Skip to content

Analytics cookies

We use Google Analytics and Google Tag Manager to count visits and see which pages are useful. If you accept, Google Analytics may set cookies to recognise your return visits. If you decline, it sets no cookies, but Google still receives a cookieless signal for each page you view. We don’t send Google your name, email address or registration details, and you can change your choice at any time under “Cookie settings” at the bottom of the page. Privacy

Anthropic: Alibaba ran the largest distillation attack ever measured against Claude — 151M+ exchanges to train Qwen

Sep 10, 2026 · Gathered automatically from public sources. Not reviewed by a person.

What happened

In its September 2026 threat-intelligence report, Anthropic attributed to operators affiliated with Alibaba the largest distillation attack it has ever measured: over 151 million exchanges with Claude between May and July 2026, peaking at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts. Anthropic says the operators forced Claude to write out its chain-of-thought reasoning inside inline text tags, harvested the transcripts, and used them to train Qwen 3.5, 3.6 and 3.7, targeting Opus 4.6 and 4.7. A joint NSA/CISA/FBI advisory (AA26-251A, 8 September 2026) separately names Alibaba among six China-based AI companies conducting industrial-scale distillation, saying that in late 2025 Alibaba distilled Claude-4, Claude Opus, Claude Sonnet and GPT-5 to improve Qwen's software engineering, customer-service dialogue and SFT/RL training.

Why it may matter to you

Distilling a frontier model's reasoning into a competing model is the kind of training-data practice this site tracks: it raises questions about whose work and whose terms govern model training, and about how platform terms are enforced when the extraction runs through fraudulent accounts.

What is not yet known

These are attributions by Anthropic and the US government, not findings of a court or regulator. Alibaba had not responded on the record when the Anthropic report was published. Whether any enforcement action follows is not stated in either source.

Sources