AI Labs Defend Against Model Output Distillation: Meta Restricts Claude Code, Anthropic Accuses Alibaba

Anthropic publicly accused Alibaba of the largest known distillation attack on Claude, using ~25,000 fraudulent accounts to generate 28.8 million exchanges between April 22 and June 5, 2026.[1][2] A separate controversy: Anthropic embedded hidden tracking code in Claude Code — characterized as "prompt steganography" — that monitored Chinese users' timezones, proxy configurations, and potential Chinese AI lab affiliations; security researcher Thereallo publicly exposed it, and Anthropic removed it after the disclosure.[6] Alibaba blocked Claude Code in response to the tracking disclosure, not the distillation accusations it has still not addressed publicly.[8] Meta separately restricted engineers from using Claude Code and Codex to protect its own training pipelines.[11][12]

Anthropic's covert monitoring of a specific user population — using an agentic tool with permissions to read files, edit code, and run commands — directly contradicts its public anti-surveillance positioning, and was removed only after public exposure.[6] The episode shows that technical enforcement against distillation can create trust and transparency problems that outlast the enforcement rationale: Alibaba's block of Claude Code is a consequence of the tracking disclosure, not the underlying accusation.

Anthropic publicly accused Alibaba of conducting the largest known distillation attack on Claude, using approximately 25,000 fraudulent accounts to generate 28.8 million exchanges between April 22 and June 5, 2026.[1][2] The campaign specifically targeted Claude's most capable functions — agentic reasoning, software engineering, and long-horizon tasks — which Anthropic described as a brazen and illicit extraction of its AI capabilities.[1][3] Anthropic sent a confidential letter to Senators Tim Scott and Elizabeth Warren on June 10, the day before a Senate AI hearing, framing the incident as both a terms-of-service violation and a national security matter.[1] Anthropic has also cut off Chinese companies that had been accessing Claude through shell companies in Singapore, VPNs, and proxy servers.[4][5] Alibaba has issued no public response to the distillation allegations.

A separate controversy emerged around Claude Code itself. Security researcher Thereallo publicly exposed that Claude Code had been using "prompt steganography" — shorthand markers hidden in prompts — to covertly monitor Chinese users' timezones, proxy configurations, and potential affiliations with Chinese AI labs.[6] An Anthropic engineer confirmed the tracker was added in March 2026 as an experiment to prevent account abuse by unauthorized resellers — who had been selling Claude pro access for as little as $12 against the $100 retail price — and to protect against distillation attacks.[6] Rohan Paul's reporting noted that Claude Code has permissions to read files, edit code, and run commands, making hidden prompt modification more consequential than ordinary app-level telemetry, and argued that invisible characters in agentic tools set a precedent making AI agents systematically hard to audit.[7][8] Anthropic acknowledged the behavior and promised to remove it, characterizing the feature as an experiment to stop API resellers and distillation, not targeted surveillance.[9][10] Ars Technica's Ashley Belanger framed the disclosure as a direct contradiction of Anthropic's public anti-surveillance stance.[6]

The tracking disclosure prompted Alibaba to block Claude Code internally, angering Chinese developers and security staff.[8] That block responds to the fingerprinting controversy rather than the distillation accusations — Alibaba still has not addressed the latter publicly. Internal Meta documents show the company separately restricted applied AI engineers from using Claude Code and Codex, citing the risk that competitor tool outputs could enter Meta's training pipelines and constitute inadvertent distillation.[11][12] Legal experts have noted that ToS anti-distillation clauses may be difficult to enforce against foreign entities, though Anthropic's documented evidence of fake accounts and systematic API use would strengthen any enforcement case.[13]

The episode exposes a structural problem in how AI labs try to detect and stop systematic API abuse: effective detection requires covert signals, because disclosed detection methods can be circumvented, but covert signals in agentic tools with elevated permissions undermine the user trust that makes those tools valuable. Anthropic's acknowledgment and removal of the markers resolves the immediate controversy but not the underlying tension between enforcement effectiveness and transparency.