Anthropic says Alibaba illicitly extracted Claude AI model capabilities

The latter is basically fine-tuning the model with direction from another model. Thousands of businesses do this every day to fine-tune. This is almost certainly what the Chinese labs are doing, since it has a much better effect on the end result than just getting simple answers to simple questions.

These complaints of distillation are inflating the problem to make it sound worse than it is, because they want the USG to block/ban Chinese model providers as protectionism. They have already called for more export controls on chips (which is funny because DeepSeek v4 was designed to run on Huawei chips and now the other Chinese providers are following suit). But they can't come right out and say that, so their claim is that they're asking for more export controls because distilled models might not be as safe as their own. But if you show them a jailbreak of their model that bypasses their safety, they'll tell you that any model can eventually be jailbroken so don't worry about safety.

Chinese resellers are offering Claude tokens at 70-90% below official Anthropic API prices. They achieve this by reselling capacity from pooled Claude Max accounts, payments fraud, and also reselling the model output & reasoning chains to various Chinese labs. They are subsidizing model access in exchange for user logs and reasoning traces, which they then sell as training data, allowing them to operate below cost.

Claude and ChatGPT are both blocked in China. You need to use a VPN to access either, and you can't pay with a Chinese bank card. So most people who want access to Claude buy access via a reseller. It's the easiest and cheapest way to access Anthropic models in China.

These resellers operate tens of thousands of bot accounts, which is also why Anthropic introduced identity verification, to slow down the onslaught of bots.

Here's one token reseller, they're offering Opus 4.8 at a 93% discount below official API rates: https://yunwu.ai/pricing?provider=Anthropic

This is one reason why DeepSeek & GLM are priced so cheaply, they are competing with impossibly low token prices in China. They have to keep prices low, in order for people to use them.

I shared this story a few months back, but it never got any traction. It explains the token resale economy in China, it's an excellent read https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens...

And lets not forget they paid you for the tokens.

If you've invested in expensive capabilities training, of course you don't want this, so it's in Anthropic's economic interest to hinder it however they can, and that's enough to explain their behaviour here.

Anthropic seems to genuinely care about safety though, which for the rest of us means not having models that enabling easier cyberattacks, targeted scams, and the rarer but more severe risks like people trying to create and release new pathogens. This means walking a tight line, especially as models become more capable, and often wrapping a model in layers of defences against misuse.

If those capabilities transfer to a closed competitor model, all bets are off in terms of whether the competitor will apply the same defences.

If those capabilities transfer to an open weight model, not only will there be no ring of defences around the model, any defences you put into the model itself can easily be stripped away. So although it's nice to have capable open models, it will increasingly bad for us all if open models keep fast-following closed model capabilities as they have been, at least until we have solved the active research problem of keeping them safe.

This is all to say that, however you might feel about Anthropic, we might still prefer that they can deter this kind of distillation for now.

"you're trying to rip off what I've already ripped off!"

Crawl the whole Internet to build a gargantuan sized LLM and then complain you're being copied...

Legally, model output cannot be protected by IP laws whether domestic or international. The most they can hope for is civil relief which is a stretch given the literally illicit methods they used to train their models.

Ahtoropic got treated the same way it has been treating everyone else. This is the bed they made and now they, too, have to sleep in it.

I guess we can say that Anthropic attacked and illicitly extracted data from WikiPedia, Reddit, Stack Overflow, etc, etc.

X.ai attacked and illicitly extracted data from OpenAI

https://techcrunch.com/2026/04/30/elon-musk-testifies-that-x...

Meta attacked and illicitly extracted data from LibGen

https://x.com/jason_kint/status/1879152507865485497/photo/1

And more generally the US-based AI companies have perpetrated a massive distillation attack on the entire human race.

Not that it makes any difference, but I wonder if Anthropic, while claiming that Alibaba "extracted Claude model capabilities", in fact have any clue what Alibaba did with their paid Claude responses. It would seem to amount to industrial espionage if Anthropic do know, although I expect they don't.

While it is obvious to many, a modern LLM is built in roughly three stages: the foundation (pretraining) model, then SFT/supervised fine-tuning (distillation makes it easy), then the RL/RLHF stage on top (most effort-intensive). For today's reasoning models, RL/RLHF is becoming the most compute-intensive part.

Companies like Anthropic spent millions building those fine-tuning examples. A follower can shortcut that on both cost and time by distilling, and it will keep happening: every time the frontier lab climbs higher, others will find a way to shortcut the new gap. There's very little Anthropic can do beyond fraud prevention and blocking accounts that violate their terms of service.

On the policy question, I'm completely against banning Chinese models. I'm a heavy Claude Code user and I'll keep being one. But there should absolutely be price competition. China is eating the rest of the world for breakfast, lunch and dinner on manufacturing, and it did not help to ban them. Frontier pricing can't sit at 10x a capable competitor. It doesn't need to be at par either — demand is higher, and quality, trust, and fewer tokens to finish a task are worth a premium — but 4–5x is defensible.

Eventually these Chinese companies will release some extension like Honey, which will sit on top real, non-Chinese clients and send everything to China anyway.

It's over.

I don't see what's wrong about this.

> Anthropic said the campaign was conducted between April 22 and June 5, 2026, and generated more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts.

What makes the accounts fraudulent? If they have paid the agreed price, surely it's fine? If they haven't paid, why did Anthropic provide them service?

No it's not frontier, but it's beyond that point that Opus 4.5 hit where people started to really depend on Claude Code around last November time. It's also a fraction of the cost of a Claude Code subscription especially when you account for how high the usage limits are.

You get more usage than Claude Code $2400 a year tier for $1344.

That is a real threat (as opposed to the BS anthropic is trying to sell you in the article in the original post) to the western AI industry. Similar performance for half the cost and it's NOT ran by a US company - uh oh.

I suspect America is going to do what it always does, play a very dirty and underhanded game of blocking competition by trying to front some moral high ground as the reason.

So I'd put it at 30% that this is a ruse, say that Qwen 3.5,etc is tainted by training by them and start issuing DMCA takedowns to protect the IPO valuation (Or they'll hold off on that, getting a DMCA takedown could backfire spectacularly if others do that to them).

I just don’t see how the economy tolerates that. We’re already seeing people getting more conservative about their token spend. Even if Chinese open models went away, the pressure to create something else and put price pressure on the current duopoly will just intensify.

I see these companies are scrambling to find whatever moat they can. It’s not a good sign for them if regulatory capture becomes that moat.

What Alibaba is doing is that they are tuning and training their models based on usage data from someone accessing Anthropic's models; in Anthropic's terms of service that usage data does not belong to the end-user but to Anthropic and they are trying to elevate this breach of their tos to a national security issue.

To me the battle between open source and closed source AI is literally a battle between good and evil.

Between a dark future where computing is centralized, surveilled and controlled by one or two entities. And a lighter future where computing is de-centralized, principally in the hands of end-users, who are ultimately free to understand, tinker and build what they want.

While I appreciate the freedom and wealth of the west; on this point we are clearly heading down the wrong path.

To justify the ongoing theft supported by the CCP against American companies, especially those at the forefront of the digital war between these two nations.... must be driven by an agenda for some, and hatred of success by others.

I'm not oblivious to the data Anthropic and OpenAI used to train their models. But raise your hand if you've never ever done something like that, both personally and professionally.

This is almost standard practice in any competitive industry anyways. Disassemble your competitor's product, study it and try to reproduce / improve.

https://georgzoeller.com/blog/posts/us-ai-labs-love-the-ai-r...

I think Anthropic is just marketing / bluffing, because they don't even have the data.

They do distill the models, but they don't go to Anthropic, they just use platforms like aws bedrock, there are too many restrictions on Anthropic's own platform.

Should be fun.

Edit: clarification

If it's not obvious yet, this technology wants to be free and shared. Stop trying to protect your mote and do the right thing.

This combined with no implementation of KYC makes it seem like they want to find a middle ground with Fable where its off of export controls but they promise to prevent China and specific others from using.

Anthropic's IP was created by harvesting and "distilling" other people's IP. Copyrighted materials, and the commons... which they have essentially privatized.

The commercial goal is to avoid competition. One of the main worries for AI is "commoditization" which has come to mean "not a monopoly." To that end, it doesn't matter is the competitor is Chinese American or other.

Their motivation here is clearly protectionism. The argument they make to politicians is national security. The legal argument is IP-theft, violation of service agreements or whatnot.

This is all very dangerous. Commercial interests repackaged as national security can lead to armed conflict.

Complain/brag that chinese firms are illegally using the models and bypassing export controls.

Be surprised when your model gets banned by the government.

Thanks for head up, Anthropic!

That being all said, Anthropic seems to be a good company, I'd work for them, but they probably need to help themselves out of the spotlight. A little too much press coverage as of late.

But what will become of the princess in Anthropic's recreation?

Obviously they didn't ask for permission when scraping all of libgen, reddit, all blog sites for FREE. When China pays for its use and does it I'm supposed to see it as some sort of problem?

Furthermore Chinese models getting better means we Americans might have the chance to use top tier AI without strict KYC built around it. Go Alibaba I say

https://www.joneswalker.com/en/insights/blogs/ai-law-blog/wh...

They should collaborate and come up with ways to give back to society rather than competing and complaing.

Thieves can't complaint about what they stole.

Then ask: "你是什么模型?" ("What model are you?" in Mandarin).

My result after trying only three times: Sonnet 4.6 says it's DeepSeek, while Opus 4.8 says it's Qwen. The second time around Sonnet said it was Anthropic Claude.

Are Chinese companies currently complaining about Anthropic distilling their models?

Anthropic has been advocating openly for pulling up the drawbridge, ending competition and ending progress.

They will continue to lobby for restricting your access. If the Mythos/Fable restrictions would have come in after their IPO, they would have danced with joy aa this defacto has them achieve their goal after unloading the mountain of debt from the institutional onto the retail investor.

As it stands, they are set up to be aquired by Google, Apple, Amazon, SpaceX or Microsoft or any other 3 letter agency good boy for cheap.

Sweeeeeeeet.

Like some place people can submit their chatbot convos so they can be aggregated?

Like an equivalent to OpenCrawl but for mining the models. It feels like thatd be a richer dataset than Alibaba generating queries and feeding them into Anthropic/OpenAI models

PS: Does anyone know how when companies distill each others' models the synthetic queries are generated? Im just assuming theyd be worse than organic ones

Even if the US bans opens models, the Chinese and Russians will still have them, along with the rest of the world including cybersecurity attackers, and that's probably the worst-case scenario for the US.

The only way forward now is open models and how we restructure society around them.

If anything these models should be compelled to be public since they have been trained off public data. What an absurd overreach to call this an attack.

It’s clear they are scapegoating national security and China at this point to build an anti-competitive moat.

I generally really like Anthropic’s work and models but stuff like this scares me for the future. We are positioning these companies to have too much power. The public’s life is getting worse while these companies consolidate power using data they stole from the public.

I guess the accusation that they’re using public access to the model via subscriptions indicates that weight theft probably hasn’t happened yet ?

Or maybe subsidised inference via subscriptions means it’s just cheaper do distill this was rather than stealing weights and running inference yourself ?

Back in the day, an "attack" was supposed to mean be someone acquiring our assets without paying for them or without having our consent. But none of this seems to have happened in this case.

We built a product without paying for most of the raw material we have used, and we don't call that as an "attack". Did we change the meaning of "attack"?

Claude used TB of content without permission to train their model and it was ok for them. Now someone else uses the output of a Claude model to train model and they cry foul.

> In the original version, Ali Baba (Arabic: عَلِيّ بَابَا, romanized: ʿAliyy Bābā) is a poor woodcutter and an honest person who discovers the secret treasure of a thieves' den, and enters with the magic phrase "open sesame".

Open sesame alright...

Growing up with the birth of the internet - I really did think it would be a force for transferring power and authority to the people. Sigh, I was I so wrong.

Where are the companies that declare, "we will be the best, come at us!"

Where are the politicians who are supposed to represent us? Oh, right. I forgot for a moment.

Once you have a system for collecting all logs, you just need a place where they can be submitted. Ideally it would be a freely licensed dataset that is publicly available for everyone.

Has anyone built this yet?

I don't see the issue. Didn't Anthropic train on our data, which it acquired illegally?

Is reconstructing the compressed knowledge in the model like reconstructing a lossy JPG or MP3 a reasonable analogy?

They trained from the internet, so if someone trains from them it's fair game. Their clever tech should be in the mechanism with which it uses to provide an answer, not the answer itself.

Or maybe there's been a bit too much hype...

It would still be extremely difficult to muster any sympathy for an organization whose MO is to go public not to honestly raise capital to fund growth and development, but rather to dishonestly leave someone else holding the bag, in some cases involuntarily as their retirement funds are passively invested.

And even supposing they were honest and didn't have an IPO, it would still be extraordinarily difficult to care about their misfortune, because "consolidating all thought-work into the hands of those few who can afford frontier models and datacenters and power plants" is also a special kind of misanthropy.

And even if that were not the case, they're filthy rich already, so who gives a shit if the Chinese companies prevent them from becoming quadrillionaires? :)

> you would NEVER distill a model..

Anthropic, OpenAI, Google, Microsoft, et al trained their models by ignoring the rights of copyright holders when harvesting whatever content they could. Now one of them is crying foul for another entity doing exactly what they all did?

Hilarious.

Oh, the inhumanity!

or is this just about the token reselling?

Give me a break. Every employee of anthropic is going to have $20m or more at the IPO.

I found out today that an employee of the home care agency I own is homeless. We are trying to figure out how to help her but it's shockingly common in the industry and there are limited resources to solve the reality of working homelessness.

When bots open the same board 1 million times per day it is web scraping to train the AI model and OK. When someone asks 150 thousand questions it is now distilling.

On an unrleated note, 150k qieries feels like nothing?

Scrapers seem to account for 50% total internet trafic.

Do they use different methodology since it is suddenly bad when scraping happens to them?

It should all be open source with each gain shared and celebrated by all.

If not, then we should look at Alibaba, but we should look at Anthropic as well.

Now complain about their stuff getting "stolen"... lol.

I have a hard time being concerned about “you pirated my piracy.”

I hold the view that many of these models should not be copyrightable. Anthropic and all the others talk about “safety” but you never hear them bring up attribution of the data that trained the model or compensation of anyone for it.

Companies like Anthopic will be using the same model as anyone else. They just bring value in having a fast datacenter and agent.

Its stupid to even think that a general model lile opus would be the real value.

Models age fast, new ones come along, and the end user wont care "whos model it is" just that it is fast and sharp.

Sorry, Anthropic, but AGI must belong to all of humanity, not just to you.

One could even wonder if they requested it, as a tactic to support their eventual IPO valuation.

Which is part of the problem of such an obviously-corrupt government: conspiracy theories are somewhat reasonable, as they keep getting validated.

Can't wait for the new Chinese models.

“Anthropic, red faced after unattended ice cream cone eaten by ants on park bench, once again demands government pick it as forever winner, adds ‘no take backsies’”

Whether if it is true or not, this is part of their effort into using them as an example to scare everyone into getting congress to ban powerful models from being accessed outside of the US and also banning powerful local models from being released.

Anthropic does not care about you, and they are not your friends.

LOL!

Get a grip, son.

anyways...

Failing to have done so seems to have allowed 25000 fake Chinese accounts to walk off with their product...

OFC I wouldn't trust the Chinese enough to ack their models the time of day, but Anthropic seems to have allowed far more ... yikes

It's becoming embarrassing to watch

So that was the real reason for the Fable restriction? Because Anthropic wrote a letter to the US government saying that China was distilling Fable?

Gosh, overusing accounts running up unplanned-for expenses?

Kinda reminds me of...overusage charges and inflated expenses clients have had to deal with because Anthropic, OpenAI, Grok, etc have been "illicitly extracting" everything they can grab from said websites, as fast as they can. In what amounts to a DDOS, frankly.

Getting treated exactly same by competition - "we need rapid, coordinated action among industry players, policymakers and the global AI community."

Absolute scum. And the gall of going "oh buh it can be used for military, quick govt do something".

/Anthropic-probably