SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAMEAnthropic v. Alibaba
28.8 Million Fake Claude Exchanges Through 25,000 Fraudulent Accounts - Disclosed as the Largest Known AI Distillation Attack
In a June 10, 2026 letter to Senate Banking Committee leaders Tim Scott and Elizabeth Warren, first reported by CNBC on June 24, Anthropic disclosed what it describes as the largest known distillation attack against its models.
- 01TRIGGERIn a June 10, 2026 letter to Senate Banking Committee leaders Tim Scott and Elizabeth Warren, first reported by CNBC…
- 02MACHINE ACTIONOperational automation
- 03MISSING GATETrust boundaries, least privilege, and output approval
- 04IMPACTData security
The short version
In a June 10, 2026 letter to Senate Banking Committee leaders Tim Scott and Elizabeth Warren, first reported by CNBC on June 24, Anthropic disclosed what it describes as the largest known distillation attack against its models.
Case telemetry
- INCIDENT
- SS-IR-096
- DATE
- June 24, 2026
- SYSTEM
- Anthropic v. Alibaba
- LOCATION / SCOPE
- United States / China
- EVIDENCE
- Alleged
- AI ROLE
- Operational automation
- HARM
- Data security
- SOURCES
- 2 cited records
The event
In a June 10, 2026 letter to Senate Banking Committee leaders Tim Scott and Elizabeth Warren, first reported by CNBC on June 24, Anthropic disclosed what it describes as the largest known distillation attack against its models. According to the letter, operators affiliated with Alibaba and its AI lab ran roughly 28.8 million exchanges with Claude through about 25,000 fraudulent accounts over a 44-day window (April 22 to June 5, 2026), systematically harvesting outputs in software engineering, agentic reasoning, complex planning and tool use - the capabilities that differentiate frontier models. Anthropic says it tied the campaign to Alibaba through IP correlation, request metadata and infrastructure fingerprints, and that it dwarfs the combined 16 million interactions from three Chinese labs it documented in February. Alibaba subsequently denied the allegations, saying it does not train on the outputs of proprietary models.
What the machine did
Distillation turns a frontier model into an unwilling teacher: query it at scale, collect its answers, and train a rival model on the output - capability transfer without the research bill. Every safeguard involved is an account-level control, and the campaign's architecture (tens of thousands of fraudulent accounts, industrial query volume, targeted capability domains) was built to defeat exactly those controls. The model itself cannot tell a paying customer from an extraction pipeline; each of the 28.8 million exchanges looked like a legitimate API call, and the pattern only became visible in aggregate, after weeks of harvesting.
Where the failure landed
If Anthropic's account is accurate, a strategic rival extracted frontier-model capability at scale for the cost of API calls and burner accounts - outside every export control and safety commitment attached to the underlying model. The disclosure moved Congress: Senators Hagerty and Kim moved to attach sanctions and blacklist provisions to defense legislation. It also crystallized an uncomfortable industry fact - model capabilities, unlike source code, leak through the front door, one authorized-looking request at a time. All figures are Anthropic's own account and have not been independently verified.
Alleged
Claims reported in litigation or public allegations; not presented here as a final finding.
SOURCE RECORD UPDATED 2026-07-09
2 cited records
- 01
- 02
Trust boundaries, least privilege, and output approval
The failure pattern in this case: Untrusted input crossed a privileged boundary.
The moment the path could change
A security owner approves credential scope and externally visible actions before the agent can cross a trust boundary.
Autonomy is a design choice.
See the operating model that keeps AI useful while preserving human authority at consequential moments.
Compare AgenticAI and AugmentedAI →