WASHINGTON – Before Congress can pass a law to stop it, lawmakers have to agree on what to call it.
Anthropic sent a letter to the Senate Banking Committee this month calling it the largest known distillation attack on any American AI company: 28.8 million automated exchanges with its Claude models, routed through roughly 25,000 fraudulent accounts over six weeks, targeting the capabilities that make Claude commercially valuable for software development and autonomous reasoning. The alleged source, Anthropic said, was a network of operators affiliated with Alibaba and its Qwen AI research lab.
Alibaba did not respond to requests for comment.
The letter, addressed to committee chair Tim Scott of South Carolina and ranking member Elizabeth Warren of Massachusetts and first reported by CNBC on June 24, is less a legal filing than a legislative prompt. Anthropic is asking lawmakers to do something American law does not currently do: classify AI model outputs as protected national assets whose unauthorized extraction by a foreign competitor constitutes grounds for sanction.
Senators Bill Hagerty of Tennessee and Andy Kim of New Jersey have agreed to take that step. The two are moving to attach an amendment to the National Defense Authorization Act that would blacklist or sanction any Chinese company found to have conducted such campaigns. A bipartisan House version, backed by Representatives Bill Huizenga and Sydney Kamlager-Dove, is under consideration for inclusion in the same defense measure.
What that amendment would actually prohibit matters. The technique at the center of Anthropic’s complaint, adversarial distillation, involves querying a more capable AI model at scale to generate outputs that are then used to train a weaker model. The logic is that the pattern of the stronger model’s reasoning is embedded in its responses, and that a smaller model trained on enough of those responses can approximate the stronger model’s capabilities without the underlying architecture or training data.
The technique is not new. It has been used in AI research since at least 2015, when Geoffrey Hinton and colleagues demonstrated that knowledge could be transferred from a large model to a smaller one through its outputs. What Anthropic’s complaint introduces is attribution and scale: the company says Alibaba-linked operators did not casually query Claude to inform their research but ran a structured, high-volume campaign specifically designed to feed Qwen’s training pipeline with Claude’s reasoning capabilities. The targets, according to the Senate letter, were among Claude’s most commercially significant: software engineering, agentic reasoning, and long-horizon task completion, the qualities that enterprise customers pay for and that distinguish frontier AI from the prior generation.
Chinese state media Global Times, citing domestic AI researchers, pushed back sharply on Anthropic’s characterization, describing the distillation framing as rooted in what one expert called tech hegemony anxiety and arguing the claims lacked verifiable legal substance. Neither Alibaba nor the Chinese government has issued a formal response.
The February precedent shapes how this case is being read. Anthropic disclosed three earlier distillation campaigns in the first quarter of 2026, naming DeepSeek, Moonshot AI, and MiniMax as the responsible labs, and called for coordination between AI companies, cloud providers, and policymakers to address the pattern. The Alibaba campaign, it now says, dwarfs all three combined. The June 12 export control directive that cut Fable 5 access, halting service for all foreign nationals including Pax Silica partners without notice, was Washington’s bluntest instrument for addressing exactly this class of risk.
That directive created its own problem. By cutting off legitimate users in allied countries without transition period or appeal, it demonstrated that export control is designed for blunt force, not precision. The legislation Hagerty and Kim are now proposing would be a different kind of instrument, targeting companies that extract capabilities through fraud rather than the global user base that relies on them professionally. Whether those two approaches can coexist, tight enough to deter Alibaba while open enough not to disable India or South Korea, is the policy question the amendment has not yet answered.
The legal terrain is also unsettled. US trade secret law, export control regulations, and terms-of-service agreements all offer partial coverage for what Anthropic describes, but none cleanly reaches the act of querying a public API at volume through falsified accounts to generate training data. As Nikkei Asia reported, Anthropic’s letter does not assert that a law has been broken; it asks Congress to write one. No legal proceeding has been filed, no court has assessed the evidence, and no independent body has verified that the 28.8 million exchanges produced a measurably better version of Qwen.
Alibaba’s Qwen 3, released in April, scored competitively against Claude on several coding benchmarks. Alibaba did not comment on the basis for those improvements, and independent researchers have not attributed them to a distillation campaign. That the release coincided with the period Anthropic describes as the extraction window is a correlation, not a proven causal link.
Meanwhile, the four Google researchers at Anthropic this week are headed to a company simultaneously asking Congress to protect its outputs from Chinese competitors while acquiring the talent that will define its next generation of models. The two strategies are not contradictory. They reflect the same calculation: that Claude’s edge, once replicated by a well-funded rival through any available means, is not easily rebuilt.
Alibaba has still not spoken.
