Anthropic: Alibaba ran the largest distillation attack ever measured against Claude — 151M+ exchanges to train Qwen

What happened

In its September 2026 threat-intelligence report, Anthropic attributed to operators affiliated with Alibaba the largest distillation attack it has ever measured: over 151 million exchanges with Claude between May and July 2026, peaking at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts. Anthropic says the operators forced Claude to write out its chain-of-thought reasoning inside inline text tags, harvested the transcripts, and used them to train Qwen 3.5, 3.6 and 3.7, targeting Opus 4.6 and 4.7. A joint NSA/CISA/FBI advisory (AA26-251A, 8 September 2026) separately names Alibaba among six China-based AI companies conducting industrial-scale distillation, saying that in late 2025 Alibaba distilled Claude-4, Claude Opus, Claude Sonnet and GPT-5 to improve Qwen's software engineering, customer-service dialogue and SFT/RL training.

Why it may matter to you

Distilling a frontier model's reasoning into a competing model is the kind of training-data practice this site tracks: it raises questions about whose work and whose terms govern model training, and about how platform terms are enforced when the extraction runs through fraudulent accounts.

What is not yet known

These are attributions by Anthropic and the US government, not findings of a court or regulator. Alibaba had not responded on the record when the Anthropic report was published. Whether any enforcement action follows is not stated in either source.