate use cases work too.
• The disclosure timing is notable. April 22 to June 5 is the attack window. The letter was June 10. Anthropic made it public June 24. That's six weeks between incident and disclosure. The timing of the public release — a week before scheduled Senate Banking Committee hearings on AI — is not accidental.

Further reading

• CNBC — Anthropic accuses Alibaba of campaign to "brazenly" extract AI capabilities — primary news coverage with policy detail
• Benzinga — Full account comparison: DeepSeek, Moonshot, MiniMax, Alibaba — best on the scale comparison
• The Deep Dive — Anthropic urges Congress to act — legislative response detail
• Bloomberg Law — Anthropic accuses Alibaba (1) — legal angle
• AI Weekly — Qwen distillation context — Alibaba's AI lab background