Somewhere in a data center, 25,000 accounts signed up for Claude. They looked like ordinary users. They asked ordinary-looking questions — how to refactor a function, how to plan a multi-step task, how to reason through a thorny engineering problem. Then they did it 28.8 million more times.

That is the picture Anthropic painted in a letter to the U.S. Senate Banking Committee, which surfaced publicly on June 24. The company accused operators tied to Alibaba's Qwen lab of running the largest distillation attack it has ever recorded — nearly 29 million exchanges with Claude between April 22 and June 5, all aimed at copying the model's brain without ever touching its code.

What actually happened

Distillation is not hacking. Nobody stole Claude's weights, its source code, or a single line of training data. Instead, the attackers treated Claude like an oracle: feed it millions of carefully built prompts, harvest the answers, and use those answers to train a cheaper model that mimics the expensive one.

Anthropic says the 28.8 million queries zeroed in on exactly the skills that make Claude worth billions — agentic reasoning, software engineering, and long-horizon tasks that stretch across dozens of steps. Not trivia. The crown jewels.

The letter went to Chairman Tim Scott and Ranking Member Elizabeth Warren. It called this the largest known distillation campaign against Anthropic to date, nearly double the operation the company pinned on three Chinese labs back in February. It also alleged the Chinese government was complicit, and framed the whole thing as turning hundreds of billions of dollars in American AI spending into a free subsidy for a geopolitical rival. Alibaba said nothing. Its stock slid anyway.

Why this matters

Here is the part nobody in San Francisco wants to say out loud. If a competitor can reproduce most of your frontier model by politely asking it 28.8 million questions, your moat is a puddle.

Anthropic just filed to IPO at a $965 billion valuation. That number assumes Claude's edge is durable — that being months ahead is worth most of a trillion dollars. A successful distillation campaign says the opposite. It says the distance between the leader and the fast follower is a few weeks and a big enough API bill.

My Opinion

I'll be blunt: the outrage is real, and the irony is thicker than the outrage.

Every frontier lab, Anthropic included, was built by vacuuming up the open internet — books, code, forums, art — without asking a soul. DeepSeek got accused of distilling OpenAI last year. OpenAI got accused of eating the whole web. The industry's entire origin story is "we took the data, we'll deal with the lawsuits later." Now the most safety-branded lab in the business is writing to Elizabeth Warren because someone did to Claude what Claude's makers did to everyone else.

That doesn't make Alibaba the good guy. Running 25,000 fake accounts to strip-mine a rival is scummy, and if the Chinese state helped, it's worse. But watching Anthropic reach for Washington instead of a better rate limiter tells you something. The technical fix — detect the pattern, throttle the accounts, watermark the outputs — is Anthropic's own job, and 44 days is a long time to miss 25,000 bots hammering your API. You call a Senate committee when the technical fix doesn't exist yet.

The next AI war won't be won by whoever builds the smartest model. It'll be won by whoever can stop everyone else from copying it by lunchtime. Solve that, and you own the decade.

Author: Yahor Kamarou (Mark) / www.humai.blog / 01 Jul 2026